Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

[csbin]

 

[goldstone77]

Only in Crystaldiskmark alone.Not in ATTO. I have near zero influence on my rig (Win10pro, 8700k, 960Pro 1TB).

The last storage focused test I ran was ATTO Disk Benchmark and here we find something interesting. These are all sequential tests so the 4K results here won’t necessarily reflect what we saw previously and they clearly don’t. However as the file size grows to 16 kilobytes we start to see a noticeable drop in performance with the update. The drop off isn’t as significant as the 4K read results seen previously but we are seeing up to a 9% reduction in throughput.

https://www.techspot.com/article/1554-meltdown-flaw-cpu-performance-windows/
Here is the link to the article.

 

[DigDog]

They have known since Jun of last year!

Edit: here is the link to the CNBC article:
https://www.cnbc.com/2018/01/04/int...lready-knew-about-massive-security-flaws.html

ok, i did NOT have that information.

Was it Google that knew, or Intel? If Google's research team knows but they had not disclosed it yet, Intel might still be able to save themselves.

 

[CatMerc]

ok, i did NOT have that information.

Was it Google that knew, or Intel? If Google's research team knows but they had not disclosed it yet, Intel might still be able to save themselves.

Google knew and informed the entire industry to mitigate this.

 

[noneis]

Spectre #2
- Intel pre-Skylake needs retpoline mitignation (very low performance hit)
- For Intel Skylake an newer retpoline is not enough -> perfromance hit incoming (according to Intel IBRS is "horribly slow")
- AMD doesn't need retpoline, lfence is enough.

source: https://twitter.com/never_released

 

[LTC8K6]

Waiting out this gen of chips has proved to be the right course of action.

Those who waited can wait some more, and then be able to build their new system without any of these vulnerabilities.

Hopefully.

If your system is a few years old and you have been waiting, then wait a little longer for the next gen of chips before spending
your hard earned money.

 

[zinfamous]

i'm gonna side with cpu manufacturers saying "it works as intended".

in other news, Lamborghini willingly released their latest car knowing full well at launch that the tires it comes equipped with are subject to a defect where if an attacker lays spikes in front of the oncoming vehicle, the tires can be punctured.
Also locks that can be opened, the chassis is susceptible to fires when covered in gasoline, and the windshield will shatter if simply struck with an 8-pound hammer.

a vulnerability is not a defect. the FDIV floating point bug was a defect. in common market products, you might have a slim chance if it was proven that a manufacturing company skipped common tests for common vulnerability, such as a company that produces roof tiles and does not test them for rain.

when it comes down to research-based technology, you just don't have a chance. unless you prove that they *knew* the vulnerability existed and went into production anyway ...

It depends on where this vulnerability came from and why it is there. I'm the cynical type, so when I see the claim "It works as intended," it absolutely means:

1. We knew this was a real exploit and security concern
2. We did it anyway because we needed to cram in some hidden performance to overtake our competitors
3. We really, really, really hoped you wouldn't notice
4. Oh, those guys over there? Their hardware also has vulnerabilities that may or may not be kinda as bad as ours, you know?

 

[zinfamous]

Waiting out this gen of chips has proved to be the right course of action.

Those who waited can wait some more, and then be able to build their new system without any of these vulnerabilities.

Hopefully.

If your system is a few years old and you have been waiting, then wait a little longer for the next gen of chips before spending
your hard earned money.

Yeah, unintended for me, lol. I was more or less waiting for a decent Vega 56 release, priced well, and available....so I continue to wait. Still haven't bought my Ryzen (Was also waiting for good mATX boards, as well). Now it's no big thing to wait for Zen+ in a couple of months. By then, I expect the issues that actually effect AMD will be ironed out and part of an initial update.

Can these be done through BIOS? I've only read that they were software/OS fixes.

...but also smaller and better PSUs are finally starting to show up, so all of these delays are helpful.

 

[LTC8K6]

Google knew and informed the entire industry to mitigate this.

What could Intel have done in June to mitigate this?

 

[DigDog]

2. We did it anyway because we needed to cram in some hidden performance to overtake our competitors

time travel confirmed

 

[LTC8K6]

Yeah, unintended for me, lol. I was more or less waiting for a decent Vega 56 release, priced well, and available....so I continue to wait. Still haven't bought my Ryzen (Was also waiting for good mATX boards, as well). Now it's no big thing to wait for Zen+ in a couple of months. By then, I expect the issues that actually effect AMD will be ironed out and part of an initial update.

