ÆPIC Leak is an Architectural CPU Bug Affecting 10th, 11th, and 12th Gen Intel Core Processors

[Makaveli]

Yep, and herein lies the REAL problem, as a lot of IT departments today are manned by 1st time rookies and/or amateurs with little to no hands on experience, who were hired in at just above minimum wage and have neither the competence nor the ability/desire to actually do any REAL work, aside from sittin on their collective duffs playing on their phones, and pick up their paychecks on payday... yea they can help you reset your password or ask the holier than thou question of "did you try restarting your computer"... but beyond that it takes them a long time to figure out how to solve everyday issues, cause they have to "look into it".. ie search google for a fix !

On the other end are the "IT Managers" or "SVP of Technology & Infrastructure", who get paid ALOT of money to sit around in meetings with the other execs, dreaming up IT budgets for the upcoming fiscal year while minimizing costs and expenditures, and push out memos about how up to date the company is and how the "forward thinking plans" they are developing will "keep the company on the cutting edge" of technology.... most of which sound as bad or worse than the marketing garbaggio that is dreamed up the press releases we see posted here.

lol i'm in a 20+ year IT career and this sums it up nicely. Its why I prefer to work alone!!

 

[TheoneandonlyMrK]

lol i'm in a 20+ year IT career and this sums it up nicely. Its why I prefer to work alone!!

He didn't have it quite right though did he, he didn't mention cloud or web based tools, our IT team and most others are only reachable through a request in a web app, just like HR, health and safety, higher management, all in the cloud's on there mobiles.

 

[Makaveli]

He didn't have it quite right though did he, he didn't mention cloud or web based tools, our IT team and most others are only reachable through a request in a web app, just like HR, health and safety, higher management, all in the cloud's on there mobiles.

It will depend on environment. When I was at a large organization your example was more the normal.At the current place i'm at which is more small to medium size there isn't too much cloud based stuff except for external client projects for the most part. And there are both positives and negative to each size, but I won't go to far on this as its abit off topic for this thread but interesting topic still.

 

[Patriot]

P4-630 is right SGX was removed from Alder Lake and so would be unaffected by this bug. In fact there was a lot of coverage that it would not be supporting 4K Bluray playback.

Nope this is a new one, the new SGX vulnerability was last week, this is not a side channel... kinda.

 

[jeffw111]

Nope this is a new one, the new SGX vulnerability was last week, this is not a side channel... kinda.

I think you missed what I was saying here Alder Lake which is 12th Gen doesn't even have SGX so it would not be affected by this issue.

 

[Solaris17]

SGX so it would not be affected by this issue.

That's not true, only that it can also be leaked via SGX which would need a patch. All of these systems are affected by APIC MMIO.

 

[johnspack]

Chances of the average user to ever be a victim of any of these exploits..... zero. Unless you actually want to sabotage your own computer. Most won't .
These are all exploits that someone would have to use on a company network where they are trusted and have admin access.

 

[Patriot]

I think you missed what I was saying here Alder Lake which is 12th Gen doesn't even have SGX so it would not be affected by this issue.

A privileged attacker (Administrator or root) is required to access APIC MMIO. Thus, most systems are safe from ÆPIC Leak. However, systems relying on SGX to protect data from privileged attackers would be at risk, thus, have to be patched.

This requires root OR SGX So bad actor ON network... so non-issue on 12th gen, returning issue on 13th gen with SGX coming back... lol.

This is not an SGX side channel, this is an APIC direct attack. However, on systems with SGX present root can be gained as a pivot point...

 

[AlwaysHope]

Yep, and herein lies the REAL problem, as a lot of IT departments today are manned by 1st time rookies and/or amateurs with little to no hands on experience, who were hired in at just above minimum wage and have neither the competence nor the ability/desire to actually do any REAL work, aside from sittin on their collective duffs playing on their phones, and pick up their paychecks on payday... yea they can help you reset your password or ask the holier than thou question of "did you try restarting your computer"... but beyond that it takes them a long time to figure out how to solve everyday issues, cause they have to "look into it".. ie search google for a fix !

