Tuesday, April 3rd 2018
Intel Stops Development, Deployment of Spectre Microcode Update for Several CPU Families
Intel on their latest Microcode Revision Guidance Guide has apparently stopped development of mitigations for some of its processor families that still haven't been updated to combat the threat of Spectre. The odyssey for the return to form of security on Intel products has been a steep, and a slow one, as the company has struggled to deploy mitigations for speculative code execution on its processor families that run it. Updates for some families of products, however - such as Penryn, Wolfdale, Bloomfield and Yorkfield, among others - are apparently not going to get an update at all.
The state on the "Production Status" for mitigations for these families has been updated from their "Planning" or "Pre-Beta" state that can be found on Intel's March 6th 2018 Microcode Revision Guidance Guide, to a new, previously unseen "Stopped" state in their latest version of the Guide, published on April 2nd.
The reasons for this "Stopped" state, as Intel puts it, are that "After a comprehensive investigation of the microarchitectures and microcode capabilities for these products, Intel has determined to not release microcode updates for these products for one or more reasons including, but not limited to the following: a) Micro - architectural characteristics that preclude a practical implementation of features mitigating Variant 2 (CVE - 2017 - 5715 ); b) Limited Commercially Available System Software support; c) Based on customer inputs, most of these products are implemented as "closed systems" and therefore are expected to have a lower likelihood of exposure to these vulnerabilities."
If any one system with this vulnerability does get exploited via a method that could be averted by the implementation of a now "Stopped" patch, though, Intel should start reeling in those lawyers back into the fold.
Sources:
Microcode Revision March 6th, Microcode Revision April 2nd, Thanks @ User Digitama!
If any one system with this vulnerability does get exploited via a method that could be averted by the implementation of a now "Stopped" patch, though, Intel should start reeling in those lawyers back into the fold.
46 Comments on Intel Stops Development, Deployment of Spectre Microcode Update for Several CPU Families
So legacy systems inside network are most likely unpatched and I find legacy systems to be the most apparent attack vector. Right after marketing, ofcourse :)
Made worse by insider trading and the fact that Intel knew about these issues before they launched Coffee Lake.
"I have i7 4790k @ 4.5Ghz and ASUS Z97 Maximus Vii Hero. I called ASUS customer support last week, and the customer supporter said they are not sure if the Z97 board will get new BIOS update for Spectre vulnerability and possibility no more BIOS update because my board and other ASUS Z97 boards are not in production anymore. But if ASUS released BIOS update for the X99 boards, than how come not Z97 board as well? Both chip support 4th and 5th gen CPU."
Asus is the top motherboard supplier in the world, so if they don't patch, I'm guessing no others will go further back than Skylake. Their list of laptops and pre-built machines that received BIOS updates only seems to cover Kaby Lake systems. www.asus.com/News/YQ3Cr4OYKdZTwnQK
Edit1: In case you were only looking through Forum view, look at the piece through the main news interface, and you'll see the links and sources.
They sold the CPUs, the CPUs are still in widespread use, the CPUs have a design flaw that needs correcting.
Intel are basically giving AMD free marketing here lol.
Processors are not operating systems. If there is a hardware vulnerability, it needs to be patched. Especially for things like the core 2, which is still widely used and represents a large attack surface.
Not everyone is on the "replace hardware every 2 years' train. 5 years should be the bare MINIMUM for support of any kind, 10 years is getting closer. There is just no need to stop supporting old hardware when it still works.