Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

Page 35 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

ashetos

Senior member
Jul 23, 2013
254
14
76
How do you know, that 19 μsec overhead is caused by CPU, and not by OS?

I said about the overhead of the patch for the Windows 10 I/O path. I never said the overhead is caused by the CPU. I said the increased CPU utilization reduced the SSD performance, which is mostly due to the OS patch and the BIOS update.

But if you want a secure system, you need the patch, so our CPUs can never work at full speed.
 

ashetos

Senior member
Jul 23, 2013
254
14
76
So, if its due sw patches and firmware (now general in the nature), is it correct to assume it can be tweaked to better performance?
Sure, but I'm not very optimistic for 3 reasons.

1. They have been working on those patches for months
2. TLB flushes etc are very expensive hardware operations that cannot be optimized any further
3. Both Windows and Linux suffer and they worked independently.
 
  • Like
Reactions: Kuosimodo

hnizdo

Member
Aug 11, 2017
33
16
41
Sure, but I'm not very optimistic for 3 reasons.
1. They have been working on those patches for months

Months is nothing if you need to fix OS and firmware and must check: hundreds of processors, several OS with several builds/distros/... each, and thousands sensitive applications (AV, security, VM, games, industry). Just think about it, ouch, ouvie...
The only possible strategy is to bring bulletproof solution soon, ignoring all performance.
 
  • Like
Reactions: Zstream

PingSpike

Lifer
Feb 25, 2004
21,730
561
126
Then that was the birth of the Core... but it doesnt end there... we wanted more and more, and hence got the i7 920 bloomfield....
This is basically the start point of where spectre / meltdown began.

Is that true? I've heard everything from Pentium 1, to Pentium Pro to Pentium 4 as when the implementation was introduced.
 

traderjay

Senior member
Sep 24, 2015
220
165
116
no at this point its pretty much meant for any Intel processor that was on that long list.



because there is always that one person who seems to figure out how to stuff a square down a circular hole.

The team from google managed to find out this exploit.
It hasn't been used yet, which basically saves intel from a massive law suit because its a exploit that wasn't exploited.

But the same can be said even in video games, no matter how well a dev patches something, there will always be that little kid who will think outside the box, and manage to break your patch in unbelievable ways causing the dev to immediately repatch.

Well we never know if hackers have used the exploits in the past. They don't really go around advertising their "exploit" methods.
 

LightningZ71

Golden Member
Mar 10, 2017
1,627
1,898
136
The original Pentium 1 was an in-order CPU and doesn't have the advanced feature that this attack targets. it's basically everything after that...
 

BigDaveX

Senior member
Jun 12, 2014
440
216
116
The original Pentium 1 was an in-order CPU and doesn't have the advanced feature that this attack targets. it's basically everything after that...

Well, except for Atom. Cue people searching through their cupboards to dig out their old netbooks. :p
 

mattiasnyc

Senior member
Mar 30, 2017
356
337
136
Whatever floats your boat is cool with me... As you said performance per dollar is what it comes out to...
OK, then lets not forget how the i5-8400 got the award of being the best cpu in gaming.
http://www.pcgamer.com/best-cpu-of-the-year-intel-core-i5-8400/

And yes we are all not gamers, however a lot of us are.
You can look here:
https://forums.anandtech.com/forums/general-hardware.4/

In a majority of the help me build a new system threads, it states gamer.
So a lot of people looking though this forum section are gamers and overclockers as well.

So that dollar to performance average can go either way for either CPU and is not only dominated by Ryzen even AFTER patch.

I didn't say it was dominated by Ryzen after a patch, and I did not say Ryzen was the bang-for-buck king for gaming. What you did was make a statement that I thought was overly broad (go back and read what I responded to) and I just addressed that what you said is true for some but not all users.

If you honestly feel that way, then fine, im not judging you, however blindy telling the masses this is better then that and this is better then that without knowing the exact purpose of said machine is flat out wrong.

Well, that's pretty much how what you wrote looked, and that's why I responded.

If your that worried about this hijack, then ok, get an AMD if that will make you feel better, but dont even try to pass info that the said AMD system will be faster then a 8700K in gaming or single threaded apps.

I didn't.

those of you guys forcing others to change to ryzen because of scare tatics, that i am not down with.

