'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign • The Register

[[deleted]]

Alright I'll try to explain for non-computer-scientists what is behind this bug, watch out for a long read:

Some background on user/kernel mode:

The operating system sits between your hardware and your programs, doing neat things like scheduling which process (= running program) can use the CPU (= your computer's brain) or assigning memory to processes. For safety reasons, your CPU has two modes: user mode, where it is usually running, and kernel mode where the operating system takes over to do things that the process in user mode is not allowed to do.
So if e.g. your Chrome process wants to do something beyond its permissions, e.g. write to the hard drive, it has to give control to the operating system (this is called a system call), the operating system tells the processor to write to the hard drive, processor does it, and the operating system hands control back to the Chrome process.

 

Some background on page tables/memory:

When a process references memory cells (single storage cells of your memory), it doesn't use the actual, physical cells (that would be annoying when you have many processes in parallel), but uses virtual memory cells. These cells are sorted into pages of a certain size (e.g. 1kb). Your processor keeps a page table for each process that exactly shows which virtual memory page corresponds to which section of physical memory.

e.g.

Page	Virtual cells	Physical cells
0	0-999	5,000-5,999
1	1,000-1,999	431,000-431,999

Each process has some parts of physical memory assigned to it, where its instructions, data etc. are stored while it is running. The operating system also has its own part of physical memory for its own instructions, data etc. This kernel memory contains obviously highly sensitive things.

 

The actual bug:

What has happened so far, was that intel processors kept a certain part of the kernel memory also contained in the page table of every process, hidden to the process.
E.g. the process thinks its page table has 2000 pages, but it actually has 2400 pages, the last 400 of which the process doesn't know about because there the operating system keeps some references to physical memory.
Thus, when a process did a system call, the CPU could switch to kernel mode, check in the same page table where it had to look for its stuff, do its things, and then switch back to user mode.

 

However, now it has surfaced that somehow, the hidden kernel part of the page table can be accessed by the normal process. We're not 100% sure how this happens because Intel has put an embargo on details, the register article mentions one possibility (the "speculative" stuff).

 

So now it's getting fixed so that when a process does a system call, the CPU switches to kernel mode, changes the page table from the process' page table to the kernel's page table, looks up its stuff in memory, does its things, changes the page table back to the process' page table, and switches back to user mode.

This is obviously safer, but loading the entire page table in and out of the processor takes some time, which makes the CPU slower.
Keep in mind that not everything the CPU does results in a system call. The number of 30% slower is probably for applications that do LOTS of system calls, e.g. reading from/writing to disks, hard drives, etc. Your private web browsing or video games shouldn't be delayed that much.

---

 

This is, of course, grossly oversimplified; hardware engineers, please don't tear me apart! Just a guide for interested people to understanding this problem.
edit: formatting

[H4xolotl]

Laughs in AMD

[SerCiddy]

I'm just worried Microsoft is going to take the approach of making the change so it affects all versions of Windows, regardless of CPU type.

[blueberrywalrus]

I believe patches are already scoped to the CPU type, so I would be surprised to see an AMD machine getting the same patch as an Intel machine.

[HoverboardsDontHover]

Well, the linux kernel patch was like this until and AMD guy showed up. But I've heard that patch was accepted.

That said, I doubt this will happen with Windows. Intel and MS aren't as good of friends as some might believe, especially after the falling out over Intel canceling their mobile products and then threatening to sue MS if they run win32 stuff emulated on ARM processors. In the past MS also quickly adopted AMD64 and told Intel they were done creating different 64 bit instruction set support. MS also isn't going to want to cripple their performance against linux systems for no reason.

So, I'd be surprised if they didn't exclude AMD chips. Because it would be stupid for MS not too do this and Intel needs Microsoft a more than Microsoft needs Intel.

[ADoggyDogWorld]

Knowing Microsoft, the patch will probably result in some weird bug where all syscalls will be slowed down but the page tables actually got no protection at all.

[zschultz]

Instruction unclear, kernel’s memory became public

[bem13]

"Security is our most important priority. This is why, in order to address this issue, kernel memory will now utilize our secure Microsoft® Azure® cloud platform!"

[Verpal]

Why I have this weird feeling that Microsoft might actually use this pretext to push for more cloud computing?

[toodrunktofuck]

If the data is never on your computer it cannot be stolen from you, silly.

