Friday, August 11th 2023
"Downfall" Intel CPU Vulnerability Can Impact Performance By 50%
Intel has recently revealed a security vulnerability named Downfall (CVE-2022-40982) that impacts multiple generations of Intel processors. The vulnerability is linked to Intel's memory optimization feature, exploiting the Gather instruction, a function that accelerates data fetching from scattered memory locations. It inadvertently exposes internal hardware registers, allowing malicious software access to data held by other programs. The flaw affects Intel mainstream and server processors ranging from the Skylake to Rocket Lake microarchitecture. The entire list of affected CPUs is here. Intel has responded by releasing updated software-level microcode to fix the flaw. However, there's concern over the performance impact of the fix, potentially affecting AVX2 and AVX-512 workloads involving the Gather instruction by up to 50%.
Phoronix tested the Downfall mitigations and reported varying performance decreases on different processors. For instance, two Xeon Platinum 8380 processors were around 6% slower in certain tests, while the Core i7-1165G7 faced performance degradation ranging from 11% to 39% in specific benchmarks. While these reductions were less than Intel's forecasted 50% overhead, they remain significant, especially in High-Performance Computing (HPC) workloads. The ramifications of Downfall are not restricted to specialized tasks like AI or HPC but may extend to more common applications such as video encoding. Though the microcode update is not mandatory and Intel provides an opt-out mechanism, users are left with a challenging decision between security and performance. Executing a Downfall attack might seem complex, but the final choice between implementing the mitigation or retaining performance will likely vary depending on individual needs and risk assessments.
Source:
Phoronix
Phoronix tested the Downfall mitigations and reported varying performance decreases on different processors. For instance, two Xeon Platinum 8380 processors were around 6% slower in certain tests, while the Core i7-1165G7 faced performance degradation ranging from 11% to 39% in specific benchmarks. While these reductions were less than Intel's forecasted 50% overhead, they remain significant, especially in High-Performance Computing (HPC) workloads. The ramifications of Downfall are not restricted to specialized tasks like AI or HPC but may extend to more common applications such as video encoding. Though the microcode update is not mandatory and Intel provides an opt-out mechanism, users are left with a challenging decision between security and performance. Executing a Downfall attack might seem complex, but the final choice between implementing the mitigation or retaining performance will likely vary depending on individual needs and risk assessments.
162 Comments on "Downfall" Intel CPU Vulnerability Can Impact Performance By 50%
well AMD also have some of their own ofc ... but still ...
You have to take the dog for a walk, find a stick, throw the stick, have the dog get stung by a bee so the dog runs into a lady with an umbrella who throws the umbrella that gets caught in a gust of wind and flies off to impale a pigeon flying nearby that lands on a mans lap, so he throws his briefcase right as he unlocked it and it goes past your eyes so you can get a glimpse of the contents in the reflection of the poop from the pigeon on your shoe.
Or like with ChatGPT where it wouldnt tell you certain forbidden things, but you could ask it to tell you a story about it while pretending to be your grandmother telling a bedtime story and it bypassed the security check - sometimes you just can't predict these things in advance and fixing them could break a thousand other things, or create even worse vulnerabilities.
So many of these attacks tie into SMT/hyperthreading, makes me wonder if that'll die off with E/C cores now.
These news are way more important for businesses than for us, imo.
And before anyone says it, there will not be any JS based exploits one can load in a browser page. It's detailed in the description;
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40982
"Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access."
Admin/Root access is required in addition to local(direct physical) access to the system in question. Remote exploitation is not possible without direct user action and interaction.Oh please with that tin-hat nonsense...
Put another way, this is very nearly nothing-sauce. The user does NOT need to worry about it.
Don't care use linux. Add in grub mitigations=off and run it like in 2010.
But I'm not getting into this silly debate/argument.
From the CVSS v3.1 specification:
This means that making a user visit a compromised website is also considered "local". So potentially this vulnerability could be exploited "remotely" via a web browser.That's not true. In CVSS v3 and never direct physical requirement is denoted by AV: P - Physical.
Please read the actual paper as well. It clearly states that the exploit works from non-admin accounts: