Intel bug incoming? Meltdown and Spectre exploits

[pete910]

<smugmode>Unless you are fortunate enough to run Linux</smugmode>

 

[Rroff]

They explain that in the subscriber-only part of that article, so the rest of us will just have to guess.

I can't see it - the only way its going to hit Intel as hard as they are making out is if someone actually successfully exploits these vulnerabilities to do a massive attack of some kind which would result in a lot of blowback for Intel - otherwise they'll just take a bit of a hit and be back to business as usual in a few months.

 

[humbug]

Get a room

 

[pete910]

Get a room

Jealous !

I can't see it - the only way its going to hit Intel as hard as they are making out is if someone actually successfully exploits these vulnerabilities to do a massive attack of some kind which would result in a lot of blowback for Intel - otherwise they'll just take a bit of a hit and be back to business as usual in a few months.

Not really, if you think about it. Say you run a large data centre/ Cloud whatever. Said update impacts parts of the services you provide. Said service takes a 20% perf hit. Find youi need to add X amount more to cover!

1. Would you be happy, then go and but x amount more intel based to cover
2. Ignore update, later on, be in a week or several years risk a exploit that compromises one of your customers. Could be insainley costly/possible jail due to known flaw.
3. Go AMD. Know the flaw does not effect AMD.Know customers are safe.Know you will not be responsible if another bug/flaw comes to light.

 

[opethdisciple]

The average home user dosn't frequent forums like OCUK. The average home user buys a laptop, PC or tablet from high street retailers. The average home user has no idea whatsoever what a "Bios" is or how to find it let alone update it. The average home user turns a PC on, uses it and turns it off.
When that PC slows to a crawl, off course they are going to notice a difference...................anyone who thinks they won't notice is living in denial, cloud cookoo land or both.

This slow down is being blown out of proportion.

My 3570k pc has been patched and I haven't noticed a scooby doo difference.

It's only in the data center where this really has an affect.

 

[Rroff]

Jealous !



Not really, if you think about it. Say you run a large data centre/ Cloud whatever. Said update impacts parts of the services you provide. Said service takes a 20% perf hit. Find youi need to add X amount more to cover!

1. Would you be happy, then go and but x amount more intel based to cover
2. Ignore update, later on, be in a week or several years risk a exploit that compromises one of your customers. Could be insainley costly/possible jail due to known flaw.
3. Go AMD. Know the flaw does not effect AMD.Know customers are safe.Know you will not be responsible if another bug/flaw comes to light.

Most companies won't switch away from their hardware like that unless maybe at the end of a contract or start of a new project, etc. but even then they tend to stick with their established platform - they might not like it but they'll mostly just increase provisioning on their existing platform - there is no guarantee another vulnerability won't come to light for either platform either so future considerations will be largely unchanged in that respect though they might take a longer look at the options next time a major upgrade, etc. or whole new systems are rolled out, etc. is done.

 

[thenewoc]

The security podcast is currently live with the twit network...

https://www.twitch.tv/twit

 

[Neil79]

Yep, that is what I have done for now. Until I see how this pans out for several weeks or so... I don’t need this horsing about just now until they get their crap together.

Going to do this as well, my PC works fine as is, I don't want this patch ruining even a minuscule amount of performance!

 

[QlimaxUK]

The security podcast is currently live with the twit network...

https://www.twitch.tv/twit

HA, when I read that link I thought it was some kind of joke

 

[drunkenmaster]

Home users aren't the reason Intel will get hit in market share, it's server and that is where vastly more money comes from. Likewise the problem here isn't immediate share price, it's the server companies that buy EPYC instead of Xeon starting from 2-3 months from now and then for the next 2-3 years, at which point AMD are then a trusted established really good option and Intel is fighting a stronger opponent in server rather than an upstart with a great chip but not much market share and not much trust.

The issue isn't how vulnerable chips are right now after the patches, it's how vulnerable they were before. Industry IT people will know full well that Intel was dramatically more vulnerable than AMD, because AMD did a few things the 'right' way while Intel took short cuts. So all in, when you're thinking about buying a new server that buyer is thinking, okay meltdown is patched but what is the next security hole, how big will it be and how likely is it to hurt Intel more than AMD, because AMD do things right and Intel take short cuts.

This will have a pretty hefty effect on Intel's bottom line but it will take a few months before new orders even start shipping so it won't be overnight, but say the second half of this year will hurt for Intel for sure. Even aside from the trust issue, which absolutely will affect sales, meltdown is causing genuine large performance drops for big server clients and seemingly many aren't happy about it already.

I would guess Intel will get hit hard from these lawsuits which I guess is by people who placed huge orders for servers between June and now... but essentially bought servers based on performance numbers and security claims that were no longer true. AMD kinda side steps that in that they would have shipped so few servers from June to the end of the year and their performance numbers were accurate and their security was pretty close to what they were claiming anyway.

 

[stockhausen]

...
because AMD did a few things the 'right' way while Intel took short cuts
...
AMD, because AMD do things right and Intel take short cuts.

To be honest, in those slightly contradictory phrases (did -vs- do) you have covered one of the three most important points.

1. Intel screwed up, AMD (for whatever reason) didn't. Intel will make 100% sure that they take more care in future and will make a point of reinforcing this to their major customers.
2. I don't know how long it takes to build a chip fabrication plant but I doubt that it happens overnight; AMD may simply be unable to ramp up production fast enough to take advantage of people's entirely justified frustration and anger at Intel.
3. Somehow I can't see WinTel being replaced by WinAMD - Microsoft have a long established relationship with Intel. I have been to conferences hosted by Microsoft and Intel, personally I have never been to a conference hosted by Microsoft and AMD.

Incidentally, I am a long-term fan of AMD and would love to see them overtake Intel in the CPU supply field.

