Major Intel CPU Hardware Vulnerability Found

[IceScreamer]

Apparently Sandy plus Win7 perf drop is not negligible.
https://translate.googleusercontent...marks/&usg=ALkJrhi-Hx_uJfTyVbvqcxjEVJMeVi9pog

 

[Bill_Bright]

Never mind AMD's response, what's their excuse for not knowing, or at least claiming to not know this was going to be a problem when designing the chips? How is it when this kind of thing comes out, only Intel gets accused of cleverly hiding the truth?

When designing the chips? Nah! If they knew, they would not have kept designing newer chips with the flaws in them.

I don't see where Intel is being blamed for "cleverly" or deceptively hiding the truth - except accusations by uninformed or biased haters. Exploitable bugs and flaws need to stay secret so the bad guys don't learn of them and release zero-day threats.

Also, nobody, not Intel, not AMD, and not the security industry - no one knew exactly the extent or complexity of these flaws/bugs in the beginning. As further research was conducted, more information and clarifications came out. This is no different from major natural disasters, accidents, terrorist attacks, or battle in a war zone. There is always confusion, missing and misinformation in the beginning.

The we (consumers have) is all the biased reporting and speculations. Let the dust settle them move on from there.

 

[biffzinker]

Looks like I just missed the cut off for the microcode update. ASUS, Gigabyte, and MSI are or will be issuing BIOS updates starting with Intel 100/X99 PCH up to Z370/X299.

https://www.asus.com/News/V5urzYAT6myCC1o2

https://www.gigabyte.com/Press/News/1586

https://www.msi.com/news/detail/QBt...HcZnxQNrE3uwkiUor437JtN5UyEv_PKbKx1DpEUNxNA~~

 

[cucker tarlson]

Seriously ? No bios update for Z97 ? Broadwell-c is a Q2 15 CPU, but too obsolete to include in the update ? Well, maybe they're gonna patch it eventually, not that I'm too concerned about those anyway since there's really nothing to steal on my PC. What a scam company though.

 

[DimBo]

Seriously ? No bios update for Z97 ? Broadwell-c is a Q2 15 CPU, but too obsolete to include in the update ? Well, maybe they're gonna patch it eventually, not that I'm too concerned about those anyway since there's really nothing to steal on my PC. What a scam company though.

I asked Gigabyte tech support whether they're going to release new BIOSes with updated CPU microcode for Z87 & Z97 motherboards or not. They answered that they'll provide updated BIOSes per user request and asked the exact model and revision of the motherboard I need an updated BIOS for.

 

[Bill_Bright]

per user request

Wow. That seems highly inefficient. I wonder what that really means? I bet they will develop an update after they receive a certain number of requests per chipset/board.

FTR - Gigabyte has a new BIOS update for the Z170 series boards, like the one I use in this computer, dated 2018/01/11. Once I finally remembered I had disabled booting from USB, the update flashed with @bios with no problems. And I have not noticed any degradation in performance or any problems with fan noise or heat.

There is no update for my secondary computer running with a Z77X chipset and i7 3770. Oh well.

 

[cucker tarlson]

I asked Gigabyte tech support whether they're going to release new BIOSes with updated CPU microcode for Z87 & Z97 motherboards or not. They answered that they'll provide updated BIOSes per user request and asked the exact model and revision of the motherboard I need an updated BIOS for.

Weird.

 

[Vya Domus]

Also, nobody, not Intel, not AMD, and not the security industry - no one knew exactly the extent or complexity of these flaws/bugs in the beginning.

Intel clearly knew for quite some time. Why do you think the shitstorm hit them first ?

 

[EarthDog]

They didnt both get hit at the same time with the release of that testing? I recall amd (prematurely) denying it affected their processors the same day...maybe that is why you feel it is different? I dont know... this is a hilarious shitstorm here i am proud to say i have mostly stayed out of.

 

[RejZoR]

Makes you wonder, has no one at any point through the history stopped for a second and evaluated the speculative cache design or everyone just crossed their fingers and hoped no one would exploit it? I mean, they are the makers of the chips, surely they know how it works and what are the possibilities for exploitation. Or was that awesome performance gain just too sweet to lose it and they just did the fingers crossed thing?

