New "Spectre" Variant Hits Intel CPUs, Company Promises Quarterly Microcode Updates

[btarunr]

A new variant of the "Spectre" CPU vulnerability was discovered affecting Intel processors, by security researchers Vladimir Kiriansky and Carl Waldspurger, who are eligible to bag a USD $100,000 bounty by Intel, inviting researchers to sniff out vulnerabilities from its processors. This discovery, chronicled under CVE-2018-3693, is among 12 new CVEs Intel will publish later this week. The company is also expected to announce quarterly CPU microcode updates to allay fears of its enterprise customers.

The new vulnerability, like most other "Spectre" variants, targets the speculative execution engine of the processor, in a bounds-check bypass store attack. A malicious program already running on the affected machine can alter function pointers and return addresses in the speculative execution engine, thereby redirecting the flow of data out of protected memory address-spaces, making it visible to malware. This data could be anything, including cryptographic keys, passwords, and other sensitive information, according to "The Register." Intel chronicled this vulnerability in section 2.2.1 of its revised speculative execution side-channel attacks whitepaper. You can also catch a more detailed whitepaper from the researchers themselves.



View at TechPowerUp Main Site

 

[R0H1T]

Considering the potential loss of revenues & face, a 100 grands sounds like peanuts to me! If only Intel would've spent more on making processors secure instead of hotchips presentation

 

[las]

Great. Didn't know Intel paid people to discover bugs. Does AMD pay people to find bugs too? I don't hear alot about Ryzenfall, Chimera and Masterkey these days. Only that it "should" be fixed in Zen 2.

 

[Tsukiyomi91]

here we go again... == come on Intel... you can do better than that.

 

[FrozenPie]

[...] I don't hear alot about Ryzenfall, Chimera and Masterkey these days. Only that it "should" be fixed in Zen 2.

Because these bugs/vulnerabilities are only usable if you already have admin/root permissions on the machine you want to attack which makes these flaws pretty useless as far as i know.

 

[nemesis.ie]

Because these bugs/vulnerabilities are only usable if you already have admin/root permissions on the machine you want to attack which makes these flaws pretty useless as far as i know.

Aren't they also mitigated in the latest AGESA?

 

[Tartaros]

Great. Didn't know Intel paid people to discover bugs. Does AMD pay people to find bugs too?

It's not an uncommon way to test things or headhunt talented people.

 

[Space Lynx]

At this rate, I think I might just go Ryzen next year for my final build.

 

[MT66]

At this rate, I think I might just go Ryzen next year for my final build.

I think ryzen 3000 series is going to be very good, this is just a speculation on my part but AMD is claiming vega 7nm is touting 35% performance increase over Vega 14nm so if they can get close to that number on ryzen 3000 also getting that 7nm treatment that should be a pretty significant boost to performance.

 

[las]

I think ryzen 3000 series is going to be very good, this is just a speculation on my part but AMD is claiming vega 7nm is touting 35% performance increase over Vega 14nm so if they can get close to that number on ryzen 3000 also getting that 7nm treatment that should be a pretty significant boost to performance.

Won't happen core vs core

I'd be very happy if Zen 2 reaches 4.5 GHz... The 1700 in my server can't even do 4 GHz stable

 

[R0H1T]

Won't happen core vs core

Yeah true, but maybe he's talking overall (MT) performance?

 

[las]

Yeah true, but maybe he's talking overall (MT) performance?

Would easily be possible - if they up the max core/threads to 12/24 or 16/32

If they want to attract gamers, they need the clockspeed boost instead of adding more cores, preferably both

8C/16T with single/duo core boost at 4.5 GHz boost out of the box and 4.6-4.8 GHz max OC would be very good. Dream scenario

TSMC should be better for high clocks compared to GloFo

 

[Space Lynx]

Also if one invests in a freesync monitor it does make any loss of performance vs intel and nvidia go further, same with gsync and say you can only afford a gtx 1060 at 144hz 1080p, like sure you vant crank everything to ultra, but its all about that smoothness that really creates the experience if you have gsync. same thing/logic applies to any future all AMD builds I plan to do, not to mention I probably will be saving $300-400 by going Freesync 2 HDR600 over gsync HDR600 - and I do have every intention of buying a monitor like that in 2019 or 2020 when I do my ultimate build, so we will just see how things play out. I am leaning towards AMD even if its 10% slower across the board, mainly out of respect, but also because of no security issues, and on top of all that 10% is not really noticeable when you add in freesync or gsync, etc.

