Check This Out Fix for Intel's Massive CPU Security Flaw might Slow Down your PC

[Snipeye]

Fix for Intel's massive CPU security flaw might slow down your PC
bY: Jon Fingas, Jonfingas

Intel is grappling with another major security flaw in its processors... and this time, the cost of fixing it may be very steep. Researchers have discovered a design vulnerability in Intel CPUs over the past decade that covers the ability of ordinary programs to determine the content or layout of protected kernel memory (i.e. areas reserved just for the operating system). While the details appear to be under embargo for now, the fix is to completely separate the kernel memory from those ordinary processes. That could carry a significant speed hit, since it requires switching between two memory address spaces every time there's a system call or a hardware interrupt request.

How much of a slowdown you see depends on the processor and the task in question. The biggest blows are expected to come to virtualization systems like Amazon's EC2 or Google Compute Engine. The Register claims the performance hits could range from 5 percent to 30 percent, but there's evidence to suggest steeper hits might be possible. Whether or not this affects everyday tasks like gaming or web browsing is another matter, though -- there has yet to be comprehensive testing.

As it's a chip-level flaw, the bug affects virtually every operating system, including Linux, macOS and Windows. Software fixes are known to be in the works for at least Linux and Windows, but a true solution that maintains performance will require changes at the CPU level. Notably, though, AMD reports that its processors aren't affected due to key differences in memory handling.

Intel has so far declined to comment. However, to call this ill-timed would be an understatement. After years of maintaining a fairly secure performance lead, it's facing stiff competition from AMD's Ryzen and Epyc processors. The last thing it needs is a security hole that not only requires design tweaks, but could slow down virtually all the chips it sells once patches are in place.

https://www.engadget.com/2018/01/03/intel-kernel-memory-flaw/

So that new PC build I was working on... I may need to go AMD now.

 

[Simon]

That?s pretty massive and a little bit surprising; I thought they more thorough than that. We will have to see how much of a hit this creates. Both my machines are Intel based and do a fair amount of video and photo editing, so lots of data crunching. Maybe my upgrade time will have to speed up a bit, I was certainly hoping to last a few more years with my current build. I suppose time will tell.


Sent from my iPhone using Tapatalk

 

[M4A1-S]

Are there certain Chips that aren't affected by this, If so I would like to know.

 

[Snipeye]

Pretty much all Intel chips made in the past DECADE are exposed to this security bug, and can see a performance degradation when the OS developers implement a hotfix. I haven't found a single list anywhere of what CPUs are exposed, but with that said, the most common term is "Intel x86-64 hardware." That means any 64-bit CPUs are included, which started around the Itanium models (2001), and later when the Core series of CPUs debuted (2006). So at the very least, it starts with the Core series in 2006. However, it could go back further to 2001.

Any chips older than 2001 aren't affected (32-bit CPUs, like the old Pentium 3 and 4 series). I also read that AMD CPU's are not affected due to their kernel design being different, though a recent Intel release suggested that AMD, ARM, and even Qualcomm CPUs are exposed to the same security flaw.

https://gizmodo.com/report-all-intel-processors-made-in-the-last-decade-mi-1821728240

 

[Simon]

Pretty much all Intel chips made in the past DECADE are exposed to this security bug, and can see a performance degradation when the OS developers implement a hotfix. I haven't found a single list anywhere of what CPUs are exposed, but with that said, the most common term is "Intel x86-64 hardware." That means any 64-bit CPUs are included, which started around the Itanium models (2001), and later when the Core series of CPUs debuted (2006). So at the very least, it starts with the Core series in 2006. However, it could go back further to 2001.

Any chips older than 2001 aren't affected (32-bit CPUs, like the old Pentium 3 and 4 series). I also read that AMD CPU's are not affected due to their kernel design being different, though a recent Intel release suggested that AMD, ARM, and even Qualcomm CPUs are exposed to the same security flaw.

https://gizmodo.com/report-all-intel-processors-made-in-the-last-decade-mi-1821728240

One can only hope no one is using a Pentium at this point

Interested to see the full hardware list but at the moment it sure does sound like everyone. The fact that the kernel contributions Intel has been making to patch this do not contain many notes also is a bit scary, really.