 

[Vya Domus]

They didnt both get hit at the same time with the release of that testing?

"Meltdown like" vulnerabilities have been exposed on the Intel side throughout the year 2017. All I am saying is Intel did knew about all this without question and pretty much did nothing about it up until this was picked up by the media like crazy.

Not that I am blaming them , this is pretty much standard behavior for these companies in situations like these.

 

[kruk]

Hehe, Intel kernel developers managed to p*ss of Linus Torvalds:

http://lkml.iu.edu/hypermail/linux/kernel/1801.2/04628.html

As it is, the patches are COMPLETE AND UTTER GARBAGE.

They do literally insane things. They do things that do not make
sense. That makes all your arguments questionable and suspicious. The
patches do things that are not sane.

WHAT THE F*CK IS GOING ON?

 

[EarthDog]

"Meltdown like" vulnerabilities have been exposed on the Intel side throughout the year 2017. All I am saying is Intel did knew about all this without question and pretty much did nothing about it up until this was picked up by the media like crazy.

Not that I am blaming them , this is pretty much standard behavior for these companies in situations like these.

What's worse... knowing about it and not doing anything about it, or not knowing about it and denying it affects 'us'? (don't answer... this is in jest).

Either way, its a hilarious situation on many fronts from all sides. Lots of mountains, when in reality, its mole hills for most any user on here. The vocal should be the cloud providers, not a bunch of people it really doesn't affect.




I'd wish Linus would stop complaining and explain what a better fix would actually be or why they are implementing like that. I deal with tantrums like this from my 10 y.o. I don't expect to see it out of an educated professional.

 

[Bill_Bright]

Also, nobody, not Intel, not AMD, and not the security industry - no one knew exactly the extent or complexity of these flaws/bugs in the beginning.

Intel clearly knew for quite some time. Why do you think the shitstorm hit them first ?

I said, "in the beginning". You even quoted it!

And the storm hit from 2 groups of people for 2 different reasons, one legitimate the other totally ridiculous.

The first storm hit because of the shear size and impact of the problem. That was totally legimate. What was rediculous was the second storm created by haters and wannabe journalists creating all the FUD with their wild speculations and outright falsehoods.

OF COURSE Intel and others knew about it before the news hit the fan. If you have a security vulnerability, you don't go advertising it to the world before you have a fix for it. But sadly, the haters and wannabes (and their blind followers) are too naive, stupid, or ignorant (or all 3) to understand that.

This is not a problem Intel has been sitting on for over a decade with their fingers crossed hoping nobody would notice. The problem is, nobody, not even Intel, noticed it until recently - including the big and very resourceful "whitehat" security firms Intel, AMD, Microsoft and others hire to find such bugs. We are just fortunate the bad guys did not find it first.

 

[DimBo]

The last answer from Gigabyte support (quoted text is translated from Russain to English by me, so don't be surprised if it contains errors):

The request for BIOSes with fixes for Intel SA-00086 & SA-00088 vulnerabilities was sent to our engineers. Because our BIOS team is under a high workload now, it'll take some time to make these customizations. We'll send you the BIOSes as soon as they'll be ready.

Judging by the answer they indeed are going to send BIOSes per request instead of publishing them, which is strange. I also expected that they'll warn me about the current "anti-spectre" CPU microcode for Haswell and Broadwell being unstable (it is known to cause BSODs and spontaneous shutdowns), just in case I don't know about it, but they didn't. Well, the fact that they're supporting 4-5 years old hardware is a good thing anyway. At least they didn't tell me to GTFO and buy a new CPU

 

[Vya Domus]

OF COURSE Intel and others knew about it before the news hit the fan.

The problem is, nobody, not even Intel, noticed it until recently

The thing is they knew for a pretty damn long time :

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754

This was filed back in Feburary 2017. I legit do not believe they were struggling the find a fix ever since. The patch is not something you would have worked on for an entire year , it is clear to everyone that it was something put together in a very short time when the media reports exploded.

The only conclusion I can make is that they knew for a very long time and they simply did not care about it at all. That's all there is to it , and again I do not expect anything better from all of these manufacturers , not just Intel.