 

[MT66]

Won't happen core vs core

I'd be very happy if Zen 2 reaches 4.5 GHz... The 1700 in my server can't even do 4 GHz stable

Glofo is claiming 5ghz-ish with their 7nm process so I don't see why the tsmc 7nm process should not enable 5ghz-ish for ryzen 3000. I think an overlooked aspect of what AMD has been using process node wise is that its a 14nm samsung node used by Glofo, as far as I know samsung only make mobile centric processors where power efficiency is a premium and clock speed tend to be in the 1ghz to maybe 3ghz range, I dont believe there is a high performance variant of a samsung node just low power, TSMC and Glofo both state they will have both a high performance and low power verison of their 7nm process. This is why I believe the ryzen clock speeds have been lacking but power efficiency has been pretty good. Either way in time it will be revealed.

 

[cucker tarlson]

If they want to attract gamers, they need the clockspeed boost instead of adding more cores, preferably both

If they want gamers they first need to do something with this horrendous latency that CCX design produces, otherwise Intel will beat them in gaming as long as they keep using ring design.

 

[GlacierNine]

Great. Didn't know Intel paid people to discover bugs. Does AMD pay people to find bugs too? I don't hear alot about Ryzenfall, Chimera and Masterkey these days. Only that it "should" be fixed in Zen 2.

You don't hear about them because they're not actually AMD specific bugs - They're bugs in ASMedia products that Intel also uses extensively. AMD already patched them, it didn't require Zen 2, and the root of the vulnerability was ASMedia

Meanwhile, there’s no sign of any effort by CTS Labs to address the backdoors and critical security flaws baked into tens of millions of Intel motherboards courtesy of their onboard Asmedia controllers, even though the ASM1042 and ASM1142 have shipped on Intel products for the past six years.

https://www.extremetech.com/computi...ith-amd-security-disclosures-digs-deeper-hole

The only reason that they were ever phrased as being solely AMD-relevant was that the company that publicised them, was making an attempt to manipulate AMD stocks. That's why the legal disclaimer on their site states: "CTS reserves the right to refrain from updating this website even as it becomes outdated or inaccurate. "

They're also linked to Viceroy Research (Who published a HYSTERICAL hit piece on AMD within hours of the CTS publication), and who have done this before, even going as far as to say "We take a financial position in our research and our readers should assume we have a position on the stock."

https://www.businesslive.co.za/bd/c...-out-the-info-to-make-a-killing-on-steinhoff/

 

[cucker tarlson]

This whole amdflaws business was a disgrace.

 

[GlacierNine]

This whole amdflaws business was a disgrace.

Fortunately, most of the tech press spent their time talking about who the fuck CTS labs were, rather than focusing on the "flaws", such as they were.

 

[trparky]

If they want gamers they first need to do something with this horrendous latency that CCX design produces, otherwise Intel will beat them in gaming as long as they keep using ring design.

I figure that that will be solved by the introduction of DDR5 in the coming years.

 

[rtwjunkie]

At this rate, quarterly fixes should have us back to Northwood performance in no time.

 

[R0H1T]

At this rate, quarterly fixes should have us back to Northwood performance in no time.

And Intel will continue to mint more money by selling upgrades, especially for enterprise since it's a necessity.

 

[GlacierNine]

If they want gamers they first need to do something with this horrendous latency that CCX design produces, otherwise Intel will beat them in gaming as long as they keep using ring design.

You're really overblowing that issue. AMD's Intra-CCX latency is actually slightly lower than Intel's Ring Bus architecture (39.38ns for data to travel between cores in a CCX, versus Intel's 43.10).

Yes, when you move between CCXs there's a difference, but especially with Ryzen 2, users won't see any difference at all until they move beyond 4 cores for a task. I'd also note that while Intel's monolithic design helps them to have 6 cores with low latency on the 8700K, the 7820X actually sees a dramatic jump in Ring Bus latency.

This was tested with DDR-2933 RAM by Tom's Hardware. The OC'd 2700X result used 3466.

 

[Aquinus]

A malicious program already running on the affected machine can

Your machine might be at risk if it has already been infected. Really? I would have never known.

 

[GlacierNine]

Your machine might be at risk if it has already been infected. Really? I would have never known.

This is different to that program already having access to all the data on your machine or in memory.

If you had a program on your machine that had no admin-level access, and was capable of doing very little malicious without that access, that's one thing. Some low-level adware or whatever.

This vulnerability would enable a program running in such restricted conditions, to access data beyond those restrictions. That's potentially quite significant.

 

[HD64G]

Won't happen core vs core

I'd be very happy if Zen 2 reaches 4.5 GHz... The 1700 in my server can't even do 4 GHz stable

Since we got from 3.9-4.1 to 4.2-4.4 with a refresh and without tweaks in the arch on basically the same production line which with some tweaks got from 14nm to 12nm, a full node improvement to 7nm alongside a big improvement encore can easily reach very close or above the 5GHz limit at stock boost for 1-2 thread needs. My 5 cents.