Intel Processors Hit with LVI Security Vulnerabilities, Mitigation Hits Performance Hard

[btarunr]

You are absolutely correct! Without this the same easy exploits could be achievable to black hats, who now have much harder time than before due to having to beat a bunch a researchers to the party.

I concede to that argument. But those black hats now have a steady stream of ideas with which to build malware and target unpatched machines. We have a steady stream of patches that cost performance.

 

[thevoiceofreason]

No the cannot be disabled already for a year+. Those are baked permanently in the kernel.

That's not really true. You can just boot with mitigations=off switch as per kernel-parameters

also, please refrain from the ”security through obscurity” -fallacy. https://www.isaca.org/resources/isa...cies-of-security-by-obscurity-full-disclosure

Nice advertisement. Hint: see who wrote the "article", what is his affiliation, and who publishes the "journal".

 

[Dredi]

i concede to that argument. But those black hats now have a steady stream of ideas with which to build malware and target unpatched machines.

There are a lot easier attack vectors that can be utilized for unpatched systems. For example the openSSL vuneralbilities from a year ago. Do you think that should have been left unpatched as well?

 

[Ferrum Master]

That's not really true.

Few CVE's are hard baked without options to switch off. That kernel.org documentation conflicts with Microsoft published info. Who's telling the truth then?

 

[Vya Domus]

There is something bewildering about the way these things are made public :

The hell is this supposed to be ?

AMD is safer only because its market footprint is too small in the datacenter space

No, AMD is safer, that's the end of it.

 

[Ned Flanders]

AMD is safer only because its market footprint is too small in the datacenter space, most of these side-channel attacks affect datacenters, and you can't hack AMD processors for rich bounties (it's similar to the "Macs don't get viruses" fallacy of the 1990s and 2000s).

@btarunr
Whats your opinion on the fact that Meltdown doesn't work on AMD CPUs because the AMD µarch does not (and apparently never did) allow speculative execution across privilege domains (Userspace - Kernelspace). This doesn't sound to me as a question of market share. If AMD was at 80% marketshare, they would still not allow speculative execution across privilege domains while Intels µarch does.

 

[mtcn77]

At this point I think the only way Intel can fight these vulnerability discoveries is by killing the bug bounty program, or significantly reducing the bounty. The program has clearly sprung up a cottage industry of security researchers (uni professors and their college grad minions) bruteforcing Intel processors for vulnerabilities that they can write papers on (earn citations), report back to Intel, and claim the cash bounties. The BBP has become a fountainhead of headache for CTOs and CIOs.

AMD is safer only because its market footprint is too small in the datacenter space, most of these side-channel attacks affect datacenters, and you can't hack AMD processors for rich bounties (it's similar to the "Macs don't get viruses" fallacy of the 1990s and 2000s).

Respected editors, can we please get past this AMD bulverism?
AMD is safe because 'meltdown' does not work on the AMD platform. This is not a personal opinion. It just doesn't. I encourage you to find this observation and report as necessary.
Don't skew the argument.
If you read the impact of this, they say somewhere Intel will have to serialize accesses to its ports, effectively turning off speculative execution in some cases.

I cannot even believe this was posted a moment back:

LVI necessitates compiler patches to insert explicit lfence speculation barriers which serialize the processor pipeline after potentially every vulnerable load instruction.

 

[Aquinus]

How many real exploits (not PoCs,) actually exist that use these vulnerabilities though?

The reality is that a lot of these exploits (not all of them,) are so hard to use that their usefulness is almost non-existent. Spectre is a great example of a vulnerability that is susceptible to academic papers, but not real users. Making a PoC that can sometimes leak tiny amounts of data under the right conditions doesn't amount to a usable vector for attack, particularly if how you exploit it requires you to give away that you're trying to break the system (like putting it under full load.)

 

[TheDeeGee]

More performance reductions.

My 4770K... i mean Pentium 3 by now is ready!

 

[Ferrum Master]

More performance reductions.

My 4770K... i mean Pentium 3 by now is ready!

Just be ready to compare.

Share your CPUZ Benchmarks!

www.techpowerup.com

 

[HwGeek]

Poor Bulldozer...looks like it didn't get a fair fight back then... looks like soon even the FX 8370 could overtake the 9900K .

 

[fynxer]

Starting to think Intel use these mitigations to slow down old cpu's so we will buy new ones.

 

[NukeDukem]

I figured it out. CVE actually stands for Corona Virus for Electronics.

It gets the elderly architectures first.

BRUH

 

[eidairaman1]

Give credit to @biffzinker for posting this news yesterday.