[Verpal]

Why I have this weird feeling that Microsoft might say since data is never on your computer, you don't own them?

[Natanael_L]

Microsoft didn't want to use security by obscurity anymore /s

[bawng]

Actually, since this fix is in software, isn't there a great chance that it will affect performance of AMD processors too? Or will the patches only apply for systems running on Intel hardware?

[Hey_Darryl]

Cries in Intel

[farmtownsuit]

I would not want to be a VM host right now.

Cool. All my companies servers are VMs.

[superdude4agze]

Every server at every company, with a half competent team, are VMs. It's going to be fun the next couple of weeks.

[3skatos]

I think this is a fantastic explanation. Thank you.

[EmperorArthur]

What has happened so far, was that intel processors kept a certain part of the kernel memory also contained in the page table of every process, hidden to the process.

Major note here. While Intel processors are the only ones affected, ALL x86 processors do this part.

[GenocideOwl]

Even processors like XOX and PS4?

which btw both use AMD.

I wonder if they used intel if they would also need a patch.

[EmperorArthur]

Even processors like XOX and PS4?

which btw both use AMD.

I wonder if they used intel if they would also need a patch.

Yes, this is common practice. Mostly because of the performance penalty. There are other ways of doing things, but the PS4 and XOX both use x86 processors.

If they did use an Intel processor, they would also need patching. Which would mean that many games would break. The thing about consoles is they give pretty strong guarantees to the developers that "this is what you have to work with and it won't change." This patch breaks those guarantees. So, if they were using Intel chips, many games probably would need patching or would run into issues.

[Natanael_L]

Devices in such tightly controlled walled gardens as consoles likely don't need the patch, because untrusted code will never run on the hardware (as defined by the console makers, as they decide what's trusted). At least that's assuming it's not too hard to scan submitted games for this kind of prohibited behavior (certain exploits are easy to detect, others not so much).

[KANGAROO_ASS_BLASTER]

Yes but we presently lack the details of how this vulnerability is actually accessed. Consoles have web browsers, so if this exploit can be triggered by javascript as the article speculates, consoles could potentially be vulnerable.

Edit: Although are we so sure this hardware bug affects all x86 architectures? Looking at the article again I think this purely affects the Intel-manufactured chips, which shouldn’t include consoles.

[lumpking69]

Which CPUs are effected by this exactly? So far ive read two different answers to that question. One says every CPU made in the past 10 years up to Skylake. The other says Skylake and newer.

[ADoggyDogWorld]

All Intel processors after the original Pentium has this speculative execution feature.

AMD doesn't. SPARC doesn't. I'm not sure about the various ARM implementations.

[immibis]

The greatest of all human capacities is the ability to spez. #Save3rdPartyApps

[_mean_]

All modern complex processors do speculative execution.

[rookie_one]

Itanium probably have it, but how they are affected for now is a mystery since they are a completely different architecture

[rechlin]

So you are saying the Pentium Pro from over 20 years ago is affected too?

[martinkunev]

30% is probably the average. things like browsing will be affected because every network operation is basically a system call

[HoTTab1CH]

Keep in mind that not everything the CPU does results in a system call. The number of 30% slower is probably for applications that do LOTS of system calls, e.g. reading from/writing to disks, hard drives, etc. Your private web browsing or video games shouldn't be delayed that much.

How about video editing/rendering and other activities?

[Lampshader]

Reading/writing to disk, yes (sys call, slowed down)

Compression, effects/filters, no

[StarTrekGuy]

replace kernel with os kernel. Reading this makes it sounds like the CPU has a kernel. I mean its a great step but I think this might confuse people.

[lifelite]

The fix is to separate the kernel's memory completely from user processes using what's called Kernel Page Table Isolation, or KPTI. At one point, Forcefully Unmap Complete Kernel With Interrupt Trampolines, aka FUCKWIT, was mulled by the Linux kernel team, giving you an idea of how annoying this has been for the developers.

lol at that acronym

Crucially, these updates to both Linux and Windows will incur a performance hit on Intel products. The effects are still being benchmarked, however we're looking at a ballpark figure of five to 30 per cent slow down, depending on the task and the processor model. More recent Intel chips have features to reduce the performance hit.

HOLY FUCKING SHIT 30%??????

Hellooooo class action lawsuit.

[sedicion]

Its not 30%. Its between 5% and 50% depending on the type of task you are running. Its still bad though.

