1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Yet another Intel CPU security vulnerability!

Discussion in 'CPUs' started by Selekt0r, Sep 10, 2019.

  1. ~>Dg<~

    Caporegime

    Joined: Jun 1, 2006

    Posts: 31,602

    Location: Notts

    its not if it is a big deal its how many posts are pro amd in here . just go look down the posts. if people cant see how pro amd it is i dont know what to say.
     
  2. Rroff

    Man of Honour

    Joined: Oct 13, 2006

    Posts: 63,853

    An interesting criteria - does that put me in with Dg's pro-AMD crowd? as I've quite a few times lately recommended the Ryzen 2600, etc. especially over the garbage Intel is putting out as the i3 and i5 lines at the moment.
     
  3. Vince

    Man of Honour

    Joined: Oct 30, 2003

    Posts: 7,769

    Location: Essex

    I'm not sure, I just don't read every post as black and white, AMD good, Intel bad, but take a much more objective view. I enjoy reading your posts on the vulnerabilities as well as others and never generally get the feeling that people are die hards one way or the other (bar a few exceptions of course).. Sure I myself have taken a few digs at Intel recently and dont think anything at all in their stack represents any sort of value right now, for the first time in a long time I'm on an all amd hedt build and I think it is great.

    None of this stopped me buying 100's of 8500 based intel systems recently simply because they fit right in at the right price. I have also openly been an advocate of epyc Rome and have purchased 3 rome based servers because again it's about value for money.
     
  4. jigger

    Capodecina

    Joined: May 28, 2007

    Posts: 11,234

    Even if we set aside the worst security problem we have ever seen and Intels performance, why wouldn’t anyone be pro AMD right now and what about being pro AMD hurts you so much?
     
  5. Rroff

    Man of Honour

    Joined: Oct 13, 2006

    Posts: 63,853

    Yeah it is important IMO to take in a range of views - so often the truth lies between two opinions even when the opinions themselves aren't necessarily wrong as such.
     
  6. jigger

    Capodecina

    Joined: May 28, 2007

    Posts: 11,234

    My concern is AMD as the only option is an ever increasing scenario so Intel needs to get it’s act together. Sadly Intel seem happy to ignore what’s going on. Three hardware revisions and I can’t see any serious attempt from Intel to stop selling b0rked hardware, while AMD have improvements across the board and worked security improvements with every hardware revision.
     
  7. Things change I've changed

    Capodecina

    Joined: Jul 27, 2005

    Posts: 11,581

    Location: The Orion Spur

    Ummmm, just built an 8700 based system and I'm really happy with it but all these security vulnerabilities have a me a bit worried.

    If I don't want to loose any performance that comes with these patches/fixes do I have to disable windows update? or is it just the bios updates I need to avoid?
     
  8. Rroff

    Man of Honour

    Joined: Oct 13, 2006

    Posts: 63,853

    There is software such as https://www.grc.com/inspectre.htm which allows you to enabled and disable the Windows mitigations at will.
     
  9. Things change I've changed

    Capodecina

    Joined: Jul 27, 2005

    Posts: 11,581

    Location: The Orion Spur

    Thank you.
     
  10. jigger

    Capodecina

    Joined: May 28, 2007

    Posts: 11,234

    You’re going to take a performance hit. Disabling Hyperthreading and virtualisation are going to really hurt performance. I lost 33% from Hyperthreading and god knows what from this mess...
     
  11. Rroff

    Man of Honour

    Joined: Oct 13, 2006

    Posts: 63,853

    For the average home user desktop/gaming system no point disabling HT - if something has got to the point of exploiting vulnerabilities there you have much bigger security/trust issues and it is the least of your worries. If you are running a server environment or server like services such as virtual machines with remote access then another story entirely and you'd be better off not using an Intel system at all.
     
  12. opethdisciple

    Capodecina

    Joined: May 18, 2010

    Posts: 18,635

    Location: London

    The best thing to do is just to disconnect your pc from the internet and restrict access to it to only yourself. That way you mitigate any risk.

    Essentially air gap the pc for max security.

    Or better yet turn it completely off.
     
