Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

[naukkis]

Intel and AMD are looking to increase performance by looking at everything there is to improve upon in their architectures. How does non-standard use of a prefix on an operation that has been enhanced to give better performance with short strings equate to sloppy ISA extension?

Well-defined ISA doesn't allow non-standard use of prefixes. It's plain stupidity to chase performance by compromising ISA.

 

[tamz_msc]

Well-defined ISA doesn't allow non-standard use of prefixes. It's plain stupidity to chase performance by compromising ISA.

Well unlike RISC-V, x86 ISA didn't evolve to its current state through an independent body overseeing the implementation and extension of the ISA.

 

[naukkis]

Well unlike RISC-V, x86 ISA didn't evolve to its current state through an independent body overseeing the implementation and extension of the ISA.

It's not a valid point. They can have legacy support but still define new extensions to have unambiguous coding. Bugs like that are avoidable - Intel just did a lousy job. And when there is one such a bug there sure is plenty more coming.

 

[moinmoin]

How does non-standard use of a prefix on an operation that has been enhanced to give better performance with short strings equate to sloppy ISA extension?

Is that even a question? This bug causes the CPU to go into an impossible state that shouldn't ever exist! So at some point somewhere the whole design broke apart and didn't behave as designed, because some part wasn't covered. And if that's not sloppy to you, please tell me what you consider sloppy.

 

[tamz_msc]

It's not a valid point. They can have legacy support but still define new extensions to have unambiguous coding. Bugs like that are avoidable - Intel just did a lousy job. And when there is one such a bug there sure is plenty more coming.

Where does "legacy support" figure here? The bug is due to an unexpected behaviour with FSRM at the micro-op level. To trigger it in a way that could pose a security risk, you'll need to have access to an insider at Intel with knowledge of how the micro-ops work.

 

[tamz_msc]

Is that even a question? This bug causes the CPU to go into an impossible state that shouldn't ever exist! So at some point somewhere the whole design broke apart and didn't behave as designed, because some part wasn't covered. And if that's not sloppy to you, please tell me what you consider sloppy.

Read the blog post again - the CPU can recover from such states on its own.

You want sloppy? How about this? It took Intel to find out that one of AMD's fixes for Spectre didn't actually work for four years.

 

[moinmoin]

the CPU can recover from such states on its own.

That's great, and what does it do as long it didn't recover yet? And what about the DoSing possible by putting multiple cores/SMT threads into that state and causing machine check exceptions?

 

[igor_kavinski]

You want sloppy? How about this? It took Intel to find out that one of AMD's fixes for Spectre didn't actually work for four years.

AMD can be excused coz they were busy kicking Intel's butt during those four years. Thanks Intel, for doing AMD's job FOR them. Time and money well spent, for a change! Now back to making chips, Intel! You owe an 8-core Gracemont i3-N305 to every Skylake and later CPU owner to make up for the sloppy Swiss Cheese CPU design that got slower and slower over the years due to the mitigation patches.

 

[tamz_msc]

AMD can be excused coz they were busy kicking Intel's butt during those four years. Thanks Intel, for doing AMD's job FOR them. Time and money well spent, for a change! Now back to making chips, Intel! You owe an 8-core Gracemont i3-N305 to every Skylake and later CPU owner to make up for the sloppy Swiss Cheese CPU design that got slower and slower over the years due to the mitigation patches.

Skylake isn't affected by the way with Reptar.

 

[tamz_msc]

That's great, and what does it do as long it didn't recover yet? And what about the DoSing possible by putting multiple cores/SMT threads into that state and causing machine check exceptions?

To do that you'll need inside knowledge of how the Intel micro-ops are decoded. Unless you kidnap an Intel engineer with knowledge of such things and tell him at gunpoint to spill the beans, nothing is going to happen.

 

[naukkis]

To do that you'll need inside knowledge of how the Intel micro-ops are decoded. Unless you kidnap an Intel engineer with knowledge of such things and tell him at gunpoint to spill the beans, nothing is going to happen.

Are you kidding? CPU goes to unstable state - corrupting data unknown ways. Using that corruption state to actually steal privileged data is the hard part but for data integrity going into non-working state is much bigger problem.

 

[tamz_msc]

Are you kidding? CPU goes to unstable state - corrupting data unknown ways. Using that corruption state to actually steal privileged data is the hard part but for data integrity going into non-working state is much bigger problem.

So do MCEs never occur in VMs in the cloud? Don't all cloud providers have redundancy built-in? Doesn't there exist something called Live Migration?

 

[naukkis]

So do MCEs never occur in VMs in the cloud? Don't all cloud providers have redundancy built-in? Doesn't there exist something called Live Migration?

Yes, that what ISA should do - give MCE when error occurs. That's not the case with that bug - cpu continues execution without notification leading possible undetected data corruption. That's the worst kind of cpu malfunctioning - actually we don't know yet if that bug can be used to modify other privileges data too. That's possible case with such kind of unexpected cpu behaviour.

 

[darkswordsman17]

Welp, looks like Apple's turn: https://arstechnica.com/security/20...secret-encryption-keys-from-apples-mac-chips/

 

[Shivansps]

I dont want to put an aluminium foil hat, but im starting to think these vulnerabilities are intentional.

 

[manly]

The gift that keeps on giving?

The Register - It's 2024 and Intel silicon is still haunted by data-spilling Spectre

 

[DrMrLordX]

The gift that keeps on giving?

The Register - It's 2024 and Intel silicon is still haunted by data-spilling Spectre

For anyone that wants a direct link to The Reg instead of via MSN:

Tool finds new ways to exploit Spectre holes in Intel CPUs

Go, go InSpectre Gadget

www.theregister.com

 

[DrMrLordX]

Here's a list of affected CPUs by "Spectre v2". It's pretty bad!

Affected Processors: Transient Execution Attacks & Related Security...

Review the impact of transient execution attacks and select security issues on currently supported Intel products.

www.intel.com

Included on the list: Emerald Rapids. Whaddya wanna bet Granite Rapids will also be affected?