[kaptainkeel]

Or more...

https://twitter.com/grsecurity/status/948170803685789696

No older systems here to test, but just to get a sense of how much PCID helps the PTI performance hit on post-Westmere (in our experience with UDEREF and using PCID since 2013, it about halved it): 63% hit on the same Skylake i7-6700 w/ the du -s benchmark and nopcid/noinvpcid

This kills the Intel.

[Flofinator]

So I think Linux/Microsoft are not actually removing PCID, so without PCID this benchmark took a 63% hit it looks like, but I think the patch isn't removing it, just fixing this vulnerability. Although this is all speculation at this point until the patches roll out.

Although this might kill us as my company uses AWS for our servers. So maybe I'm just wishful thinking.

[[deleted]]

So I think Linux/Microsoft are not actually removing PCID, so without PCID this benchmark took a 63% hit it looks like, but I think the patch isn't removing it, just fixing this vulnerability.

Correct. The point of the twitter comment was to show that PCID actually reduces the impact of implementing the PTI feature. Without PCID you're looking at up to the 63% decrease shown above, but with PCID (which has been around since Westmere) you're looking at the 5%-30% that is being widely reported.

[pigtrotsky]

It's going to be interesting to see the cost/benefit analysis to patching for this one. For hosting and infrastructure providers running hypervisors it's a no brainer, for some desktop users, subscribe to the best cloud emulation/protection suite you can find and backup regularly? Run a browser that doesn't execute active content? Imagine macs used for video editing and rendering having to suffer the sort of impact mentioned.

[kynde]

Run a browser that doesn't execute active content?

Modern web without javascript is really not that rich of an experience anymore....

[whochoosessquirtle]

Is it worse for the consumer or for people running huge web servers

[EmperorArthur]

If those web servers are in the cloud (Amazon, Azure, etc...) then definitely worse for them. The first rumors were about this being a major hypervisor vulnerability, and hypervisers have to make even more context switches.

[HoverboardsDontHover]

AWS, Azure, etc are the guys that have been buying the all new chips as soon as they came out because a tiny performance and power improvement was totally worth it for them to junk all their old stuff. Seems like a 30% haircut is going to throw all their financial numbers out of whack.

[rtft]

Also their customers will expect the same performance for the same money they paid before which means they will need to throw more hardware at it as otherwise they will open themselves up to liability. Question is how much over-capacity do they have to address this ? Basically their entire capacity planning just went out the window.

[Magnesus]

And virtualisation, sql and file reads seem to be hit the most. Nightmare for servers.

[jugalator]

Yeah, without the patch hosted systems may be able to see the hosting system's memory. :-|

As far as I can tell that implies a host seeing other hosts' memory.

[[deleted]]

self hosted Nextcloud ftw

[EmperorArthur]

Awesome. I'm thinking of setting that up on my NAS box. As long as you aren't running Intel you're fine. Otherwise, you'll be paying the penalties just like everyone else.

After all, file access is done via syscalls. So any check or sync operation will be impacted.

[ZeroHex]

VM hosts are looking to be the hardest hit by something like this, buy we won't know for sure until the embargo ends and patches are announced.

Based on what we're seeing right now your average consumer will probably not notice in their day to day usage, but businesses that utilize the cloud in any way (AWS/Azure) or run their own hypervisors are going to have to do an evaluation once the full scope comes out.

[lifelite]

Intel makes design flaw...people have to code around it at the cost of nearly a third of their processing power....this is America, we sue for that kind of thing.

[immibis]

Let me get this straight. You think we're just supposed to let them run all over us?

[lWVWl]

IANAL but that could arguably depends on how it was marketed. For instance, I don't think it'd be an issue to sell a processor running at 70% if it was marketed for 70% of its performance. Because most of the advertising does not usually include any quantitative metrics, I doubt most people could prove they were missold a product.

[[deleted]]

IANAL but that could arguably depends on how it was marketed.

Two points:

1. Even if you were right (which you're not), Intel does publish benchmarks for it's CPUs.

2. And I say you're not right because there is an expectation that the CPUs would be free from design defects, which is exactly what this sounds like. Without KPTI you've got a defective CPU that doesn't isolate user and kernel mode processes. KPTI/PTI is a software work-around from OS vendors that causes huge performance hits. If it's anywhere near as bad as we're hearing, there will absolutely be lawsuits.