Nobody is forcing anybody to do anything.
 

FIVR

Diamond Member
Jun 1, 2016
3,753
911
106
Looks like Brian Kraznich may have to talk to the SEC pretty soon. WSJ article out with experts saying he should be investigated. Behind paywall, so here it is:

"The sale of Intel Corp. stock by Chief Executive Brian Krzanich while the company was handling concerns about security flaws in its chips was a highly unusual move that risked attracting regulatory scrutiny, according to lawyers and analysts who follow executive stock sales.

The trade took place on Nov. 29, nearly six months after Intel was informed about the vulnerabilities, which could enable hackers to access user data in chips made by Intel and others. Mr. Krzanich sold shares and exercised stock options worth a total of $39 million, netting him nearly $25 million, according to regulatory filings made at the time.

Word of the security flaws didn’t become public until last week, sending Intel’s shares down.

The timing of Mr. Krzanich’s sale “is really odd,” said Dan O’Connor, an attorney specializing in securities with the law firm Ropes & Gray. “The timing, the size, the unusual nature compared to prior sales—that’s going to get this a lot of scrutiny.”

The trade took place under a U.S. Securities and Exchange Commission rule that allows officers and directors of public companies to prearrange sales of specific numbers of shares at particular times. The rule prohibits insiders from setting up such transactions while possessing undisclosed information that might affect the stock price, Mr. O’Connor and other securities experts said.

ADVERTISEMENT

Brian Krzanich, CEO of Intel.PHOTO: MIKE BLAKE/REUTERS

An Intel spokesman said Mr. Krzanich’s divestiture was unrelated to the chip security issue and the sale was based on a prearranged trading program. The company declined to make Mr. Krzanich available for an interview.

Regulatory filings show that Mr. Krzanich established the divestiture plan about a month before the trade, on Oct. 30, long after Intel learned of the chip vulnerabilities in June.

Intel hasn’t said when Mr. Krzanich was informed of the issue. The company declined to provide further comment.

Mr. Krzanich’s trade stands out because it deviated from the CEO’s previous pattern of incremental sales of Intel stock, according to Ben Silverman, a researcher at InsiderScore LLC, a clearinghouse for information about trades made by corporate and institutional insiders. In addition to exercising more than $28 million in options, the CEO sold nearly 50% of his unrestricted stock, reducing his unrestricted holding to 250,000 shares, the minimum set by Intel’s executive stock ownership guidelines according to the company’s most recent proxy statement. That was an unusual move by a CEO, Mr. Silverman said.

“It’s not just that he sold stock knowing about the security issue,” he said. “The size and selling behavior were unusual. Put those two elements together, and certainly on the surface it doesn’t look good.”

WSJ’s Joanna Stern “bumps” into Intel CEO Brian Krzanich in the elevator at D.Live and asks about driverless cars and his favorite chip, to eat and to use. Photo: Andria Chamberlin for The Wall Street Journal

Mr. Silverman and other securities experts said they would expect U.S. regulators to examine Mr. Krzanich’s trade to see if it violated insider trading regulations, although such cases are difficult to win.

A spokesman for the SEC declined to comment.

For an insider trade to violate the rule, the information held by Mr. Krzanich about the security vulnerabilities in Intel chips at the time he made the trade would have to be deemed material to Intel’s business, the securities experts said. Intel said last week that it didn’t expect the issue to have any material impact on its business.

That may be reasonable, said Doug Chia, who oversees governance issues at The Conference Board, a nonprofit business advisory group. Tech companies frequently discover security flaws, many of which are insignificant or easily fixed, he said.

Even so, other securities specialists say companies generally would want to be careful in communicating with investors about a CEO’s stock sale in such circumstances.

“At first glance, it’s a very unusual type of thing that shareholders and directors would want a fairly tight explanation about,” said David Larcker, a professor of securities law at Stanford University. “It may be fine, but it’s the kind of thing you’d want to really understand and be transparent with shareholders about.”

At the time of Mr. Krzanich’s sale, Intel was working with chip rivals and software partners to patch the security flaws, which were built into a variety of chips including virtually all Intel processors going back more than a decade. Intel was by far the company most affected by the problem, because it has dominant market share in chips used for servers and personal computers.