On the other end are the "IT Managers" or "SVP of Technology & Infrastructure", who get paid ALOT of money to sit around in meetings with the other execs, dreaming up IT budgets for the upcoming fiscal year while minimizing costs and expenditures, and push out memos about how up to date the company is and how the "forward thinking plans" they are developing will "keep the company on the cutting edge" of technology.... most of which sound as bad or worse than the marketing garbaggio that is dreamed up the press releases we see posted here.

You nailed it there! that's why I bailed out of the industry over a decade ago.

 

[P4-630]

It seems also AMD gets is issues

New Vulnerability Affects All AMD Zen CPUs: Threading May Need to Be Disabled

Side-channel SQUIP vulnerability affects all SMT-enabled Zen CPUs.

www.tomshardware.com

 

[ExcuseMeWtf]

There is so much FUD potential in news like this tbh.

In my opinion any piece regarding this should clearly state early on whether it requires physical access or can be exploited remotely, which is exactly the piece of information vast majority of us needs to know to evaluate how concerning it is.

 

[mplayerMuPDF]

It seems also AMD gets is issues

New Vulnerability Affects All AMD Zen CPUs: Threading May Need to Be Disabled

Side-channel SQUIP vulnerability affects all SMT-enabled Zen CPUs.

www.tomshardware.com

Glad I disabled that a long time ago. I don't mind my 2600 lite being a reborn Phenom II X6 at all. Just happy I was actually able to buy a hexacore CPU.

 

[Makaveli]

Glad I disabled that a long time ago. I don't mind my 2600 lite being a reborn Phenom II X6 at all. Just happy I was actually able to buy a hexacore CPU.

This is not an exploit you would see being used on a home pc. Its would affect servers and cloud environments.

 

[AlwaysHope]

Glad I disabled that a long time ago. I don't mind my 2600 lite being a reborn Phenom II X6 at all. Just happy I was actually able to buy a hexacore CPU.

You mean a 2600 hexacore with significant improvement in clock cycle efficiency compared to Phenom II X6 right ?

 

[mplayerMuPDF]

You mean a 2600 hexacore with significant improvement in clock cycle efficiency compared to Phenom II X6 right ?

I mean 1600 AF (which is Zen+-based and basically a 200 MHz (300 MHz boost) slower 2600, hence "2600 lite") with SMT disabled. So, yes, basically a much more efficient Phenom II X6. During the Phenom II era, I was using a T2370 (low-end Core 2 Duo based CPU with Intel GMA X3100 IGP) laptop LOL.

 

[Assimilator]

There is so much FUD potential in news like this tbh.

In my opinion any piece regarding this should clearly state early on whether it requires physical access or can be exploited remotely, which is exactly the piece of information vast majority of us needs to know to evaluate how concerning it is.

The vast majority of these cleverly-named attacks are mostly FUD. But security researchers have figured out the easy way to get themselves noticed is to find one of these vulnerabilities, give it a cool name, then spam it EVERYWHERE - with the result that the public becomes consequently ever-less-interested (the "boy who cried wolf" scenario).

 

[Mussels]

Nyah


Hope theres a firmware fix, that sounds even worse than the typical side channel attacks - and some of those had mitigtations that royally sucked

There is so much FUD potential in news like this tbh.

In my opinion any piece regarding this should clearly state early on whether it requires physical access or can be exploited remotely, which is exactly the piece of information vast majority of us needs to know to evaluate how concerning it is.

Good thing TPU's article does, without a misleading title


Right on the front page too

A privileged attacker (Administrator or root) is required to access APIC MMIO. Thus, most systems are safe from ÆPIC Leak. However, systems relying on SGX to protect data from privileged attackers would be at risk, thus, have to be patched

Like most of these risks it requires local admin access, the risk here is that SGX is bypassed and it's not a side channel attack - one disclosed for ryzen recently had to run the attack on a real core, to access data from the attached SMT thread - that's not just admin/root access but also screwing with running processes and locking them to specific cores and threads to work

Getting stale data seems risky, as an attack could potentially harvest a lot over time

 

[tpu7887]

Yes, when a vulnerability needs to have root access to work, the attacker already owns the system.
The only concern would be if this can be executed across VMs, which really only applies to cloud services, but sensitive/critical services should never run in the cloud anyways. Anyone in the industry knows security is done in layers; If there is a bug in hardware, firmware or the OS, usually the higher levels will protect until the problem is resolved/mitigated. In the public cloud, if there is a hardware or hypervisor bug, then all the other security measures can be bypassed.