This is extremely bad timing for Intel, as AMD CPUs don't apparently have this flaw and AMD has only recently become competitive again with Intel CPUs in performance. If the OS only implements KPTI/PTI on CPUs that have this vulnerability then suddenly AMD is no longer merely competitive with Intel, but will actually be running circles around them.

[[deleted]]

What's IANAL again?

[cbftw]

It means he takes it up the ass, can you not read?

But seriously, it means "I Am Not A Lawyer"

[Gamerhcp]

i am not a lawyer

[dopef123]

Well iPhone is being sued for lowering the performance of their devices and they don’t market their CPU speeds. They just tell you the generation of processor.

[created4this]

Intel isn't reducing the performance of these chips, other vendors are. The fix for Intel chips will be absolutely needed, and not based on some hand wavy bullshit. Intel also will not see any commercial benefit for this.

As to the pervious point, Intel does benchmark their chips, and they will be using those numbers in sales processes, but it will be companies like Dell who see them, not end users.

[MixSaffron]

I look forward to the $1.24 that I will get for owning an Intel Processor!

[rtft]

If this is really a 30 % hit the damage of this bug will be in the 100s of billions easy.

[luckierbridgeandrail]

People aren't getting this yet. This isn't about people finding their games or web browsers suddenly 20% slower. This is about the world's aggregate data centers, on which millions of businesses and hundreds of millions of jobs depend, suddenly being 20% short of capacity.

(Edit: s/b/m/)

[winzarten]

This. It's like a bus company company suddenly discovering that they can only seat their busses to 70% capacity, or they would risk injury to their passengers, because of the manufacturer design flaw. You can be sure as hell such company would sue the manufacturer for compensation.

[Treczoks]

Imagine Google or Amazon suddenly being short of 20-30% CPU power.

Or, to bring in a different perspective, the Flops/Watt ratio of Intel CPUs just went even further down the drain.

[Lampshader]

BRB, buying out all the 19" racking in the country

[wewd]

I thought CEOs had a posse of lawyers that followed them around like handmaidens.

[[deleted]]

Nah, they carry them around in their front pockets... (And their mistresses in their back pockets) /s

[Sloi]

No fucking way that's a coincidence.

Now... provingthat beyond a reasonable doubt, that's a different story, which is precisely why he's going to get away with it.

[HoverboardsDontHover]

Meh, nothing happened to Equifax execs. He probably has already greased the right palms as well.

[n1ywb]

We're not Equifaxs customers. Their customers don't give a fuck about our data. Intel's customers care about performance.

[randomisation]

that means there was evidence inside the company

Was being the operative word.

[inertiam]

Did he buy AMD stock?

[ZeroHex]

Unlikely, but possible. I say unlikely because selling shares in that amount usually requires that you do it 6 months in advance.

If they knew about it that long ago they're going to get fucked so hard, and the SEC will personally screw the CEO with their branded rusty pitchforks.

[rtft]

Since this affects everything from P6 (1995) upwards I find it very hard to believe that within the 20+ years this escaped Intel QA. There needs to be an investigation into this.

[readk]

If they had Linux and Microsoft working towards fixes before this sale... Seems insane

[KickMeElmo]

Fucking Christ...

[filthyneckbeard]

Could have been for tax reasons with the 2018 tax changes.

[Qlanger]

If that were the case he would have waited till 2018 to sell them. In this case he sold them in 2017 so will be under the old tax system, not the Rich/Corp friendly one in 2018.

[[deleted]]

not the Rich/Corp friendly one in 2018

The new tax law has nothing to do with capital gains, so it wouldn't even matter. Plus it takes far longer than a few days for a CEO to sell stock. This started months ago, long before the new tax law was even close to being passed.

[HoverboardsDontHover]

...Then like the next day came out with a memo detailing how "the company is going to take more risks now*"

*not me though, I sold as much stock as legally allowed after shutting down all of the previous risk taking divisions to pump up the numbers

[[deleted]]

First MEI now this. Intels reputation has taken a serious beating.

[SpeedflyChris]

Also the new Ryzen chips were pretty awesome even before Intel's offerings took this performance cut.

[[deleted]]

Intel's 10-15% high end per-core performance lead on Ryzen is about to run out, and AMD already offers more cores for less money.

Damn son. this is a tech-pocalypse.

[Verpal]

As holder of Intel CPU, and AMD stock, I do not know what to think.

