Wednesday, January 3rd 2018
Dear Intel, If a Glaring Exploit Affects Intel CPUs and Not AMD, It's a Flaw
Intel tried desperately in a press note late Wednesday to brush aside allegations that the recent hardware security-vulnerability are a "bug" or a "flaw," and that the media is exaggerating the issue, notwithstanding the facts that the vulnerability only affects Intel x86 processors and not AMD x86 processors (despite the attempt to make it appear in the press-release as if the vulnerability is widespread among other CPU vendors such as AMD and ARM by simply throwing their brand names into the text); notwithstanding the fact that Intel, Linux kernel lead developers with questionable intentions, and other OS vendors such as Microsoft are keeping their correspondence under embargoes and their Linux kernel update mechanism is less than transparent; notwithstanding the fact that Intel shares are on a slump at the expense of AMD and NVIDIA shares, and CEO Brian Kraznich sold a lot of Intel stock while Intel was secretly firefighting this issue.
The exploits, titled "Meltdown," is rather glaring to be a simple vulnerability, and is described by the people who discovered it, as a bug. Apparently, it lets software running on one virtual machine (VM) access data of another VM, which hits at the very foundations of cloud-computing (integrity and security of virtual machines), and keeps customers wanting cost-effective cloud services at bay. It critically affects the very business models of Amazon, Google, Microsoft, and Alibaba, some of the world's largest cloud computing providers; and strikes at the economics of choosing Intel processors over AMD, in cloud-computing data centers, since the software patches that mitigate the vulnerability, if implemented ethically, significantly reduce performance of machines running Intel processors and not machines running AMD processors (that don't require the patch in the first place). You can read Intel's goalpost-shifting masterpiece after the break.
Linus Torvalds wrote an interesting comment on one of his Linux kernel mailers.
The exploits, titled "Meltdown," is rather glaring to be a simple vulnerability, and is described by the people who discovered it, as a bug. Apparently, it lets software running on one virtual machine (VM) access data of another VM, which hits at the very foundations of cloud-computing (integrity and security of virtual machines), and keeps customers wanting cost-effective cloud services at bay. It critically affects the very business models of Amazon, Google, Microsoft, and Alibaba, some of the world's largest cloud computing providers; and strikes at the economics of choosing Intel processors over AMD, in cloud-computing data centers, since the software patches that mitigate the vulnerability, if implemented ethically, significantly reduce performance of machines running Intel processors and not machines running AMD processors (that don't require the patch in the first place). You can read Intel's goalpost-shifting masterpiece after the break.
Intel Responds to Security Research Findings==END==
Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed. Intel believes these exploits do not have the potential to corrupt, modify or delete data.
Recent reports that these exploits are caused by a "bug" or a "flaw" and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices - with many different vendors' processors and operating systems - are susceptible to these exploits.
Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.
Intel is committed to the industry best practice of responsible disclosure of potential security issues, which is why Intel and other vendors had planned to disclose this issue next week when more software and firmware updates will be available. However, Intel is making this statement today because of the current inaccurate media reports.
Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied.
Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers.
Linus Torvalds wrote an interesting comment on one of his Linux kernel mailers.
From Linus Torvalds <>
Date Wed, 3 Jan 2018 15:51:35 -0800
Subject Re: Avoid speculative indirect calls in kernel
On Wed, Jan 3, 2018 at 3:09 PM, Andi Kleen wrote:
> This is a fix for Variant 2 in https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
> Any speculative indirect calls in the kernel can be tricked to execute any kernel code, which may allow side channel attacks that can leak arbitrary kernel data.
Why is this all done without any configuration options?
A *competent* CPU engineer would fix this by making sure speculation doesn't happen across protection domains. Maybe even a L1 I$ that is keyed by CPL.
I think somebody inside of Intel needs to really take a long hard look at their CPU's, and actually admit that they have issues instead of writing PR blurbs that say that everything works as designed.
.. and that really means that all these mitigation patches should be written with "not all CPU's are crap" in mind.
Or is Intel basically saying "we are committed to selling you shit forever and ever, and never fixing anything"?
Because if that's the case, maybe we should start looking towards the ARM64 people more.
Please talk to management. Because I really see exactly two possibibilities:
Intel never intends to fix anything
OR
these workarounds should have a way to disable them.
Which of the two is it?
Linus
53 Comments on Dear Intel, If a Glaring Exploit Affects Intel CPUs and Not AMD, It's a Flaw
@R-T-B
Well, I know from AV side that a lot of tools and protection features use virtualization for malware analysis or protection itself. If malware in such environment can still access the rest, that's a huge issue. Of course, I'm not gonna rush selling my system straight away, but I'll keep an eye on the situation. I never made big of a deal of Intel flaws that were fixable with firmware or OS microcode. But this one is a big one. And the fact that Intel was trying to cover it up, sell stocks in the meanwhile and god knows what else you kinda lose trust in such company. I know money is money and every company goes into damage control, but still...
As for the bug itself, it was revealed ~3 quarters back so yes everyone has a right to blame Intel.
Details for this crap became public 2 days ago. While researchers and patch authors definitely knew, not everyone in the decisions chain did.
www.amd.com/en/corporate/speculative-execution
As for my next desktop/home server build, I'll be going for Ryzen 2 for sure. Even though it is very unlikely this bug would cause any real damage to a PC locally assuming the user has some basic computer knowledges and is vigilant, with the kind of attitude Intel has expressed towards the issue why should I keep supporting their products? I was a long time AMD user from the original K7 up until Phenom II. I only switched over to the dark side (Lynnfield i7) because of the huge disappointment of bulldozer. Now it's time to switch back.
These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running on them.
security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
spectreattack.com/
Interesting that some ARM variants seem to be vulnerable to Meltdown as admitted by ARM themselves. Researchers did leave ARM and AMD vulnerability a bit of an open question in the paper.
Spectre seems to be the more critical one though as mitigation is much more complex.
Is this an editorial???
PS: Btarunr, you know I love you and the whole TPU group like family, so remember this is constructive criticism when I say:
Mark yo' shit.
I really wonder now if this wasn't used by any number of nefarious elements, NSA or criminals, in the past?
www.dsogaming.com/news/windows-10-intel-security-update-is-now-available-six-triple-a-games-tested-in-cpu-bound-scenarios/
Not sure why there's a huge space after my post either. That wasn't there when I was posting and I can't delete it. :confused:
I was confused because there is more than one spectre type.