Friday, August 11th 2023
"Downfall" Intel CPU Vulnerability Can Impact Performance By 50%
Intel has recently revealed a security vulnerability named Downfall (CVE-2022-40982) that impacts multiple generations of Intel processors. The vulnerability is linked to Intel's memory optimization feature, exploiting the Gather instruction, a function that accelerates data fetching from scattered memory locations. It inadvertently exposes internal hardware registers, allowing malicious software access to data held by other programs. The flaw affects Intel mainstream and server processors ranging from the Skylake to Rocket Lake microarchitecture. The entire list of affected CPUs is here. Intel has responded by releasing updated software-level microcode to fix the flaw. However, there's concern over the performance impact of the fix, potentially affecting AVX2 and AVX-512 workloads involving the Gather instruction by up to 50%.
Phoronix tested the Downfall mitigations and reported varying performance decreases on different processors. For instance, two Xeon Platinum 8380 processors were around 6% slower in certain tests, while the Core i7-1165G7 faced performance degradation ranging from 11% to 39% in specific benchmarks. While these reductions were less than Intel's forecasted 50% overhead, they remain significant, especially in High-Performance Computing (HPC) workloads. The ramifications of Downfall are not restricted to specialized tasks like AI or HPC but may extend to more common applications such as video encoding. Though the microcode update is not mandatory and Intel provides an opt-out mechanism, users are left with a challenging decision between security and performance. Executing a Downfall attack might seem complex, but the final choice between implementing the mitigation or retaining performance will likely vary depending on individual needs and risk assessments.
Source:
Phoronix
Phoronix tested the Downfall mitigations and reported varying performance decreases on different processors. For instance, two Xeon Platinum 8380 processors were around 6% slower in certain tests, while the Core i7-1165G7 faced performance degradation ranging from 11% to 39% in specific benchmarks. While these reductions were less than Intel's forecasted 50% overhead, they remain significant, especially in High-Performance Computing (HPC) workloads. The ramifications of Downfall are not restricted to specialized tasks like AI or HPC but may extend to more common applications such as video encoding. Though the microcode update is not mandatory and Intel provides an opt-out mechanism, users are left with a challenging decision between security and performance. Executing a Downfall attack might seem complex, but the final choice between implementing the mitigation or retaining performance will likely vary depending on individual needs and risk assessments.
162 Comments on "Downfall" Intel CPU Vulnerability Can Impact Performance By 50%
However, I would like to remind everyone that this problem is NOT, repeat NOT something the general public needs to worry about. This exploit REQUIRES admin authorities. If you already have admin authorities, you don't need the exploit because you already have complete direct access to the system in question.
So let's have done with the bickering & arguing, eh?
Things that were taking a fraction of a second suddenly took over a second, I soon turned it off again. :)
What I have assumed with the registry value is as you pick a higher value it also enables any mitigations for lower values as well, however I havent verified that, it could be using an addition system, where would add the values together if you want to enable multiple mitigations.
CVE-2022-23825:CVE-2023-20569:Both are modifying the same value and both change different bits:
I am wondering if enabling both mitigations at the same time requires setting the value to 83886144 instead. The documentation isn't clear about this.
www.tomshardware.com/news/amds-inception-fix-causes-up-to-54-performance-drop
I don't think its as big a deal as affecting AVX workloads but admitedly its worse than I expected.
But then I realize that intentionally sabotaging your own product would only drive your customer to the competition.
(And don't many enterprise customers usually switch out hardware regularily anyways? Like when the warranty is expired?)I've argued for years that we should drop SMT outright. It made a lot of sense back when CPUs had few cores and a lot more pipeline stalls than today. But as the CPUs have become more advanced, the real-world benefits has shrunk, while the complexity to implement it has risen immensely. At this point the engineering effort and transistor budget cost of SMT could probably have been better spent on something else to increase IPC instead. Hopefully the rumors of dropping SMT in Arrow Lake is true.That's not how antivirus works, that's just marketing nonsense.
Under most workloads there is sub 1% hit, some 5-15% not the sensational 54% wccftech is publishing and everyone is chatterboxing.
As MariaDB was such a huge outlier, I expect there to be an update in the future that will lessen the impact.
www.phoronix.com/review/amd-inception-benchmarks/4 see for yourself.
www.phoronix.com/news/GCC-Workaround-Intel-Downfall
Intel appears to have published a GCC patch to lessen the AVX impact... but disabling the avx path for gather...?
I guess the performance impact decreased it to the point that the non-avx code path was faster? idk.
@rtb how are you reading that?
I happen to think that there is some merit to the idea that companies, like microsoft, know they're in trouble and want to find a way to force people to upgrade. Finding vulnerabilities like this is one of them. Limiting what hardware Windows can run on while killing off existing fully functional OSes is another. It's a multi-pronged approach, which is almost painfully obvious. Should be, and technically is, illegal.
Malwarebytes:
"These generic malware detections are due to our new automated signature system called BytesTotal and DDS engine that are based on Machine Learning technology with 100% autonomous learning which don’t require any human interaction to correctly identify malware.. These techniques are part of Malwarebytes’ Katana engine and were developed for automated mass detection of wide ranges of malware and adware."
"Malwarebytes detects unknown threats as Malware.AI by using Artificial Intelligence and Machine Learning techniques without any specific detection rules to protect users from malware that has not yet been researched and classified. This helps protect our customers against 0-day malware."
Malware.AI | Malwarebytes Labs
Yes, i might have missed something, yes, i might be incorrect but i would like to stand corrected with actual arguments and evidence instead of being insulted.