    Last edited: Sep 13, 2019
  13. Rroff

    Man of Honour

    Joined: Oct 13, 2006

    Posts: 63,853

    The BIOS updates will slow things down and I don't think there is any easy way to manage that other than not installing them in the first place though some of the newer ones reduce the performance hit - some of the Windows updates also actually reduce the impact of the BIOS updates albeit you'll still be some way off the original performance.
     
  14. IT Troll

    Wise Guy

    Joined: Jun 15, 2005

    Posts: 2,290

    Location: Edinburgh

    Cheaper than the cost of change to AMD. They would rather spend that money on migrating their platform to their own silicon.
     
    Last edited: Sep 13, 2019
  15. IT Troll

    Wise Guy

    Joined: Jun 15, 2005

    Posts: 2,290

    Location: Edinburgh

    A workload which see a performance increase of 33% is a rare thing. To be running that in an environment which is at risk to these attacks is even rarer. Unlucky.
     
  16. Jimmy Weirdarms

    Gangster

    Joined: Aug 14, 2017

    Posts: 194


    False.

    Part of the reason these things are such a big deal is that we all run oodles of untrusted code, every day. It's mostly javascript and while browsers do their best not to allow scripts to exploit things like spectre and meltdown, they can't protect against everything.
     
  17. Rroff

    Man of Honour

    Joined: Oct 13, 2006

    Posts: 63,853

    It could be argued that having Hyper-threading disabled would reduce the amount of data potentially compromised in the event malware was run on the machine - but there are far easier ways for the kind of malware that target the average consumer desktop to gather information once it is able to execute on the machine. The vulnerabilities with HT are across domain security boundaries so a serious consideration in situations where you can't solicit in advance the code being executed on a machine such as the case with virtual private server providers and some other services and/or makes things a lot more serious if someone manages to execute code via things like buffer overruns in SQL services and so on.

    In the case of browser exploitation - these aren't particularly useful against the average user desktop environment as they can't trivially be used as fire and forget malware - more valuable in targetted attacks where you have some idea of what the target is and what you are going after specifically which is more applicable to intrusion into enterprise networks, etc. Browser script mitigations are fairly robust against trivial use of these exploits by malicious websites, etc.

    If you don't believe me look at the demos on https://mdsattacks.com/

    EDIT: Infact the latest lot of exploits don't depend on HT running even anyhow - just makes it easier for them - but doesn't prevent them being used if you disable it.
     
    Last edited: Sep 14, 2019
  18. zx128k

    Hitman

    Joined: May 9, 2007

    Posts: 509

    The ZombieLoad attack allows stealing sensitive data and keys while the computer accesses them.

    While programs normally only see their own data, a malicious program can exploit the fill buffers to get hold of secrets currently processed by other running programs. These secrets can be user-level secrets, such as browser history, website content, user keys, and passwords, or system-level secrets, such as disk encryption keys.

    The attack does not only work on personal computers but can also be exploited in the cloud.

    https://zombieloadattack.com/
    ZombieLoad in Action CVE-2018-12130
    In our demo, we show how an attacker can monitor the websites the victim is visiting despite using the privacy-protecting Tor browser in a virtual machine.

    https://www.pcgamesn.com/intel/zomb...y-patch-hyperthreading-mitigation-performance

    “We conclude that disabling hyperthreading, in addition to flushing several microarchitectural states during context switches, is the only possible workaround to prevent this extremely powerful attack,” a research paper describing the Zombieload flaw, authored by researchers at Graz University of Technology, Cyberus Technology, Worcester Polytechnic Institute, and KU Leuven, says.


    https://mdsattacks.com/
    RIDL and Fallout: MDS attacks CVE-2018-12126, CVE-2018-12127, CVE-2019-11091

    The RIDL and Fallout speculative execution attacks allow attackers to leak private data across arbitrary security boundaries on a victim system, for instance compromising data held in the cloud or leaking your data to malicious websites. Our attacks leak data by exploiting the 4 newly disclosed Microarchitectural Data Sampling (or MDS) side-channel vulnerabilities in Intel CPUs. Unlike existing attacks, our attacks can leak arbitrary in-flight data from CPU-internal buffers (Line Fill Buffers, Load Ports, Store Buffers), including data never stored in CPU caches. We show that existing defenses against speculative execution attacks are inadequate, and in some cases actually make things worse. Attackers can use our attacks to leak sensitive data despite mitigations, due to vulnerabilities deep inside Intel CPUs.