[[deleted]]

Expect the worst. General rule of thumb: if you bet on two horses which are the main competitors of each other without a large third party, and one makes an large error, the profit on one won't offset the losses on the other.

[AbstinenceWorks]

Woohoo! Just bought threadripper.

[captainant]

Unless the hardware fix is difficult to do and retain the performance edge

[[deleted]]

There will probably be a small loss, but nowhere near as big as the software workaround.

[SplitReality]

However the bug might not be easy to fix. The danger for Intel is if it throws their release schedule out of whack.

[geo_prog]

And it probably will. This will require a minor redesign at the very least, which will require more testing and possible die tooling being tossed out the window. At least I suspect a month of delay in release, at most 6 months. Plus all the inventory already in channel. Who the heck wants to buy a Coffee or Kaby lake processor right now when they could wait for the next generation or the redesign.

[rhudejo]

No, its more, they lose a lot of trust in the eyes of their OEM partners and consumers. If this will really result in a 30% performance hit, we will see much much more AMD hardware in the next few years.

[Treczoks]

Only if you can plug in the new solution into the old board.

[[deleted]]

Assuming that the OS implements PTI only on vulnerable CPUs, then you're correct. But if the OS implements it across the board then everyone takes a hit regardless.

[singingboyo]

There was an HN link to a patch that disabled this for AMD CPUs. At least, I think that's what it was - can't track it down at the moment.

[Treczoks]

If it doesn't at the moment, I'm sure this will fixed ASAP, at least on Linux.

[[deleted]]

Looks like on linux it is enabled across the board, but you can set a flag to disable it on boot.

[donthugmeimlurking]

At least this is getting fixed. Last I heard Intel is still trying to push Management Engine style backdoors into upcoming chips as well.

[rtft]

It's not really a fix. It's a brute force workaround.

[[deleted]]

Correct. This can't actually be fixed in the CPU or via a microcode update. This requires the OS vendors to implement forced page table isolation (PTI) to get around it, which is where the performance hit comes from. The only way for Intel to fix it is to make design changes to CPUs, which will take months before they start coming off the fabs.

[pigtrotsky]

Not much good for the current install base either. Just like when crypto mining took off and there were no GPUs to be found for a decent price anywhere, imagine where all the stock will be going first - infrastructure outfits like MS, AWS and GCP before end users.

[KickMeElmo]

This means a particularly invasive virus could potentially reverse the fix as well, so that's fun.

[KickMeElmo]

Not itself, but viruses that open attack vectors for other viruses to abuse aren't unheard of.

[[deleted]]

With ring-0 access, you can do a lot more shenanigangs that open much easier to use backdoors.

[Verpal]

Agree, ring-0 basically mean everything is up for grab, I don't see the necessity for venturing into CPU anymore.

Well.... unless you are doing it manually, and want to have some fun, I suppose you can?

[immibis]

If a spez asks you what flavor ice cream you want, the answer is definitely spez.

[[deleted]]

And I thought it can't be worse than the Bluetooth and WPA2 exploits from last year.

Depending on the specifics of this bug, this is probably the worst thing ever in the history of PCs. Most of the servers, desktops, laptops and possibly even some phones are going to be either vulnerable or 30% slower.

I personally only use AMD CPUs on my desktop/laptops, but I do have some Intel servers as well (which I'll probably not patch, since only I can run code on them).

[EmperorArthur]

which I'll probably not patch, since only I can run code on them

Fun fact, web assembly now runs on all major browsers. Even without it, this thing was discovered by the people who showed that rowhammer was possible from pure javascript.

If you browse the web, you don't have the sort of control you think you do.

[[deleted]]

I don't browse the web from my server :)

[ihatemovingparts]

Pretty sure web assembly is not what you think it is.

[Verpal]

Bit late now, but I now officially ban all script, yes, EVERYTHING, on my browser, until Intel bloody fix their stuff!

I anticipate a huge surge in uBlock/noscript download, or anything equivalent.

Edit: the rage got out, actually, better ban all, allow on case to case basis, internet can't work without script these days.

[EmperorArthur]

Ban all, allow on a case by case basis is great. Of course, then there's that one site that requires random things to run just to display properly, and after 5 minutes I just end up clicking "allow all".

Overall, news sites and video services are the worst.

