Huge Intel CPU Bug

[zakblood]

Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit In Windows And Linux
If the reports are accurate, it appears that Intel might have a pretty severe chip-level security bug on its hands that cannot be simply swatted away with a microcode update. The bug affects all modern Intel processors dating back at least a decade.
We should note that squashing the bug requires a patch at the OS level; and Linux patches have already been distributed.

Microsoft is expected to address the bug in its monthly Patch Tuesday update. The circumstances surrounding the exploit are currently under embargo, but some details are starting to make their way to the public spotlight.

There's one big problem, however. Fixing this vulnerability in software also comes with a big hit on performance. Additional overhead is introduced to maintain a barrier between memory address spaces, which can result in a performance handicap of 30 percent or more. However, recent Intel processors with PCID (Process-Context Identifiers) enabled could have the performance impact lessened somewhat.

The hardware bug is apparently severe enough to make it ripe for exploitation, with some of the biggest targets being companies that use virtualized environments.

"Urgent development of a software mitigation is being done in the open and recently landed in the Linux kernel, and a similar mitigation began appearing in NT kernels in November," wrote the Python Sweetness blog on Monday. "In the worst case the software fix causes huge slowdowns in typical workloads.

"There are hints the attack impacts common virtualization environments including Amazon EC2 and Google Compute Engine."

In addition, apparently both Microsoft Azure and Amazon Web Services have scheduled maintenance that will take place over the next week, although there is no detailed explanation for the downtime. However, rampant speculation suggests that the maintenance could be to put the software fixes in place for this specific Intel CPU hardware bug. Literally, in some cases, it appears operating systems will need to be overhauled to deal with the issue.

You may have noticed that we haven't mentioned AMD once in this article up to this point. Well, AMD processors aren't affected by the bug due to security protections that the company has in place. This also means that AMD processors shouldn't be affected by any performance hits.

Further, AMD"s latest EPYC data center server chips and Ryzen Pro enterprise desktop CPUs have Secure Memory Encryption technology on board, for additional protection against just these sorts of threat vectors.

Regardless, given that the patches are currently under embargo and that Intel is understandably staying tight-lipped, it may still be a few days before we are made privy to all pertinent details surrounding the bug and how damaging it will be to existing computing platforms. However, all of this is looking very real at this point. The Linux update detailing its patch has been posted here by Linus Torvalds himself.

Update, 10:02 PM - 1/2/18 - Initial performance results on Linux platforms are beginning to surface now on the web. Early numbers are showing IO-intensive workloads are especially sensitive to the Kernel Page Table Isolation patch.

Linux performance enthusiast site Phoronix has posted some early benchmark numbers, post-patch. Some results are coming in with a 17 - 18 percent degradation overall.

Update, 10:56 PM - 1/2/18 - As it turns out, apparently the Linux patch that is being rolled out is for ALL x86 processors including AMD, and the Linux mainline kernel will treat AMD processors as insecure as well. As a result, AMD CPUs will feel a performance hit as well, though the bug only technically affects Intel CPUs and AMD recommends specifically not to enable the patch for Linux. How Microsoft specifically will address the issue with the Windows operating system remains unclear until the company's formal Patch Tuesday update is made known, hopefully soon.

[zakblood]

so why post?

does anyone care?

and does it effect you?

post is for information only, and may help some after Tuesdays patch fully understand why there pc may being going slower now than before the patch, so if your pc is borderline, eg only now just runs a game, after Tuesdays patch, it may not meet the minimum for a given game, after a 30% CPU loss etc.

[VPaulus]

Does this affect all existing Intel CPU processors?
Are other Windows besides 10 being affected?
Will the patch be optional for Windows users?

[rommel222]

Greetings zakblood,
Thanks for posting this and alerting to performance hits. [:(]

[rico21]

I do not think it's intel's fault. We have not been in control of our computers for a long time. Manufacturers are putting spyware into hardware, spy secret services around the world is using big computer boxes to penetrate our data, and I do not even talk about civilian hackers. All this is an important part of the processors activity and makes our machines row.
Intel is the tree that hides the forest![:(][:D]

[hadberz]

Good to know. I'm thinking of upgrading my computer this year. Guess I will wait for a cpu refresh.

[zakblood]

ORIGINAL: VPaulus

Does this affect all existing Intel CPU processors?
Are other Windows besides 10 being affected?
Will the patch be optional for Windows users?

all Intel cpu's and all versions of windows, included servers versions atm as well, but no idea if they will sort out something at a later date, as i would guess they will have to, as 30% is a massive loss for most, win 10 users, no options as it's a auto recommended download, others it's a choice, but as it's a loop hole fix, most would be mad not to have it either, as it's pre O/S entry access to your pc and o/s, so scammers and bots could undermine any ones protection without it

[Lecivius]

Wow, there really is not a lot of detailed information out there. I have so many questions, and none were answered in the first 10 articles I read...

[ncc1701e]

If I knew, I would have bought a new PC for Christmas [:D]

[rommel222]

Greetings to All,
Here are some online reference articles for reference:
https://www.theverge.com/2018/1/3/16844 ... dows-linux
https://www.extremetech.com/computing/2 ... erformance
https://www.pcworld.com/article/3245606 ... c-mac.html
https://www.theregister.co.uk/2018/01/0 ... sign_flaw/

I have concerns for the online physics and astronomy courses I teach. The students buy the cheapest computer they can get to run the required simulation software and sometimes have trouble due to bare minimum cpu and graphics memory requirements. If there are going to be slow downs I worry about students being able to run the software due to performance hits.

[Aurelian]

Hmmm, and I'm telling myself "Should of stuck with AMD"....[:)]

[Zorch]

ORIGINAL: Aurelian

Hmmm, and I'm telling myself "Should of stuck with AMD"....[:)]

But how do you know AMD doesn't have a similar backdoor? [:D]

[Aurelian]

ORIGINAL: Zorch

ORIGINAL: Aurelian

Hmmm, and I'm telling myself "Should of stuck with AMD"....[:)]

But how do you know AMD doesn't have a similar backdoor? [:D]

I don't, but I've never heard of any problems. I still have my AMD proc and motherboard and memory

[ncc1701e]

No, AMD is not affected by this bug.

[Zorch]

ORIGINAL: ncc1701e

No, AMD is not affected by this bug.

Key word being 'this'. [8D]

[Lobster]

ORIGINAL: Zorch

ORIGINAL: ncc1701e

No, AMD is not affected by this bug.

Key word being 'this'. [8D]

[8|][8|][8|][:D]

[Orm]

Thank you for the information. [&o]

It would be appreciated with updates as more information become available.

[Crossroads]

Seems there's two serious bugs in play, "Meltdown" and "Spectre". former (so far) deemed specific to Intel CPUs, but the latter for AMD CPUs too [:(]

“Meltdown” and “Spectre”: Every modern processor has unfixable security flaws

[Crossroads]

I patched my Macbook the other day without being aware of this. It seems to run hotter now, with the fan kicking in quite soon to high gear, something it's not done before [&:]

[stuart3]

Below is the latest Google Security Blog. It includes the sentence "These vulnerabilities affect many CPUs, including those from AMD, ARM, and Intel, as well as the devices and operating systems running on them."

https://security.googleblog.com/2018/01 ... -need.html