I don't know why you are struggling to defend Intel and blame everything on shitty journalism and FUD , that doesn't pardon the obvious lack of response Intel had on this issue. Yes , the articles written were absolute garbage and it was indeed full of FUD but what else did you expect from them ?

 

[londiste]

Makes you wonder, has no one at any point through the history stopped for a second and evaluated the speculative cache design or everyone just crossed their fingers and hoped no one would exploit it? I mean, they are the makers of the chips, surely they know how it works and what are the possibilities for exploitation. Or was that awesome performance gain just too sweet to lose it and they just did the fingers crossed thing?

They did. A lot of people have worked on this problem and the Meltdown/Spectre discoveries were not found from scratch, a lot of previous research has been done and has been used in this.
- The theoretical vulnerability was known and warned about from the start of speculative execution being implemented in CPUs (early nineties or even earlier). Specific concerns about Intel's predictor were aired around 2012-2013. In 2016 it was found/shown that speculative execution really does load data it should not (but no method to retrieve it was found).
- Add to it the various necessary know-how. A lot of prerequisites for the work came from both published information as well as couple/several years worth of research on Intel's branch predictors (specifically Haswell but it has probably been pretty much the same in this regard at least since Sandy Bridge if not earlier). Flush+Reload was found in 2013.
There were other bits in there but I do not remember all I have read about this clearly enough. I may be off by a year here or there but this is the gist of it.

Also, nobody, not Intel, not AMD, and not the security industry - no one knew exactly the extent or complexity of these flaws/bugs in the beginning.

Intel clearly knew for quite some time. Why do you think the shitstorm hit them first ?

Depends on what we look at as the beginning. Specifically Meltdown and Spectre were found in June 2017 and reported to the industry. The half-year embargo on details is not unexpected, it gave time to everyone involved/affected to align their affairs. Details were supposed to be published somewhere in the second half of January but rapid feverish changes being pushed into Linux kernel obviously caused a lot of alerts to go off.

Intel deservedly got the shitstorm first because Meltdown is stupid

 

[Bill_Bright]

udging by the answer they indeed are going to send BIOSes per request instead of publishing them, which is strange. I

I don't think it is strange. It makes sense to me - from a business decision. Gigabyte is a hardware maker. No doubt their programming staff is not very big. So their limited resources must be concentrated on those Gigabytes platforms that are currently in design, development or in production stages. It would be bad business to sell brand new products that are flawed leaving the factory.

The thing is they knew for a pretty damn long time :

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754

This was filed back in Feburary 2017. I legit do not believe they were struggling the find a fix ever since. The patch is not something you would have worked on for an entire year , it is clear to everyone that it was something put together in a very short time when the media reports exploded.

I don't think you appreciate the complexity of the task.

It is not like calling up the source code, edit a couple lines, compile and save the code and be good to go.

And re-tooling a high-tech processor manufacturing plant is a major, extremely complex process too.

Plus it is not just CPU makers involved but countless partners and competing OEMs who all must make a coordinated effort to develop, test and distribute fixes.

I am not blaming everything on bad journalism and FUD. But I sure am blaming bad journalism and their FUD for exaggerating the threat and stirring up and creating unrealistic expectations in people who don't really understand or appreciate the problem, or how to correct it.

It seems you and your fellow believers are just mad because you and the public were not made aware of this issue sooner. Well, anyone who's worked in security for any length of time knows and appreciates there are many things the public (which includes the badguys) does not need to know about. But that does not mean there are not many dedicated people working behind the scenes to protect us. That is exactly why Intel, AMD, Google Microsoft and others all agreed to keep the details under wraps.

But that does not mean I don't put any blame on Intel as you also seem to believe. The flaw is in Intel chips. Chips they designed and manufactured. That's on them. And their PR department (probably with the help of their shyster... err... I mean legal department) blew it by downplaying the problem when it first went public.

But the fact remains related flaws are found in competing processors too. Intel did not force those flaws on AMD or ARM processors. But as is typical, the one with the deepest pockets gets the most wrath. That, and the unrealistic expectations and blown out of proportion threats are what I am defending against.