It's hard to measure competence in IT, which is probably contributing to a lot of unqualified staff, and this is even a problem for "experienced" staff, some people just never know what they're doing or don't care.
I once saw a company wanting to ramp up their security hire a team of "security experts", which were so incompetent in introducing "well established security principles" like two-factor authentication and using a service from a "tried and tested" third-party, they managed to make it worse than not having it, as there were fundamental flaws in the setup resulting in several attack vectors.

Incompetence is rampant - it's unfortunate. Things can so easily look right to management when they're wrong, too. It's a problem. For IT security, maybe if there was a regulated body that trained and employed people (and kept them current) to consult with companies before/after they've had major changes made to their IT infrastructure - things would be better. As long as the regulated body did a good job keeping current.
For those willing to pay, security could be almost guaranteed. Companies wanting to "do it cheap", it would obviously not be

Absolutely not. 9th gen is still Skylake+*n (aka garbage lake) and therefore vulnerable to many transient execution attacks. Personally, I will keep running this Zen+ system (with SMT disabled) for many, many years, not just because I cannot afford to upgrade but also because it is clear to me that all these new generations have new security vulnerabilities of their own, so there is no sense upgrading to a newer gen with supposed hardware "mitigations". When the time comes, I will probably upgrade to a RISC-V/ARM-based system with in-order cores (i.MX10 with A510 would be interesting as they are supposed to have performance equivalent to that of the old A73), which is immune to all these issues afflicting highly complex OoO designs. That system may have less raw CPU power (certainly single-thread) but at least it would be highly secure and have low power consumption, two attributes that are highly attractive considering the future that we are currently facing. I don't strictly need tons of performance for home use anyway.

I don't have the knowledge or tools to make my own. It's important to remember though - you don't know for sure the features any one chip supports unless you crack it open and get it under a microscope. And have someone very familiar with microprocessor design take a look at things. Even then, it's not 100%.

So you're saying 9th gen security is worse than 10th/11th/12th gen overall, but it doesn't have this specific vulnerability.
Do you know of a resource that lists all the vulnerabilities/defects of modern CPUs? Preferably back to the introduction of i3/i5/i7, but if one less complete exists I'm not opposed

 

[mplayerMuPDF]

Incompetence is rampant - it's unfortunate. Things can so easily look right to management when they're wrong, too. It's a problem. For IT security, maybe if there was a regulated body that trained and employed people (and kept them current) to consult with companies before/after they've had major changes made to their IT infrastructure - things would be better. As long as the regulated body did a good job keeping current.
For those willing to pay, security could be almost guaranteed. Companies wanting to "do it cheap", it would obviously not be



I don't have the knowledge or tools to make my own. It's important to remember though - you don't know for sure the features any one chip supports unless you crack it open and get it under a microscope. And have someone very familiar with microprocessor design take a look at things. Even then, it's not 100%.

So you're saying 9th gen security is worse than 10th/11th/12th gen overall, but it doesn't have this specific vulnerability.
Do you know of a resource that lists all the vulnerabilities/defects of modern CPUs? Preferably back to the introduction of i3/i5/i7, but if one less complete exists I'm not opposed

9th gen security without mitigations would certainly be worse, I think, yes. Because Sunny Cove and later derivative designs have lots of (partial) hardware mitigations built-in. There have been some new vulnerabilities that only affect Sunny Cove+ but they are less than all the old vulnerabilities affecting Skylake+n. I don't know that there is one comprehensive table for all CPUs. But Intel does have this for some of their CPUs: https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html As for the old CPUs going back to the start of the Core i range: I think we will never really know, all those old CPUs (same with AMD) seem to have been abandoned. I have no idea exactly which vulnerabilities affect my Richland and K10 laptops and I doubt there are any microcode mitigations for them. But I don't really use the Richland laptop for web browsing except with Netsurf (no JavaScript) as it is only a dual core and I have my desktop anyway. I use uBlock Origin (like I do on my desktop) on the K10 (Llano quad core so it is still pretty fast with Linux) laptop so that should greatly reduce the risk (and that is without considering that K10 lacks SMT, which makes a huge difference).