Can these be done through BIOS? I've only read that they were software/OS fixes.

...but also smaller and better PSUs are finally starting to show up, so all of these delays are helpful.

I don't know, I'm still confused as to whether this is even a problem for a home user and if it is even a problem in the absence of a malware infection?
Also, I am thinking that patches and updates will gradually decrease the performance hit for those situations where that occurs.

 

[coercitiv]

I don't know, I'm still confused as to whether this is even a problem for a home user and if it is even a problem in the absence of a malware infection

Mozilla had to make changes to Firefox in order to limit exploit potential via JS. Based on this I reckon a browser based attack was a possibility, hence home users could become targets.

 

[zinfamous]

I don't know, I'm still confused as to whether this is even a problem for a home user and if it is even a problem in the absence of a malware infection?
Also, I am thinking that patches and updates will gradually decrease the performance hit for those situations where that occurs.

patching meltdown looks to be a real performance hit for people using NvMe SSDs. Some of those benchmarks were reporting 20-25%? Rather defeats the purpose of going that route, then.

 

[CatMerc]

What could Intel have done in June to mitigate this?

Well, bring their own engineers on board to research and fully understand the issue, start discussing and writing patches for their own systems and OS's, stuff like that.

This can't be done overnight.

 

[sze5003]

Yep chrome had some patches too. If there is a way to access your memory it's a potential threat to get someone's data. Most of the impacts of the patch would effect servers and such. Some stuff at work uses AWS so I wonder how our webservices that run on that will behave. Yesterday was looking at some logs and I could already see some performance issues. But I'm pretty sure my company didn't take the update yet, they move slowly.

 

[LTC8K6]

patching meltdown looks to be a real performance hit for people using NvMe SSDs. Some of those benchmarks were reporting 20-25%? Rather defeats the purpose of going that route, then.

IIRC, that was only in a benchmark, not in actual use?

 

[LTC8K6]

As the industry understands these exploits better, the patches will probably get more efficient.

 

[Zstream]

Part of me wishes Google never attempted performing this exploit. Fixes of some kind have to be performed once any exploit is disclosed. This kind of fix I could have done without.

It’s not that Google found the exploit. It’s that deep state hackers have been using it for some time.

 

[PhonakV30]

allright , Finally Windows Update is downloading KB4056892 for Win 10 1709. To trigger this update , You should download Reg file : Link

https://www.bleepingcomputer.com/ne...stems-for-the-meltdown-and-spectre-cpu-flaws/

Wait for 1 hour or more.

 

[Fanatical Meat]

So any conclusive impact on older machines like my core 2 quad?
I'd hate that to be slowed down and be forced to buy a new machine that gets slowed down

 

[coercitiv]

So any conclusive impact on older machines like my core 2 quad?
I'd hate that to be slowed down and be forced to buy a new machine that gets slowed down

Home users will not be significantly impacted in terms of performance (meaning zero or near zero performance impact). Update your browser, update your OS, go on with your life as usual.

 

[LTC8K6]

So any conclusive impact on older machines like my core 2 quad?
I'd hate that to be slowed down and be forced to buy a new machine that gets slowed down

Probably not going to notice in regular home use.
But when you do buy a new system in a year, the newer chips should not have these flaws.

They will probably have their own flaws, though.

 

[coercitiv]

But when you do buy a new system in a year, the newer chips should not have these flaws.

This is what I'm most curious about: what CPUs will Intel be selling in 2019 that have been purposely built to avoid this vulnerability? Why would Intel's next gen arch be designed to be immune to this exploit path considering Intel has just become aware of it?

 

[XMan]

Hmm. i7-4790K, Intel's tool says my system is not vulnerable? That chip certainly falls in the described range.

 

[witeken]

This is what I'm most curious about: what CPUs will Intel be selling in 2019 that have been purposely built to avoid this vulnerability? Why would Intel's next gen arch be designed to be immune to this exploit path considering Intel has just become aware of it?

Intel said the first chips with hardware mitigation will be released in 2018. They already know about it for 7 months so definitely possible.