 

[M4A1-S]

Well, R.I.P Coffee Lake.

 

[Mr. Lemming]

HOPEFULLY this won't affect gaming much at all, as my system is just under a week away from the expected ship date with a Coffee Lake i7 churning GHz out like mad...

 

[Simon]

Intel has responded;

Intel acknowledges that the exploit has "the potential to improperly gather sensitive data from computing devices that are operating as designed." The company further goes on state that "these exploits do not have the potential to corrupt, modify or delete data." The company goes on to state that the "average computer user" will be negligibly affected by any software fixes, and that any negative performance outcomes "will be mitigated over time." In a classic case of trying to point fingers at everyone else, Intel says that "many different vendors' processors" are vulnerable to these exploits.

Full statement

 

[Snipeye]

HOPEFULLY this won't affect gaming much at all, as my system is just under a week away from the expected ship date with a Coffee Lake i7 churning GHz out like mad...

Good news, some preliminary tests, and I do mean preliminary, suggest that gaming performance is not negatively impacted, or its effects are negligible. However, those were games that strongly relied on GPU; some other games that use the CPU more may be adversely impacted. We will have to wait and see.

 

[reflex99]

Apparently OS X has been patched since 10.13.2 (https://twitter.com/aionescu/status/948609809540046849]source)

So one way around this issue is to join a cult.

I have a feeling the PC enthusiast market will make a bigger deal of this than it will end up being. See similar past chip level bugs (Phenom TLB bug, P67 sata errata, bulldozer + OSschedulers, etc. I'm sure there's more I'm forgetting). I'm guessing in a few months nobody will be seriously affected. IMO the quality/security of the user applications/software is a more significant vector to worry about.

edit: i cannot type or read tonight.

 

[Snipeye]

More news released this morning from The Register:
https://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

Summary: there are two attacks codenamed Meltdown (Var 3) and Spectre (Var 1, Var 2)

Meltdown
This is the big bug reported on Tuesday.

It can be exploited by normal programs to read the contents of private kernel memory.
It affects potentially all out-of-order execution Intel processors since 1995, except Itanium and pre-2013 Atoms. It definitely affects out-of-order x86-64 Intel CPUs since 2011. There are workaround patches to kill off this vulnerability available now for Windows, and for Linux. Apple's macOS has been patched since version 10.13.2. Installing and enabling the latest updates for your OS should bring in the fixes. You should go for it. If you're a Windows Insider user, you're likely already patched. Windows Server admins must enable the kernel-user space splitting feature once it is installed; it's not on by default.

Amazon has updated its AWS Linux guest kernels to protect customers against Meltdown. Google recommends its cloud users apply necessary patches and reboot their virtual machines. Microsoft is deploying fixes to Azure. If you're using a public cloud provider, check them out for security updates.

The workarounds move the operating system kernel into a separate virtual memory space. On Linux, this is known as Kernel Page Table Isolation, or KPTI, and it can be enabled or disabled during boot up. You may experience a performance hit, depending on your processor model and the type of software you are running. If you are a casual desktop user or gamer, you shouldn't notice. If you are hitting storage, slamming the network, or just making a lot of rapid-fire kernel system calls, you will notice a slowdown. Your mileage may vary.

It also affects Arm Cortex-A75 cores. Qualcomm's upcoming Snapdragon 845 is an example part that uses the A75. There are Linux kernel KPTI patches available to mitigate this. The performance hit isn't known, but expected to be minimal.

Additionally, Cortex-A15, Cortex-A57 and Cortex-A72 cores suffer from a variant of Meltdown: protected system registers can be accessed, rather than kernel memory, by user processes. Arm has a detailed white paper and product table, here, describing all its vulnerable cores, the risks, and mitigations.

Meltdown does not affect any AMD processors.

Googlers confirmed an Intel Haswell Xeon CPU would allow a normal user program to read kernel memory.

It was discovered and reported by three independent teams: Jann Horn (Google Project Zero); Werner Haas, Thomas Prescher (Cyberus Technology); and Daniel Gruss, Moritz Lipp, Stefan Mangard, Michael Schwarz (Graz University of Technology).