I personally dislike Skylake (hence "garbage lake") and derivatives because they are affected by vulnerabilities that Haswell (and Broadwell, for laptops) are not (and they have that SGX crap that is used for DRM). If I were to buy an Intel computer, it would have to either have a *well CPU or Icelake+ (Sunny Cove+).

 

[tpu7887]

9th gen security without mitigations would certainly be worse, I think, yes. Because Sunny Cove and later derivative designs have lots of (partial) hardware mitigations built-in. There have been some new vulnerabilities that only affect Sunny Cove+ but they are less than all the old vulnerabilities affecting Skylake+n. I don't know that there is one comprehensive table for all CPUs. But Intel does have this for some of their CPUs: https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html As for the old CPUs going back to the start of the Core i range: I think we will never really know, all those old CPUs (same with AMD) seem to have been abandoned. I have no idea exactly which vulnerabilities affect my Richland and K10 laptops and I doubt there are any microcode mitigations for them. But I don't really use the Richland laptop for web browsing except with Netsurf (no JavaScript) as it is only a dual core and I have my desktop anyway. I use uBlock Origin (like I do on my desktop) on the K10 (Llano quad core so it is still pretty fast with Linux) laptop so that should greatly reduce the risk (and that is without considering that K10 lacks SMT, which makes a huge difference).

I personally dislike Skylake (hence "garbage lake") and derivatives because they are affected by vulnerabilities that Haswell (and Broadwell, for laptops) are not (and they have that SGX crap that is used for DRM). If I were to buy an Intel computer, it would have to either have a *well CPU or Icelake+ (Sunny Cove+).

Didn't 9th gen fix the problems in hardware without large performance penalties that 8th/7th/6th/5th/4th etc gen processors needed microcode/software fixes for back in 2018 - some of which impacted performance by 30%+? I thought I heard they did, but I could be wrong. There are always new vulnerabilities being found lol, it's hard to keep up. Every once in a while I get lost (more lost than usual anyway) lol.

Can't SGX be disabled in the BIOS, and if you disable it, *lake processors behave the same as Haswell/Broadwell?

I don't like HT/SMT. I do work with audio sometimes and it can cause latency problems, especially when you're using real time monitoring of processed audio (eg singing with electric guitar when the "electric" part of "electric guitar" is being created in the PC from an input directly from the guitar). Every millisecond matters, especially to me because after a few, I'm thrown off.

My last two CPUs have been 9600K and 2500K - both non-HT. I think I read somewhere Intel will be including HT on all of their CPUs from now on, even their i3s. It'll probably stay that way as long as AMD is competitive at all levels (it was shortly after they began to be when Intel changed). In addition to the potential security problems brought by HT/SMT, it's nothing special: any performance brought to the table costs just as much power as if done on another core, and overclocks are reduced because of it (I especially like my single threaded performance). If non-HT/SMT CPUs are reintroduced in the next generations, I'll be sticking with them as long as they have enough cores. If not, I'll buy the amount I'd like, then disable HT/SMT, enjoying greater security, lower latency, and higher performance. in every program at all times except in rare occasions when loads are running which bring CPU usage up near 100%.

 

[Mussels]

Didn't 9th gen fix the problems in hardware without large performance penalties that 8th/7th/6th/5th/4th etc gen processors needed microcode/software fixes for back in 2018 - some of which impacted performance by 30%+? I thought I heard they did, but I could be wrong. There are always new vulnerabilities being found lol, it's hard to keep up. Every once in a while I get lost (more lost than usual anyway) lol.

Can't SGX be disabled in the BIOS, and if you disable it, *lake processors behave the same as Haswell/Broadwell?