Apple has indicated that all iPhones, iPads and modern Mac devices are affected by Meltdown. Where's the wrath against them?

Is the threat serious? Of course. I have never denied that. But is it unlikely any of us reading this thread has, or ever will be compromised by a badguy exploiting it.

 

[EarthDog]

I don't think it is strange. It makes sense to me - from a business decision. Gigabyte is a hardware maker. No doubt their programming staff is not very big. So their limited resources must be concentrated on those Gigabytes platforms that are currently in design, development or in production stages. It would be bad business to sell brand new products that are flawed leaving the factory.

Interesting take. Its not like they have to apply the BIOS to 10s of thousands of people. They have to develop a few dozen. Though their staffs are small, I am certain in no time flat someone would have requested a BIOS for each board they made which is affected. So why not dedicate resources up front to tackle them all and mass distribute?

To answer that, I would think that customer service would get bombarded, so perhaps that is actually why and has nothing to do with BIOS staff.

 

[trickson]

I bet users are having panic attacks now at that performance loss.

Almost like getting your e-wiener reduced.

AMD Ryzen FTW!!!
So there saying this affects speed and performance and security? WOW! Sounds like Intel has some E-peens to fix... LOL.

 

[Zyll Goliat]

Intel Recommends Users Don't Install Meltdown and Spectre Fixes Due to Random Reboots?
Links:
http://www.game-debate.com/news/244...tdown-and-spectre-fixes-due-to-random-reboots

https://www.computerworld.com/artic...-not-install-its-meltdown-firmware-fixes.html

https://www.wired.com/story/meltdown-and-spectre-patches-take-toll/

 

[trickson]

Intel Recommends Users Don't Install Meltdown and Spectre Fixes Due to Random Reboots?
Links:
http://www.game-debate.com/news/244...tdown-and-spectre-fixes-due-to-random-reboots

https://www.computerworld.com/artic...-not-install-its-meltdown-firmware-fixes.html

https://www.wired.com/story/meltdown-and-spectre-patches-take-toll/

I recommend everyone dumping Intel if that is the case! I mean so what Intel has been doing knowingly is sell consumers defective chips that do not work accordingly to the spec's? That is if able to be prove maybe false advertising misleading the consumer? This is NOT good for Intel!

 

[biffzinker]

The Microsoft patch that encompasses Meltdown mitigation plus Spectre with the microcode update from Intel isn't causing any issues unless you had a old AMD K8 CPU (later fixed.)

The microcode update from Intel is causing sporadic reboots on Haswell/Broadwell, and possibly later Skylake/Kabylake.

 

[Zyll Goliat]

I recommend everyone dumping Intel if that is the case! I mean so what Intel has been doing knowingly is sell consumers defective chips that do not work accordingly to the spec's? That is if able to be prove maybe false advertising misleading the consumer? This is NOT good for Intel!

Well Intel is just more vulnerable then AMD but basically almost all todays CPU´s are affected.....either way it´s not bad for"them"when you really think about it,listen this happened now when we reach the peak of the Ghz speed maybe they believe that it´s time now to slow down this "older"CPU architecture a bit and then they can produce and sell the new CPU architecture that are not affected with this malfunction at all......thats just my"conspiratorial"2 cents.....

 

[Bill_Bright]

So why not dedicate resources up front to tackle them all and mass distribute?

Because for legacy (no longer in production) boards, they get $0.00 returns on those investments. It is not just about developing the updated code. It has to be thoroughly tested with most if not all supported CPUs for that chipset/BIOS. I suspect many of those are boards and CPUs (and compatible RAM) they no longer have laying around.

You say a "few dozen", it is a lot more than that. I note Gigabyte alone has boards with 24 different CPU sockets! And some of those sockets support more than a dozen different chipsets. And many of those chipsets are used with many boards (dozens and dozens!) they have produced.

I mean it looks like Gigabyte currently shows 134 boards for the 1155 socket alone! That's more than a few dozen already. The 1150 has almost as many and the 1150 has 143! And the 775 socket has 195! That's 600 boards just for those 4 sockets.

So its a big undertaking that really cuts directly into their bottom line with zero chance of recouping even a penny for those efforts.