 

[Homer-Simpson]

Doesn't look like VMWare Workstation Pro 14.0 has a patch out for it yet. I'll keep an eye on things and see what happens over the coming days.

EDIT: New notification for CVE-2017-5715:

https://www.vmware.com/security/advisories/VMSA-2018-0004.html

14.1.1 is now out.

 

[LoadsaMoney]

List of MSi mobos to get BIOS updates.

http://www.guru3d.com/news_story/msi_releases_bios_updates_to_address_recent_vulberabilities.html

 

[AS_Platinum]

Regarding VMware CPU Microcode Update Driver

"It appears that running this driver does not update the microcode early enough for the OS to recognise the "Hardware Support for Branch Target Injection mitigation"

Looking forward to seeing an BIOS update for Z77 from Gigabyte...

 

[CAT-THE-FIFTH]

https://cloudblogs.microsoft.com/mi...-and-meltdown-mitigations-on-windows-systems/

With Windows 10 on older silicon (2015-era PCs with Haswell or older CPU), some benchmarks show more significant slowdowns, and we expect that some users will notice a decrease in system performance.
With Windows 8 and Windows 7 on older silicon (2015-era PCs with Haswell or older CPU), we expect most users to notice a decrease in system performance.

For context, on newer CPUs such as on Skylake and beyond, Intel has refined the instructions used to disable branch speculation to be more specific to indirect branches, reducing the overall performance penalty of the Spectre mitigation. Older versions of Windows have a larger performance impact because Windows 7 and Windows 8 have more user-kernel transitions because of legacy design decisions, such as all font rendering taking place in the kernel. We will publish data on benchmark performance in the weeks ahead.

 

[CAT-THE-FIFTH]

This slow down is being blown out of proportion.

My 3570k pc has been patched and I haven't noticed a scooby doo difference.

It's only in the data center where this really has an affect.

Apart from the benchmarks which I posted earlier.





The first with a Haswell Core i5 and an RX580 and the second is with 6c SB CPU and a GTX1080TI.

So dependent on the system configuration,you might see a few percent drop and as MS have said older systems will be affected more.

 

[MyBrainz]

List of MSi mobos to get BIOS updates.

http://www.guru3d.com/news_story/msi_releases_bios_updates_to_address_recent_vulberabilities.html

Also,

List for ASUS Mobo's to get update..

https://www.asus.com/News/V5urzYAT6myCC1o2

Nothing for my z170 Pro Gaming yet though :-/

 

[hudson86]

List of MSi mobos to get BIOS updates.

http://www.guru3d.com/news_story/msi_releases_bios_updates_to_address_recent_vulberabilities.html

Bah, so i'm out of luck with my X79.

Problem is now, i'm very reluctant to upgrade and trust Intel, but not sure Ryzen has the ooomph in single threaded etc.

Without Bios updates on X79 how exposed am i likely to be in the future.

 

[thenewoc]

Bah, so i'm out of luck with my X79.

Problem is now, i'm very reluctant to upgrade and trust Intel, but not sure Ryzen has the ooomph in single threaded etc.

Without Bios updates on X79 how exposed am i likely to be in the future.

It's the Spectre vulnerabilities you're exposed to without the bios update AFAIK.

In the same boat with Z77 so I will be relying more on a newly patched browser and ad blocking which my AV provides. Ideally use a separate browser with only one tab open to log in to anything sensitive like banking. Along with being cautious of any software I install, hopefully will be enough to block someone from having the chance to execute code on my machine. The most common vulnerability I see being exploited will be through a rogue ad that gets served up on a site you trust so I'll be ad blocking on mass.

Will hope to limp through like this I guess until either Ryzen+ or Ryzen 2. Will be interesting to see how well each of the motherboard manufacturers handle their bios support for this fiasco and will be taking note of those doing the best job when it comes to buying my next one for Ryzen.

 

[CAT-THE-FIFTH]

It looks like some US Senators are pushing for an investigation of the Intel CEO:

https://www.bloomberg.com/news/arti...e-government-to-probe-intel-ceo-s-share-sales

U.S. Senators Urge Government to Probe Intel CEO's Share Sales

Two key U.S. senators are pushing authorities to investigate whether Intel Corp. Chief Executive Officer Brian Krzanich violated insider-trading rules when he sold off a chunk of his shares in the chipmaker late last year.
News reports that more than $20 million in share sales by Krzanich were scheduled in October of last year before the company made public that its processors were vulnerable to hackers are “troubling,” Senators Jack Reed and John Kennedy wrote in Tuesday letters to the Securities Exchange Commission and the Justice Department. Reed, a Rhode Island Democrat, and Kennedy, a Louisiana Republican, are members of the Senate Banking Committee.

“These reports are troubling not only because of the risk to nearly all phones and computers, but also because these reports raise concerns of potential insider trading,” the senators wrote. “If you uncover such violations through your examinations, we expect you to enforce our laws to the fullest extent possible.”

Read More: Intel CEO Krzanich’s Stock Sales Seen Warranting SEC Examination

The bipartisan request for an investigation adds to pressure on Intel, which has said Krzanich’s share sales were pre-arranged. Still, his most recent sales were much bigger than usual and the timing didn’t match his usual trading style, prompting securities lawyers to predict that they might draw regulatory scrutiny.

“Intel is aware of the letter released by Senators Kennedy and Reed,” the company said in an emailed statement. “We will cooperate fully with any governmental inquiries or investigations.”

An SEC spokeswoman declined to comment, while a Justice Department spokesman didn’t immediately respond to a request for comment.

The story behind how the vulnerability was discovered:

https://www.bloomberg.com/news/arti...-inside-the-semiconductor-industry-s-meltdown

It seems this was talked about a year ago!!