I don't like HT/SMT. I do work with audio sometimes and it can cause latency problems, especially when you're using real time monitoring of processed audio (eg singing with electric guitar when the "electric" part of "electric guitar" is being created in the PC from an input directly from the guitar). Every millisecond matters, especially to me because after a few, I'm thrown off.

My last two CPUs have been 9600K and 2500K - both non-HT. I think I read somewhere Intel will be including HT on all of their CPUs from now on, even their i3s. It'll probably stay that way as long as AMD is competitive at all levels (it was shortly after they began to be when Intel changed). In addition to the potential security problems brought by HT/SMT, it's nothing special: any performance brought to the table costs just as much power as if done on another core, and overclocks are reduced because of it (I especially like my single threaded performance). If non-HT/SMT CPUs are reintroduced in the next generations, I'll be sticking with them as long as they have enough cores. If not, I'll buy the amount I'd like, then disable HT/SMT, enjoying greater security, lower latency, and higher performance. in every program at all times except in rare occasions when loads are running which bring CPU usage up near 100%.

Look into HPET - from memory, the HPET issue is likely what you were facing and SMT just made it worse.
It was a big issue from 6th to 9?th gen intel
The HPET bug: What it is and what it isn't - overclockers.at
(Link is focused on games, but it also caused weird audio issues back in the day especially around the Vista era where networking and audio clashed, and networking taking priority would cause crackling and latency issues)

 

[mplayerMuPDF]

Didn't 9th gen fix the problems in hardware without large performance penalties that 8th/7th/6th/5th/4th etc gen processors needed microcode/software fixes for back in 2018 - some of which impacted performance by 30%+? I thought I heard they did, but I could be wrong. There are always new vulnerabilities being found lol, it's hard to keep up. Every once in a while I get lost (more lost than usual anyway) lol.

Can't SGX be disabled in the BIOS, and if you disable it, *lake processors behave the same as Haswell/Broadwell?

I don't like HT/SMT. I do work with audio sometimes and it can cause latency problems, especially when you're using real time monitoring of processed audio (eg singing with electric guitar when the "electric" part of "electric guitar" is being created in the PC from an input directly from the guitar). Every millisecond matters, especially to me because after a few, I'm thrown off.

My last two CPUs have been 9600K and 2500K - both non-HT. I think I read somewhere Intel will be including HT on all of their CPUs from now on, even their i3s. It'll probably stay that way as long as AMD is competitive at all levels (it was shortly after they began to be when Intel changed). In addition to the potential security problems brought by HT/SMT, it's nothing special: any performance brought to the table costs just as much power as if done on another core, and overclocks are reduced because of it (I especially like my single threaded performance). If non-HT/SMT CPUs are reintroduced in the next generations, I'll be sticking with them as long as they have enough cores. If not, I'll buy the amount I'd like, then disable HT/SMT, enjoying greater security, lower latency, and higher performance. in every program at all times except in rare occasions when loads are running which bring CPU usage up near 100%.

I have to say this is still one of the nice things that Intel offers: CPUs without SMT. The other thing that I like is that they still offer T (35W) versions of their CPUs. AMD offered 45 W T versions with Richland and later 35 W "E" versions with some generations, although I think those are OEM only. I used to have an i5-2400 without SMT and liked it quite a bit (it was my first real quad core and desktop CPU).

9th gen does have some minor partial hardware mitigations but it is nothing compared to Ice Lake (Sunny Cove) and derivatives AFAIK. Ultimately it is still just Skylake+*n, whereas Sunny Cove is a clean sheet design (yet still massively OoO and speculative, so it will always be vulnerable to some transient execution vulnerabilities I believe but I am not an expert, just a lay observer).

 

[Mussels]

I have to say this is still one of the nice things that Intel offers: CPUs without SMT. The other thing that I like is that they still offer T (35W) versions of their CPUs. AMD offered 45 W T versions with Richland and later 35 W "E" versions with some generations, although I think those are OEM only. I used to have an i5-2400 without SMT and liked it quite a bit (it was my first real quad core and desktop CPU).

