Tuesday, January 2nd 2018
Intel Secretly Firefighting a Major CPU Bug Affecting Datacenters?
There are ominous signs that Intel may be secretly fixing a major security vulnerability affecting its processors, which threatens to severely damage its brand equity among datacenter and cloud-computing customers. The vulnerability lets users of a virtual machine (VM) access data of another VM on the same physical machine (a memory leak). Amazon, Google, and Microsoft are among the big three cloud providers affected by this vulnerability, and Intel is reportedly in embargoed communications with engineers from the three, to release a software patch that fixes the bug. Trouble is, the patch inflicts an unavoidable performance penalty ranging between 30-35%, impacting the economics of using Intel processors versus AMD ones.
Signs of Intel secretly fixing the bug surfaced with rapid changes to the Linux kernel without proper public-visibility of the documentation. The bulk of the changes involve "kernel page table isolation," a feature that prevents VMs from reading each other's data, but at performance costs. Developers note that these changes are being introduced "very fast" by Linux kernel update standards, and even being backported to older kernel versions (something that's extremely rare). Since this is a hardware vulnerability, Linux isn't the only vulnerable software platform. Microsoft has been working on a Windows kernel patch for this issue since November 2017. AMD x86 processors (such as Opteron, Ryzen, EPYC, etc.,) are immune to this vulnerability.
Source:
Reddit
Signs of Intel secretly fixing the bug surfaced with rapid changes to the Linux kernel without proper public-visibility of the documentation. The bulk of the changes involve "kernel page table isolation," a feature that prevents VMs from reading each other's data, but at performance costs. Developers note that these changes are being introduced "very fast" by Linux kernel update standards, and even being backported to older kernel versions (something that's extremely rare). Since this is a hardware vulnerability, Linux isn't the only vulnerable software platform. Microsoft has been working on a Windows kernel patch for this issue since November 2017. AMD x86 processors (such as Opteron, Ryzen, EPYC, etc.,) are immune to this vulnerability.
53 Comments on Intel Secretly Firefighting a Major CPU Bug Affecting Datacenters?
I'm starting to think it will seriously impact those large corporations with datacenters/farms but not nearly as much the regular users... Still, Intel is gonna bleed some significant cash.
Cite:
" ... in all Intel CPUs. Apparently, a process can make an Intel CPU exploit a hardware bug speculatively load memory areas and then allow access to it without further testing, without the process having the necessary rights. This allows an unprivileged process to access the memory of the kernel, which can contain sensitive data. This is especially precarious for cloud providers such as Amazon and Google, who want to prevent breaking out of virtual machines. In addition, the kernel's Address Space Layout Randomization (ASLR) security technique, which is used as defense in depth, could be compromised."
Intel needs to go back to drawing board, and test their premium CPU's accordingly. Stop making things so complex with IME.
By the way
www.techpowerup.com/forums/threads/amd-lobbies-to-be-excluded-from-intel-vt-flaw-kernel-patches.240187/
On the positive i can't wait for five years when the ramifications of all this are buyable in silicon:),by me , what with the competition in the field people are going to have to do some extraordinarily good work to compete.
www.techpowerup.com/forums/threads/my-research-into-amds-linux-performance-marginality-issue.237195/page-2#post-3777687
not so much if you host your own infrastructure. After all it appears you have to already have access to a vm on the machine to read the contents from another. Within an organization that's less of a concern than say me having an AWS node that can read the contents of another companies AWS node...
Except for the minimum $250,000 required by Intels bylaws.
WHAT A SLEAZY COMPANY!
www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx
They are using the latest Win10 Insider build which has the fix enabled. The test system consists of an i7-7700K and an Asus GeForce GTX 1080 Ti Strix.
See screenshot below or this link for all benchmarks. As expected performance in AC only decreases when the CPU is the limiting factor (low details, high framerates). This could mean that the impact is a lot higher on lower performing systems (e.g. i3 or Pentium processors) where the CPU is the bottleneck.