The companies had planned to announce the problem and their fixes on Jan. 9, but it leaked earlier. Intel shares then dropped more than 5% total on Wednesday and Thursday. They edged up 0.7% on Friday."
 
  • Like
Reactions: lightmanek

LTC8K6

Lifer
Mar 10, 2004
28,520
1,575
126
Looks like Brian Kraznich may have to talk to the SEC pretty soon. WSJ article out with experts saying he should be investigated. Behind paywall, so here it is:
Well, they have addressed the stock sale in news articles.

BK apparently still has a lot of Intel stock.
 

LTC8K6

Lifer
Mar 10, 2004
28,520
1,575
126
Krzanich sold hundreds of thousands of Intel shares in November, based on a plan filed in October, both months after Google told the company of the vulnerabilities in June 2017. But the stock sale was unrelated, Intel said.

"It wasn't something where I had information that allowed me to trade," Krzanich said. "Intel has a very rigorous process for how I manage my stock. I have a stock trading plan that is defined over time, so when stocks sell it's defined up front and I have no control over that. Those [plans] are reviewed by the company."

And though he sold lots of stock, Krzanich still has 250,000 shares, as required by his employment contract. "To me, 250,000 shares is still quite a bit of stock to be owning," he said. "I'm a strong believer in Intel's stock. That's a large amount of my net worth, and I'm passionate about Intel's future."

Well, that's what he/they said...
 

LTC8K6

Lifer
Mar 10, 2004
28,520
1,575
126
He has the bare minimum stock to remain CEO Only.

He sold off everything else.
"Brian's sale is unrelated," the company said in a statement. "It was made pursuant to a pre-arranged stock sale plan ... with an automated sale schedule. He continues to hold shares in-line with corporate guidelines."
 

richaron

Golden Member
Mar 27, 2012
1,357
329
136
"Brian's sale is unrelated," the company said in a statement. "It was made pursuant to a pre-arranged stock sale plan ... with an automated sale schedule. He continues to hold shares in-line with corporate guidelines."
An "automated sale schedule" he made long after knowing about an exploit which affects basically only intel CPUs.

Surely you can see reason to be suspicious? What is it that you don't understand?
 

IEC

Elite Member
Super Moderator
Jun 10, 2004
14,329
4,913
136
Discussions about stock sales and conspiracy theories probably aren't relevant to the topic at hand. This is CPUs & Overclocking, not Stocks and Insider Trading.
 

FIVR

Diamond Member
Jun 1, 2016
3,753
911
106
"Brian's sale is unrelated," the company said in a statement. "It was made pursuant to a pre-arranged stock sale plan ... with an automated sale schedule. He continues to hold shares in-line with corporate guidelines."

His "automated sale" was vastly larger than any of his other sales and was arranged in October, roughly 4 months after the vulnerability was revealed to Intel and weeks before public disclosure.


It looks like textbook insider trading. The amazing part is that he probably knows he'll get away with it because of his political connections.
 

FIVR

Diamond Member
Jun 1, 2016
3,753
911
106
Discussions about stock sales and conspiracy theories probably aren't relevant to the topic at hand.

How is it "not relevant"? It is Intel's CEO acting upon his knowledge of the bug (the topic of the thread). It affects intel's customer mindshare and its business (because he is the CEO!)
 
  • Like
Reactions: DarthKyrie

Markfw

Moderator Emeritus, Elite Member
May 16, 2002
25,542
14,496
136
I said about the overhead of the patch for the Windows 10 I/O path. I never said the overhead is caused by the CPU. I said the increased CPU utilization reduced the SSD performance, which is mostly due to the OS patch and the BIOS update.

But if you want a secure system, you need the patch, so our CPUs can never work at full speed.
Only Intel needs the patches for the ones that have a performance impact. If you want "more secure" Ryzen or threadripper are the most secure right now.
 
Last edited:

IEC

Elite Member
Super Moderator
Jun 10, 2004
14,329
4,913
136
How is it "not relevant"? It is Intel's CEO acting upon his knowledge of the bug (the topic of the thread). It affects intel's customer mindshare and its business (because he is the CEO!)

You were okay until you brought politics into it. Take it to P&N if you want to take that angle with it.