 

[GlacierNine]

I concede to that argument. But those black hats now have a steady stream of ideas with which to build malware and target unpatched machines. We have a steady stream of patches that cost performance.

Attempting to hide security vulnerabilities both downplays the severity of the problem, and also encourages businesses people rely on to safeguard their data, to also ignore the extent of the issue as the public will not hold them sufficiently accountable.

Think of it this way: Which would you rather have? A world where facebook gets hacked, they say it was an "unexpected and little known vulnerability" and everyone believes them because only Project 0 and Krebsonsecurity ever posted about it?

Or a world where facebook gets hacked, everyone knows the name of the exploit and facebook has to cough up a good reason they weren't secured against it from the day the vulnerability was made public because it was on Techradar, Gizmodo and TPU?

also -

it puts multi-tenant machines, such as physical servers handling multiple tenants via virtual servers.

Presumably you accidentally missed out the words "at risk" ?

 

[TheinsanegamerN]

I concede to that argument. But those black hats now have a steady stream of ideas with which to build malware and target unpatched machines. We have a steady stream of patches that cost performance.

Are you really arguing that these exploits being made public knowledge is giving black hats more info then they already have?

Dude, how many times you going to stick your tongue on the stove before you figure out the stove is hot? Quit with these side arguments that security through obscurity is a good thing. Windows exploits are constantly made public knowledge, and as a result is harder to get into then the likes of MacOs that hid their exploits for years and as a result are leakier then a rusty sieve.

Despite all those patches "costing" performance, intel is still on top for gaming performance, and AMD already humiliated them in everything else. Your average end user doesnt notice significant differences from these patches.

Name a ransomware that leverages a CPU-level vulnerability. Bonus points for one that leverages a side-channel attack vector.

You cant, because they were patched by intel thanks to their bounty program making them aware of issues.

just one swing and a miss after another today eh?

 

[R0H1T]

Think of it this way: Which would you rather have? A world where facebook gets hacked, they say it was an "unexpected and little known vulnerability" and everyone believes them because only Project 0 and Krebsonsecurity ever posted about it?

Or a world where facebook gets hacked, everyone knows the name of the exploit and facebook has to cough up a good reason they weren't secured against it from the day the vulnerability was made public because it was on Techradar, Gizmodo and TPU?

I'd rather FB die the way of the Dodo or Myspace if we're being generous

 

[GlacierNine]

I'd rather FB die the way of the Dodo or Myspace if we're being generous

Yeah but we're talking about things that might actually happen in the short-medium term. Facebook isn't going anywhere for at least a while.

 

[Chomiq]

Give credit to @biffzinker for posting this news yesterday.

He's mentioned in the footer, right above source link.

 

[John Naylor]

I have seen dozens of announced vulnerabilities for both AMD and Intel CPUs ... what I have never seen is a doumented instance of any of these vulnerabilities ever being exploited. So all that's really of note here is fanboi bickering which has as much valididity as "ntel is still on top for gaming performance, and AMD already humiliated them in everything else ". The definition used for "everything else" is specious.

A PC is a tool ... a tool can only be judged at how well it does it's job, so let's define it's job.

a) Did you build a PC to run benchmarks and get your name on leader boards ?
b) Did you build a PC based upon performance in things that you might do one o do few times a year ?
c) Did you build a PC to play games and run applications on a frequent bias.
d) Did you build your PC to run apps you will never use

Practical people build the boxes based upon c) and c) only ... fanbois squawk about a) and b). Let's look aty TPUs test results. Three is no "Best CPU" .. only the best CPU for a specific set of applications. Looking at 3900X vs 9900KF


1. Cinebench - a) category ... we have yet to be asked to do a build which maximizes Cinebench performance or had a client who uses it to make a living, it's the medical equivalent of a scalpel in a Chiropractice office. We do have lots of folks who use CAD, adding all the PCs in all the offices we've been in, there's prhaps 1 rendering box for every 200 CAD boxes and AutoCAD at $5,000 per seat ($2,00 per year) is not exactly on a any significant % of PCs.

Gotta give an easy win to AMD here, but a 0.50 on market significance.

2. Game / Software Development - d) category ... again an easy win here for AMD; Again, not a lot of market significance, as above, teeny user base.

3. Web Related - c) Category ... performance is split between red and green camps but with differences of /10th of a second, who cares ? Uses can not react quick enough to take advantage of it.

4. Machine Learning \/ Physics / Brain Simulation - d) category. The size of the market here is completely insignificant, and if the % of users here who run this stuff ia mor than 0.2% Id be shocked... Another win for AMD, but not one that will matter to 99+% of the forum audience.

