Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

[DrMrLordX]

Because security is not representative of real world benchmarks.

Heehee. Funny, but if that were the case, all the patches going back to Meltdown would have been released the same way . . .

From many peoples perspective the speculative execution attacks are medium risk, and as such don't warrant overreaction (including those in my company). So perhaps Microsoft is leaving it up to the admins to decide if it's worth the effort/performance to apply it?

Heh! Possibly. Intel has likely noticed a number of their users looking for ways to disable mitigations just to claw back some performance.

 

[UsandThem]

https://www.tomshardware.com/news/intel-csme-security-flaw-vulnerability-firmware

The bug affects all Intel CPUs that come with a CSME microcontroller unit (MCU), with the exception of newer Ice Lake and Comet Lake processor generations. The vulnerability has a CVSS score of 8.2 out of 10, classifying it as “high severity.”

Another day, another vulnerability.

 

[DrMrLordX]

@UsandThem

Does that mean the later steppings of Cascade Lake-SP (and -AP) are affected by this vulnerability? And what about Cooper Lake?

 

[UsandThem]

@UsandThem

Does that mean the later steppings of Cascade Lake-SP (and -AP) are affected by this vulnerability? And what about Cooper Lake?

That's the way I understand it, but they'll probably clear it up some more over the coming weeks. Honestly, with all the different vulnerabilities Intel has had over the last few years, it's getting tough to remember what CPUs have what hardware mitigation.

 

[nicalandia]

https://www.tomshardware.com/news/intel-csme-security-flaw-vulnerability-firmware

Another day, another vulnerability.

It's the gift that keeps on giving!

 

[dualsmp]

Another gift from Intel.

Positive Technologies: Unfixable vulnerability in Intel chipsets threatens users and content rightsholders

Positive Technologies: Unfixable vulnerability in Intel chipsets threatens users and content rightsholders

www.ptsecurity.com

Intel x86 Root of Trust: loss of trust

The scenario that Intel system architects, engineers, and security specialists perhaps feared most is now a reality. A vulnerability has ...

blog.ptsecurity.com

'Unfixable' boot ROM security flaw in millions of Intel chips could spell 'utter chaos' for DRM, file encryption, etc

Although exploitation is like shooting a lone fish in a tiny barrel 1,000 miles away

www.theregister.co.uk

 

[DrMrLordX]

Doesn't appear to affect "tenth gen" Intel platforms. I guess? So hey just another reason for people to buy more Intel stuff! Gotta stay up to date!

 

[Topweasel]

Doesn't appear to affect "tenth gen" Intel platforms. I guess? So hey just another reason for people to buy more Intel stuff! Gotta stay up to date!

So instead of purchasing 30% more hardware to make up the difference. They will have to replace everything. Intel's adapting to this pretty dang quickly.

 

[Markfw]

So instead of purchasing 30% more hardware to make up the difference. They will have to replace everything. Intel's adapting to this pretty dang quickly.

There's lots of other things that still affect 10th gen hardware.

 

[dualsmp]

I also stumbled across this tidbit yesterday where Intel quietly dropped support for older versions of Intel ME. Meaning Broadwell and earlier get no fixes anymore. This was back in May 2019.

https ://www.intel.com/content/www/us/en/support/articles/000033416/technologies.html

Firmware versions Intel® Manageability Engine (Intel® ME) 3.x through 10.x, Intel® Trusted Execution Engine (Intel® TXE) 1.x through 2.x, and Intel® Server Platform Services 1.x through 2.X are no longer supported. Therefore, they weren't assessed for the vulnerabilities/CVEs listed in this Security Advisory. There's no new release planned for these versions.
--
Edit: Broadwell appears to use Intel ME version 10.x .

 

[Topweasel]

There's lots of other things that still affect 10th gen hardware.

Sure creating a scenario where people have to replace everything twice. Eventually they will have a security issue so bad that people will run screaming to Intel to let them by 2400x the amount of equipment in replacement of the new unsecured one.

 

[Gideon]

Well well, it looks that there was an AMD security flaw discovered instead:

https://twitter.com/x/status/1235979728860872705

More news probably coming later

 

[nicalandia]

Well well, it looks that there was an AMD security flaw discovered instead:

https://twitter.com/x/status/1235979728860872705

More news probably coming later

Please stop spreading FUD

 

[Jimzz]

Well well, it looks that there was an AMD security flaw discovered instead:

https://twitter.com/x/status/1235979728860872705

More news probably coming later

Really?

