Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

Page 80 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

Panino Manino

Senior member
Jan 28, 2017
695
872
136
I was thinking, it's possible to disable these mitigation, at least on Ubuntu? It's possible to disable and enable at will? Or most of these mitigation once they're activate there's no reverting back?
 

jpiniero

Lifer
Oct 1, 2010
12,831
4,119
136
I was thinking, it's possible to disable these mitigation, at least on Ubuntu? It's possible to disable and enable at will? Or most of these mitigation once they're activate there's no reverting back?
You can turn it off, that's how Phoronix is testing it.
 

nicalandia

Platinum Member
Jan 10, 2019
2,956
4,557
136
AMD Processors Expose Sensitive Data to New 'SQUIP' Attack

SGX, Intel’s supposedly impregnable data fortress, has been breached
yet again



Thankfully anything of worth that I had that could be stolen has already been taken by my Ex Wives...!
 

moinmoin

Diamond Member
Jun 1, 2017
4,182
6,267
136
“An attacker running on the same host and CPU core as you could spy on which types of instructions you are executing due to the split-scheduler design on AMD CPUs.”
That's kind of a "Doh!" situation. Cores have their own schedulers, which are obviously shared for SMT on the same core. That's why disabling SMT (or not splitting threads of the same core among different users) has been best practice since when Spectre first appeared.

The bug that enables ÆPIC Leak is what is known as an uninitialized memory read, which occurs when memory space is not freed up after the CPU has finished processing it, causing old data to leak that is no longer needed. Unlike previous CPU bugs with names like Specter, Meltdown, Foreshadow, and RIDL/Fallout/ZombieLoad – which resulted from temporary runs that created side channels revealing private data – ÆPIC Leak is an architectural flaw that resides in the CPU itself.
SGX has been essentially dead for quite some time already, but still: ouch! I sure hope Intel put more thought into the upcoming SGX2.
 
  • Like
Reactions: nicalandia

nicalandia

Platinum Member
Jan 10, 2019
2,956
4,557
136

moinmoin

Diamond Member
Jun 1, 2017
4,182
6,267
136
I also don't use Windows 11, keep Windows 10 up to date..


Beware: Windows 11-ready CPUs with VAES "susceptible to data damage", full CPU list here
Hm, as far as I understand it it's not really the VAES instruction that's broken (as all chips implementing VAES seem to be equally affected) but the way Windows 11 previously applied it that could be susceptible to data damage, by what appears to be saving some safeguarding that now has to be applied anyway and consequently leads to longer processing time.
 
  • Like
Reactions: scineram

DrMrLordX

Lifer
Apr 27, 2000
20,503
9,588
136
So . . . Skylake-SP? Cascade Lake-SP is 9th gen and IceLake-SP is 10th gen. On desktop that affects Coffee Lake, Kabylake, and Skylake.
 
Feb 4, 2009
32,960
13,820
136
has this hole turned out to be an issue. Seems like it’s been quite a while and consumer equipment doesn’t appear to be impacted. How about data centers?
 

DrMrLordX

Lifer
Apr 27, 2000
20,503
9,588
136
has this hole turned out to be an issue. Seems like it’s been quite a while and consumer equipment doesn’t appear to be impacted. How about data centers?
Golden Cove and Raptor Cove aren't in datacentres yet, so there's no way of knowing how these newer kernel versions will affect Sapphire Rapids or Emerald Rapids. For consumer desktop, I would expect savvy Linux users to disable the mitigations if they need extra performance. Especially if there are no known exploits in the wild based on the vulnerability(ies) meant to be mitigated by later kernel versions.
 

ASK THE COMMUNITY