Intel bug incoming? Meltdown and Spectre exploits

[pete910]

Serious problem or hot air?

https://www.reddit.com/r/sysadmin/comments/7nl8r0/intel_bug_incoming/
More complicated hardware gets the more likely this will happen I suppose, irrelevant of size of company.

Edit: Info

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
Some initial benchmarks

https://www.phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2

Intel patch problems

https://techcrunch.com/2018/01/22/linus-torvalds-declares-intel-fix-for-meltdown-spectre-complete-and-utter-garbage/

 

[pete910]

Not likely to have any implications to 90% of people posting here, really.

There are a few of us that use VM's though, not that It will likely make that much to us that have the odd VM running

 

[pete910]

Have to wonder why theres an embargo?

 

[pete910]

I know there was a patch for the linux kernel on boxing day as to make sure PTI is disabled on AMD cpus. So I guess there is something afoot regards the security.

 

[pete910]

Lol,

redesign of the Linux and Windows kernels

Am not saying that it's obviously been a PITA as appears to be fairly bad hole that's needed to be plugged, but stating a redesign is somewhat sensationalized I feel.

 

[pete910]

Hmmm to believe patch notes or believe a news site??
I guess we'll see soon.

Devs that's done patches wont know the actual perf hit until these things are tested either

 

[pete910]

From his testing he actually states most workloads show 5%. Of course any performance hit isn't good but we know how these things go. Hyperbole most of the time.

Which patch/dev are you referring too ?

 

[pete910]

Rather costly then by the looks of it it seems

https://www.phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2

File IO and SQL seem to be the worst hit.

 

[pete910]

The reputable outlets will probably report on it tomorrow when the embargo is up.

Perf on the desktop for what I read yesterday was not the concern it was server but more importantly the actual security hole.

I'm still wanting to know why there is an embargo on it when this was known in October ? That with the fact Intel's own CEO dumping stock toward end of November does not help the issue

 

[pete910]

I'm not sure about October, and Intel's CEO can't just sell stock willy nilly, you can find all of his form 4 filing history here, the sales are made under a 10b5-1 plan to avoid insider trading. A lot of this info is public for a reason.

To be fair there is a blackhat event in 2016 that touched on part of this flaw, I'll dig to see if I can find it. was rather in depth iirc

Also here's intel's CEO stock dump I was referring to

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

 

[pete910]

@pete910 but that's not dumping stock, 10b5-1 plans have predetermined dates when a predetermined number of shares are sold in order for insiders (like CEOs) of publicly traded companies to avoid insider trading related issues. That sale was going to happen regardless of any variation in Intel's stock value, most CEOs do 10b5-1s.
That fool.com article is pure fud and they should know better if they're a finance outlet.

To be fair stock/shares are not my thing. To me looks like dumping a shed load .

 

[pete910]

I think you mean reference 6 "Gruss, D., Maurice, C., Fogh, A., Lipp, M., Mangard, S.: Prefetch Side-Channel Attacks: Bypassing SMAP and Kernel ASLR. In: CCS’16 (2016)" that the KAISER research paper cites. The KAISER paper itself is an interesting read - what I want to know if whether KAISER is actually a more feasible solution than KPTI, but haven't yet delved in deep enough.

Edit: just to answer myself - KPTI is derived from KAISER. What prompted my question is that the KAISER paper claims "the performance impact of KAISER is only 0.28%" but in practice there can be a rather larger performance penalty for some apps/benchmarks.

That sounds the one, I have/had the pdf of it somewhere.

Edit: Found it https://www.blackhat.com/docs/us-16...Layout-Randomization-KASLR-With-Intel-TSX.pdf

No word on if AMD are affected or not yet...

No, there not. The security flaw that is .

 

[pete910]

I saw that Linux kernel submission earlier. It's interesting that at the bottom it shows the diff between their submisison and the prevoius version. So there is a version out there which assumes that all CPU's are affected. So the first patch might also hit AMD until a second patch is released. I'm sure this will be released quickly under Linux since we can see that the patch has been submitted by AMD themselves. But how quickly for Windows since only MS have control over it?

Already pulled into the kernel tree , Linus himself did it

Edit :
Wasn't Linus it was another maintainer that pulled it into here the tip/tip.git tree


https://www.phoronix.com/scan.php?page=news_item&px=Linux-Tip-Git-Disable-x86-PTI

It's not unique to Intel, but what they carefully avoided saying in that statement is that the patch to fix it does not hit performance on AMD systems, whereas is does hit performance on Intel systems in cloud /data centers.

Yes it does hit amd perf wise but the patch/fix is not needed on AMD CPU's thus irrelevant

 

[pete910]

Phoronix guy is delving deeper in

https://www.phoronix.com/scan.php?page=article&item=linux-more-x86pti&num=1

Looks to be doing some extensive testing too, seems apt as its more server perf that's the worry here not so much average joe desktop.

 

[pete910]

indeed.

Personally, i think AMD Windows users are getting shafted whatever happens, even if they don't need the fix.

I would have thought they would do it similarly to how LInux is, as in if a AMD CPU is detected the patch/fix is not enabled

 

[pete910]

But AMD are affected by one of the exploits as far as I have read (they are after all commenting on the "exploits" as a whole)

Zen is not for either,

Info here for those interested
https://googleprojectzero.blogspot.co.uk/

 

[pete910]

Niiiiiiiiice. Open source rocks


I expect I'm in for a few days of hell at work trying to schedule emergency patching on hundreds of servers

Lol, just amended my post , read as Linus but was a different maintainer

Having said that, the AUR guys have pulled it in too.

 

[pete910]

Amds architecture may well be able to fix this issue since they can do a lot more at the microcode level than intel can.
However being vulnerable to even one of the exploits means they will have to suffer the performance hit of the patch hopefully for the short term.

Not sure which vulnerability you mean but, the patch that causes the perf hit is solely for PTI code on intel CPUS.

 

[pete910]

This is what Linus thinks of Intel atm.


https://lkml.org/lkml/2018/1/3/797

 

[pete910]

AMD's unpatch:

if (c->x86_vendor != X86_VENDOR_AMD)
          setup_force_cpu_bug(X86_BUG_CPU_INSECURE);

Translation

Paraphrased in English:
"If the CPU isn't AMD, assume it's not secure."

AMD's pr need to all over that I think