    RIDL
    RIDL (Rogue In-Flight Data Load) shows attackers can exploit MDS vulnerabilities to mount practical attacks and leak sensitive data in real-world settings. By analyzing the impact on the CPU pipeline, we developed a variety of practical exploits leaking in-flight data from different internal CPU buffers (such as Line-Fill Buffers and Load Ports), used by the CPU while loading or storing data from memory.

    We show that attackers who can run unprivileged code on machines with recent Intel CPUs - whether using shared cloud computing resources, or using JavaScript on a malicious website or advertisement - can steal data from other programs running on the same machine, across any security boundary: other applications, the operating system kernel, other VMs (e.g., in the cloud), or even secure (SGX) enclaves.

    Fallout
    Fallout demonstrates that attackers can leak data from Store Buffers, which are used every time a CPU pipeline needs to store any data. Making things worse, an unprivileged attacker can then later pick which data they leak from the CPU's Store Buffer.

    We show that Fallout can be used to break Kernel Address Space Layout Randomization (KASLR), as well as to leak sensitive data written to memory by the operating system kernel.

    Ironically, the recent hardware countermeasures introduced by Intel in recent Coffee Lake Refresh i9 CPUs to prevent Meltdown make them more vulnerable to Fallout, compared to older generation hardware.


    https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190013

    These vulnerabilities are known as:

      • CVE-2018-12126 - Microarchitectural Store Buffer Data Sampling (MSBDS) 
      • CVE-2018-12130 - Microarchitectural Fill Buffer Data Sampling (MFBDS)
      • CVE-2018-12127 - Microarchitectural Load Port Data Sampling (MLPDS)
      • CVE-2019-11091 - Microarchitectural Data Sampling Uncacheable Memory (MDSUM)
    To be fully protected, customers may also need to disable Hyper-Threading (also known as Simultaneous Multi Threading (SMT)).

    Potential performance impacts
    Specific performance impact varies by hardware generation and implementation by the chip manufacturer. For most consumer devices, impact on performance may not be noticeable. Some customers may have to disable Hyper-Threading (SMT) to fully address the risk from MDS vulnerabilities. In testing Microsoft has seen some performance impact with these mitigations, in particular when hyperthreading is disabled. Microsoft values the security of its software and services and has made the decision to implement certain mitigation strategies in an effort to better secure our products. In some cases, mitigations are not enabled by default to allow users and administrators to evaluate the performance impact and risk exposure before deciding to enable the mitigations. We continue to work with hardware vendors to improve performance while maintaining a high level of security.

    Mitigation strategies

    Intel has provided CPU microcode updates, and recommendations for mitigation strategies for operating system (and hypervisor) software. See Intel's Security Advisory for more details. We recommend you install the software updates provided by your operating system and/or hypervisor vendor.

    In addition, we recommend disabling Simultaneous Multi-Threading (SMT), also known as Intel® Hyper-Threading Technology, which significantly reduces the impact of MDS-based attacks without the cost of more complex mitigations. Note that you might still be vulnerable despite disabling SMT, as MDS does not strictly rely on the presence of SMT.

     
    Last edited: Sep 14, 2019
  19. zx128k

    Hitman

    Joined: May 9, 2007

    Posts: 509

    The main issue I have is if you buy an Intel processor, whats issue can you expect next and what performance the patch will cost you. So far AMD are mostly not affected. I think 8th and 9th gen Intel CPU's are okay with ZombieLoad. That's if you believe Intel.
     
    Last edited: Sep 14, 2019
  20. Harlequin

    Mobster

    Joined: Jun 17, 2004

    Posts: 2,948

    Location: Eastbourne , East Sussex.

    I must wonder, how would an FX 8x50 now perform against a 2700k/3770k in a fully patched system