9th gen does have some minor partial hardware mitigations but it is nothing compared to Ice Lake (Sunny Cove) and derivatives AFAIK. Ultimately it is still just Skylake+*n, whereas Sunny Cove is a clean sheet design (yet still massively OoO and speculative, so it will always be vulnerable to some transient execution vulnerabilities I believe but I am not an expert, just a lay observer).

I mean, you can simply disable SMT for both companies. It's not like you pay more for it, these days.

 

[mplayerMuPDF]

I mean, you can simply disable SMT for both companies. It's not like you pay more for it, these days.

And that is what I currently have (although in Linux as if I disable it in the UEFI, suspend/S3 will no longer work on Ryzen...). But it is nicer to just have a "clean" CPU in the first place without that nonsense. And preferably I would have a CPU without ME/PSP and DRM garbage too.

 

[tpu7887]

I have to say this is still one of the nice things that Intel offers: CPUs without SMT. The other thing that I like is that they still offer T (35W) versions of their CPUs. AMD offered 45 W T versions with Richland and later 35 W "E" versions with some generations, although I think those are OEM only. I used to have an i5-2400 without SMT and liked it quite a bit (it was my first real quad core and desktop CPU).

9th gen does have some minor partial hardware mitigations but it is nothing compared to Ice Lake (Sunny Cove) and derivatives AFAIK. Ultimately it is still just Skylake+*n, whereas Sunny Cove is a clean sheet design (yet still massively OoO and speculative, so it will always be vulnerable to some transient execution vulnerabilities I believe but I am not an expert, just a lay observer).

I like the T offerings. I have a suspicion, though, that the more recent CPUs (starting around 9th gen) are more or less normal chips with lower power limits.

I explain in detail: The 9600T is said to have a base clock of 2.3GHz and a TDP of 35W, and the 9600K is said to have a base clock of 3.7GHz and TDP of 95W. If I'm remembering how things work correctly, and they still work the way they did when I learned things, this means: when at 100% utilization (probably non-AVX), the 9600T is able to run up to and including 2.3GHz without exceeding its TDP of 35W. The 9600K is able to run at 100% up to 3.7GHz using no more than 95W.

This means for heavily multithreaded tasks, the 9600T is 62% a 9600K.

Mr. T boosts to 3.9GHz, while K boosts to 4.6GHz.

This means when 9600T has a light workload, it's 85% of a 9600K.


To verify this, I would: first, take out my 9600K and put the 9600T in my motherboard. Then I'd enter the BIOS, load optimized defaults and boot into Windows. Then I'd load all CPU cores as much as I know how, sans (without) AVX. If it drops to 2.3GHz, we're done! If not, I'd download and install ThrottleStop, open it, and change the multiplier to whatever it is that makes 35 watts the value for CPU Package Power.

Then I'd pull out the 35 watt, stick in the 95 watt, and repeat the process outlined in Example.

If the T processor reaches a notably higher frequency than the K processor at 35W, then Intel is binning for higher performance at lower power.
If it doesn't, well then... they're not! lol
(personally I think 2.3GHz is a low base clock for 35W when 95W gives 3.7GHz. I'd think 35W would give you at the very least 2.6GHz- I'd expect 2.7-2.8GHz. Anyway... end of interruption). I'm pretty confident that Intel used to bin chips more extremely for low power consumption.

Another thing I find interesting - I've read mentioned casually from semi official sources, and heard this from people in conversation, that it's not always CPUs with lower VIDs which overclock best. You'd think so, but it's not so. My 2500K is a shining example of that. Its VID is 1.426V

1.426V

My 2500K's VID is higher than the voltage people say is safe to set the chip to lol. So this implies the 2500K is probably a bad example, right?

Wrong!

The thing is extremely stable at 4.9GHz with 1.43V. Rock solid stable. With 1.47V? it'll run almost everything you can think of at 5.2GHz. It can boot at 5.4GHz with 1.52V
AND REMEMBER: That VID is for the 2500K's maximum turbo boost frequency of 3.7GHz (3.3GHz base)