Spectre
Spectre allows, among other things, user-mode applications to extract information from other processes running on the same system. Alternatively, it can be used by code to extract information from its own process. Imagine malicious JavaScript in a webpage churning away using Spectre bugs to extract login cookies for other sites from the browser's memory.

It is a very messy vulnerability that is hard to patch, but is also tricky to exploit. It's hard to patch because just installing the aforementioned KPTI features is pointless on most platforms ? you must recompile your software with countermeasures to avoid it being attacked by other programs, or wait for a chipset microcode upgrade. There are no solid Spectre fixes available yet for Intel and AMD parts.

In terms of Intel, Googlers have found that Haswell Xeon CPUs allow user processes to access arbitrary memory; the proof-of-concept worked just within one process, though. More importantly, the Haswell Xeon also allowed a user-mode program to read kernel memory within a 4GB range on a standard Linux install.

This is where it gets really icky. It is possible for an administrative user within a guest virtual machine on KVM to read the host server's kernel memory in certain conditions. According to Google:

When running with root privileges inside a KVM guest created using virt-manager on the Intel Haswell Xeon CPU, with a specific (now outdated) version of Debian's distro kernel running on the host, can read host kernel memory at a rate of around 1500 bytes/second, with room for optimization. Before the attack can be performed, some initialization has to be performed that takes roughly between 10 and 30 minutes for a machine with 64GiB of RAM; the needed time should scale roughly linearly with the amount of host RAM.

AMD insists its processors are practically immune to Variant 2 Spectre attacks. As for Variant 1, you'll have to wait for microcode updates or recompile your software with forthcoming countermeasures described in the technical paper on the Spectre website.

The researchers say AMD's Ryzen family is affected by Spectre. Googlers have confirmed AMD FX and AMD Pro cores can allow arbitrary data to be obtained by a user process; the proof-of-concept worked just within one process, though. An AMD Pro running Linux in a non-default configuration ? the BPF JIT is enabled ? also lets a normal user process read from 4GB of kernel virtual memory.

For Arm, Cortex-R7, Cortex-R8, Cortex-A8, Cortex-A9, Cortex-A15, Cortex-A17, Cortex-A57, Cortex-A72, Cortex-A73, and Cortex-A75 cores are affected by Spectre. Bear in mind Cortex-R series cores are for very specific and tightly controlled embedded environments, and are super unlikely to run untrusted code. To patch for Arm, apply the aforementioned KPTI fixes to your kernel, and/or recompile your code with new defenses described in the above-linked white paper.

Googlers were able to test that an Arm Cortex-A57 was able to be exploited to read arbitrary data from memory via cache sniffing; the proof-of-concept worked just within one process, though. Google is confident ARM-powered Android devices running the latest security updates are protected due to measures to thwart exploitation attempts ? specifically, access to high-precision timers needed in attacks is restricted. Further security patches, mitigations and updates for Google's products ? including Chrome and ChromeOS ? are listed here.

Discovered and reported by these separate teams: Jann Horn (Google Project Zero); and Paul Kocher in collaboration with, in alphabetical order, Daniel Genkin (University of Pennsylvania and University of Maryland), Mike Hamburg (Rambus), Moritz Lipp (Graz University of Technology), and Yuval Yarom (University of Adelaide and Data61).

 

[Mister36]

I have the relevant patches on two machines now that run Windows 10, one 1703 and one 1607. I don't game on these (Work machines), but I have not noticed any performance issues.

It is unlikely you will see any impact (Unless you run Database Administrator: The Game), and of course you should update as soon as possible.

Windows 10: https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892

Windows 8.1: https://support.microsoft.com/en-us/help/4056898/windows-81-update-kb4056898

Windows 7: https://support.microsoft.com/en-us/help/4056897/windows-7-update-kb4056897

 

[Simon]

Updated and haven't noticed a thing.

On a side note; I think the mass spread panic is a bit out of control. 99% of users who just game and browse Facebook and Youtube aren't going to ever get in contact with anything that will cause you these problems. But that's just my take. This is something people would use for attacks on datacenters.

 

[Snipeye]

That's my view too Simon. Now I'm trying to figure out can I proceed with that PC build of mine, or risk waiting to see if I get that corporate bonus to buy something a lil more souped up (1080 Ti...?) With that said, I sure didn't mind the nice big boost to AMD stock when I sold it.