• Competitor rules

    Please remember that any mention of competitors, hinting at competitors or offering to provide details of competitors will result in an account suspension. The full rules can be found under the 'Terms and Rules' link in the bottom right corner of your screen. Just don't mention competitors in any way, shape or form and you'll be OK.

New Intel vulnerability: SPOILER

DragonQ

DragonQ

DragonQ

Soldato
Joined
13 Jun 2009
Posts
6,872
Affects all Intel "Core" CPUs going back to Nehalem. Sources:

The Register article
TechRadar article
The original paper

Paper said:
Spoiler is not a Spectre attack. The root cause for Spoiler is a weakness in the address speculation of Intel’s proprietary implementation of the memory subsystem which directly leaks timing behavior due to physical address conflicts. Existing spectre mitigations would therefore not interfere with Spoiler.
Click to expand...

TechRadar said:
And worryingly, the researchers believe that not only is Spoiler unaffected by any existing countermeasures for the likes of Spectre, but that it can’t be easily mitigated against without, in their words, “significant redesign work at the silicon level”.
Click to expand...

The Register said:
Moghimi doubts Intel has a viable response. "My personal opinion is that when it comes to the memory subsystem, it's very hard to make any changes and it's not something you can patch easily with a microcode without losing tremendous performance," he said.
Click to expand...

It should be noted that although these articles state that ARM and AMD CPUs seem unaffected, the paper indicates that the only AMD architecture tested was Bulldozer, so it may affect Ryzen also. I assume this'll be confirmed over the coming weeks.
 
~>Dg<~ said:
" so it may affect Ryzen also " looks at title lol . almost daily mail . :D
Click to expand...
How so? The authors of the paper suggest it doesn't affect AMD or ARM architectures, I am just being a bit more cautious after reading through parts of the paper. Ostensibly it is an Intel flaw, unless further information arises.

StriderX said:
Mega oof, why is this all coming out now?
Click to expand...
Cyber security has become a much bigger focus in both academia and national security institutions around the world over the past half-decade or so. The more you probe, the more you'll find I suppose. AMD has an advantage simply because their architecture is newer and thus they probably treated security more seriously when designing it. Back when Nehalem was being designed I doubt security was as high on Intel's agenda as it would be now, and because today's architectures are still based on it anything affecting Nehalem will probably affect everything up to Coffee Lake Refresh.
 
will you edit the title to say it effects amd at a later date ? its a scare thread yet it is clearly pointed at intel only yet you dont even know if it effects amd.
 
~>Dg<~ said:
will you edit the title to say it effects amd at a later date ?
Click to expand...
Anyone can ask a mod to change it if it happens.

its a scare thread yet it is clearly pointed at intel only yet you dont even know if it effects amd.
Click to expand...
It's "pointed at Intel" (whatever that means) because it has been demonstrated on a dozen variants of Intel CPUs. If someone found a bug in Windows would you prefer the headline be "Bug found in OSs" because Linux hadn't been tested? Give it a rest.
 
DragonQ said:
It should be noted that although these articles state that ARM and AMD CPUs seem unaffected, the paper indicates that the only AMD architecture tested was Bulldozer, so it may affect Ryzen also. I assume this'll be confirmed over the coming weeks.
Click to expand...

Pretty much all CPUs with an implementation of speculative load, etc. are affected to some degree by memory disambiguation problems - I believe Zen is patchable at a software level, per application, at a performance penalty while older AMD CPUs are less affected but also part of why they don't perform that great for some tasks in the first place.

Aslong as it can be mitigated within a web-browser or similar internet facing application where a remote site can execute certain types of commands at will the vulnerability for home users is pretty much non-existent which should be possible at software level and stuff like javascript is already slow enough the performance impact isn't much of an issue. Like with other vulnerabilities of this nature for the average home user aslong as you have the appropriate browser patches if something is taking advantage of this kind of vulnerability you have bigger security issues to worry about.

For server, etc. type usage these kind of problems are becoming a potential nightmare.
 
At least my old Core Duo laptop is safe!

Another massive blow to Intel CPU's in the server space, how many more of these have been found but not yet reported, Intel were told about this in December I'd have expected a response from them prior to this bring released by the publisher of the exploit.
 
Journey said:
At least my old Core Duo laptop is safe!

Another massive blow to Intel CPU's in the server space, how many more of these have been found but not yet reported, Intel were told about this in December I'd have expected a response from them prior to this bring released by the publisher of the exploit.
Click to expand...

Intel will have to go back to making Q6600s :p
 
CuriousTomCat said:
I wonder exactly how many corners were cut to give Intel a 15% IPC lead
Click to expand...

I'm not sure it is so much cutting corners - maybe a certain underestimating how far some people would go to try and exploit stuff like this but a lot of the problem is just how long these architectures have existed for.

You see it with other hardware as well - for instance routers that for the first few years were considered pretty secure but after they've been out for a decade or so suddenly there is a flood of vulnerabilities found for the chipset used.
 
Rroff said:
I'm not sure it is so much cutting corners - maybe a certain underestimating how far some people would go to try and exploit stuff like this but a lot of the problem is just how long these architectures have existed for.

You see it with other hardware as well - for instance routers that for the first few years were considered pretty secure but after they've been out for a decade or so suddenly there is a flood of vulnerabilities found for the chipset used.
Click to expand...
Indeed, pretty much anything connected to the internet these days is getting more vulnerable by the year.
 
DragonQ said:
It's "pointed at Intel" (whatever that means) because it has been demonstrated on a dozen variants of Intel CPUs. If someone found a bug in Windows would you prefer the headline be "Bug found in OSs" because Linux hadn't been tested? Give it a rest.
Click to expand...

Just DG defending his beloved intel, as always.
 
DragonQ said:
I already explained this in the OP: they only tested Bulldozer.
Click to expand...

Its very odd that they tested all Core series Intel CPU's but only Bulldozer from AMD.

Having said that i have a suspicion they never will test Zen, i have read the original PDF, this exploit is part of the same Spectre speculative memory execution insecurity, something that was also found to be true for AMD's Bulldozer architecture but not Zen, it may explain why they tested Bulldozer but not Zen.
 
Yay more patches and performance regression for my Intel server estate and the potential of loads more work organising patching again. Can't wait to replace this Intel junk this year. From an Intel house to actively avoiding Intel kit within 18 months, they are doing a cracking job at killing their name in the server space.
 
You must log in or register to reply here.
Back
Top Bottom