" Additional funding was provided by generous gifts from Intel. "

 

[Hitman928]

Well well, it looks that there was an AMD security flaw discovered instead:

https://twitter.com/x/status/1235979728860872705

More news probably coming later

While there's something there, it seems even harder to realize an actual attack than Spectre and also seems really easy to mitigate because it requires the attacker to be able to execute code on the same physical CPU core for one attack vector or the same logical core for the other attack vector. In other words, if you're in a cloud environment, then as long as you make sure instances don't share cores, you're good. If you're not in a cloud environment, you're probably pretty screwed anyway because the attacker is executing code on your system. I'll wait to see how AMD responds for the rest.

 

[Hitman928]

Really?

" Additional funding was provided by generous gifts from Intel. "

I don't think it's a secret at this point that intel is funding security research to try and find flaws in AMD CPUs. They don't want to be in this spotlight any more.

 

[moinmoin]

I'd take this serious, the people (from TU Graz) behind this paper also unearthed many of the Meltdown and Spectre vulnerabilities. Note that finding vulnerabilities is actually good news if it results in hardening the affected products (of which AMD's track record so far is fine). Also Intel's "involvement" says nothing, the team has been looking at CPUs for these kinds of weaknesses for years now and gets the chips directly from Intel and AMD these days, so they are acknowledged for that.

 

[nicalandia]

I call this BS.. Why did they had to reverse engineered AMD's L1D Cache way predictor instead of testing it on the actual hardware?

"Additional funding was provided by generous gifts from Intel" ...What kind of Gifts?

 

[DrMrLordX]

Wait for a proof-of-concept before anyone gets their panties in a wad.

Intel has been funding opposition research on AMD since RyzenFall.

 

[nicalandia]

Wait for a proof-of-concept before anyone gets their panties in a wad.

Well too late for this Fanboy..!

 

[UsandThem]

It looks like Tom's released an article concerning what was in the Tweet above, although they are still waiting to hear back from both AMD and Intel:

https://www.tomshardware.com/news/new-amd-side-channel-attacks-discovered-impacts-zen-architecture

A new paper released by the Graz University of Technology details two new attacks, Collide+Probe and Load+Reload, that can leak secret data from AMD processors by manipulating the L1D cache predictor. The researchers claim that the vulnerability impacts all AMD processors from 2011 to 2019, meaning that the Zen microarchitecture is also impacted.

The university disclosed the vulnerabilities to AMD on August 23, 2019, meaning it was disclosed in a responsible manner (unlike the CTS Lab debacle), but there isn't any word of a fix yet. We've pinged AMD for comment.

 

[moinmoin]

Really?

" Additional funding was provided by generous gifts from Intel. "

https://twitter.com/x/status/1236083330556231683

Daniel Gruss is an assistant professor in the Secure Systems group (Team Gruss/CoreSec) at the Graz University of Technology.

 

[VirtualLarry]

by manipulating the L1D cache predictor.

I understand the need for branch "prediction", but I guess I don't understand cache "prediction". Wouldn't that be "way selection", and not"prediction"?

I thought caching didn't rely on prediction, rather, search on tag bits, with final address bit verification, once the tag bits were hit in a "way".

I'm not really up on cutting-edge micro-architecture these days, so I could be wrong. I remember "COAST" modules for cache, that's about as recent as my knowledge on the subject.

 

[naukkis]

I call this BS.. Why did they had to reverse engineered AMD's L1D Cache way predictor instead of testing it on the actual hardware?

"Additional funding was provided by generous gifts from Intel" ...What kind of Gifts?

Because CPU's branch predictors and caches are utilized with microtags, only few bits of whole addresss space are needed for tags. AMD calls that way prediction but L1-cache is read with that microtag and that microtag can be wrong, so wrong data might be get from cache. Full tags are only checked later so side-channel exploit can leak that wrongly accessed data.

That's just why Intel cpu's are so vulnerable. Intel didn't hash their microtags at all so exploiting those vulnerabilities is as easy as it can be. AMD hashed those microtags so to exploit those vulnerabilities they first need to reverse-engineer those hash functions to be able to know how to attack against them.

 

[Nothingness]

I call this BS.. Why did they had to reverse engineered AMD's L1D Cache way predictor instead of testing it on the actual hardware?

I don't get your point: they reverse engineered the way prediction algorithm by running on actual hardware.