5. Office Suites - Finally a category c) item ... stuff most folks will use frequently enough to matter in a CPU choice. We get a 4% win for Intel in Word, a 1% win for Intel in Powerpoint and a 1% win for AMD in Excel ... the win goes to Intel but the margin is so small as to render in insignificant as "user lag" will make it unnoticable.

6, Image and Video Editing - Another category c) items and here finally one that matters. A 10% advantage to Intel here in Image Editing and a 4.5% advantage in Video Editing. While not a bit thing market share wise, it's over 100 times more significant tham machine learning, brain simulation, software development, etc. 1st significant win for either side here. Google OCR is in the test and it's significant one ... we might use it 3-4 times a year so we use Adobe OCR to do thatas do most of our clients.

7. Virtualization - As we're speaking to desktops not Server functions I'd skip this. Suffice to say Intel gets the win on VM Ware ... AMD gets significant wins in MySQL and jav ... a Bog reason to go AMD ,..if you use them. No relevance if you don't.

8, File Compression / Encryption - A category b) items for most. less and less as time goes by. Big Win for AMD on the compression / Bit win for Intel on encryption ... Who cares ? Not many

9, Media and Sound recording - Would be at thing for youtubers, musicans and similar sorts and similar sorts, AMD dominates the media / Intel dominates the sound... if those are your thang, pay attention ...if not like most, ignore.

10. No one argues the gaming so not worth mentioning.

In short, there is no best CPU... there's only best for you do on your PC. If office suites, gaming, Adobe products or AutoCAD are your thing, Intel is the onbviois choice. If doing brain simulation, encoding, rendering, virtualization is your thing, AMD is the obvious choice.... just look at what YOU do and decide accordingly. As to the invulberabilitoes... call me when ya ready to publish "Patient O's" story. As of yet , I have not seen any instance of theese invulnerabilities being exploited. Until that happens, I'm not paying attention.

 

[Raptor_i]

I'll be happy if there is a way to avoid fixing these Vulnerabilities , I can't afford losing anymore performance even if it's a fraction .

 

[phanbuey]

Also they're not going to ramrod a security patch that drops your performance by 30% -- at that point it will be a toggle or a Windows defender app monitor feature. Just like for phishing sites or malware. It will come down to users having more control. You can easily make sure that only the code you want is running; and let the users let applications in one by one, in addition to a scan of known malware.

 

[GreiverBlade]

why every time i read ... "Mitigation Hits Performance Hard" i think .... "awwww the improvements Intel implemented to make their CPU's faster turn out to be vulnerabilities, shucks ... who knew ..."
well, can also take it like that, if the CPU was faster with all the vulnerabilities ..: "Intel did take shortcuts in their design to make their CPU faster"
was it on purpose or not ... was it truly vulnerabilities they had no clue about it until some "bug-hunter" found them?

alright, alright, i know AMD has vulnerabilities too (well what... 2? oh ... ) but i think even with mitigations, their performance will keep close to their actual level without them (if they need one ofc)

 

[londiste]

why every time i read ... "Mitigation Hits Performance Hard" i think .... "awwww the improvements Intel implemented to make their CPU's faster turn out to be vulnerabilities, shucks ... who knew ..."
well, can also take it like that, if the CPU was faster with all the vulnerabilities ..: "Intel did take shortcuts in their design to make their CPU faster"

Nope. This idea has been making rounds again and it is simply wrong. These vulnerabilities did not help Intel CPU to be faster. These were not shortcuts but an oversight at some level.

Mitigations are software workarounds to hardware problem and this makes them really hard on performance. If you look at the performance of Intel's newer revisions of CPUs with issues fixed, the vulnerabilities (at least the known vectors) cannot be exploited any more, software mitigations are not applied and the performance is the same as before.

Edit:
OK, performance is not quite the same as before because Spectre did make some software changes necessary. However, this 3-4% performance hit (based on Phoronix' testing) is universal across all CPUs.

Also they're not going to ramrod a security patch that drops your performance by 30%

They are not. Intel will deploy mitigations for SGX but consider risk of exploiting the vulnerability in other places small enough to not apply general mitigation. There will be some coordination with OS development to minimize the possibility of OS-level gadgets this type of attack could use. Researchers did seem to agree this was reasonable.

 

[TheGuruStud]

Intel security article: But, but ,AyyyyMDeeeee! Reeeeee!

Take your intel love affair down a few notches. AMD chose to be safe. Intel choice IPC at all costs. Or they're completely incompetent, it's your pick.