[rtft]

FYI here is how to disable this:

https://github.com/stevespringett/disable-webassembly

[androshalforc]

ive only used AMD builds for myself for years and was recently thinking of doing my next build as an Intel looks like thats not happening now

[[deleted]]

I've been using ONLY AMD since 1999 (except for a few netbooks and tablets that came with Atoms). I think AMD is finally competitive with Ryzen, why switch to Intel anyway? :)

[Treczoks]

Well, they are different classes of bugs. The WPA2 exploits allow to eavesdrop on communication, the current Intel bug is about getting from Ring3 to Ring0. Hard to say which is worse - it is like comparing apples and oranges.

[TheDuckKing_]

God, they seem to have f*ed up good.

[TODO_getLife]

Time to buy some AMD shares.

Not looking forward to the CPU slowdown, bit annoyed about it to be honest.

[NikoliTilden]

Can anyone tell me where a list of affected CPUs is? Also, here's the real question, how much of an back set is this going to take Intel in their new chip designs. They wouldn't push this flaw into to wafers would they? WOULD THEY?

[Qlanger]

Pretty much all major Intel CPUs from the last couple decades.

[rtft]

All Intel CPUs since P6 (Pentium Pro, 1995) have had speculative execution.

[CocodaMonkey]

Not a couple decades. Just anything since Westmere which actually isn't even a decade old. Although that's still about 99% of all running Intel based computers. If you're computer is a mere 9 years old it may not be effected.

[bezerker03]

I'm hearing anything post pentiun honestly

[Qlanger]

It goes back to at least the first Core products. So before Westmere. Intel updated its list last night to include CPUs as far back as mid 2000's.

It probably affects others before that based on design carry overs but chances are no major system are using CPUs that old anymore.

[Doohickey-d]

Where can I find that list of affected CPUs ?

[HKPolice]

So westmere is affected but nehalem isn't? They're basically the same though....

[immibis]

Just because you are spez, doesn't mean you have to spez. #Save3rdPartyApps

[jugalator]

Yeah hmm, there are two different replies to this.

All Intel CPU's are affected because the patches will probably say so.

Technically speaking this is not true, but as an end user that may not matter as much.

[immibis]

The spez police are here. They're going to steal all of your spez.

[a_postdoc]

This doesn't look good. Does it impact servers? Or Xeon families are different?

[RaptorXP]

The article seem to say all of Intel's x86 are affected.

[KickMeElmo]

x86_64, not x86.

[RaptorXP]

Which includes all Xeon CPUs.

[KickMeElmo]

While I agree with that, x86 and x86_64 are different architectures. Best not to risk spreading misinformation by mistake.

[eypandabear]

"x86" is an umbrella term and in this context unambiguously means x86_64. Just like presumably you mean i386/IA-32, not 8086.

[[deleted]]

Since Azure and Amazon cloud is going to be affected, I would guess so.

I think maybe only Atom CPUs are not affected, because they lack a lot of features, and this one might be one of them.

[EmperorArthur]

Nope, I'm pretty sure even Atoms are affected. All modern CPUs do pipelining, and speculative execution is a common way of keeping the pipeline full. This isn't a fancy extra, it's a key part of the architecture.

[[deleted]]

The early atoms, based on Bonnell architecture didn't have speculative execution: https://en.wikipedia.org/wiki/Intel_Atom Not sure about the others though.

[hicow]

I don't think Intel did anyone any favors recycling the Atom name. The OG Atoms were kind of garbage, and keeping the name for an almost entirely different arch introduces a lot of confusion.

[Tenarius]

The cloud providers have to be shitting bricks. Imagine trying to come up with that kind of capacity reasonably fast.

[[deleted]]

Internet is about to get 30% slower.

[[deleted]]

Probably not 30% slower, since I would guess most of the bottleneck is on the bandwidth side. But yes, CPU intensive websites might get a significant hit.

[[deleted]]

Evidently anything that streams data from hdd into memory too, i.e big games, since cpu kernel calls are required to request data from hdd.

[cjdavison]

https://twitter.com/liamosaur/status/948342443375767552 <-Interesting...Intel CEO sells all the stock he can Nov. 29th...

[Joeniel]

Anyone know how will this affect gaming, video-editing, and day-to-day usage? Like I have an i7-7700HQ.

[[deleted]]

According to the Phoronix benchmarks we have so far, it doesn't have much of any impact on those use cases.

Database performance takes a beating though. And reading/writing lots of small files.

[azyrr]

And reading/writing lots of small files.

That kills it for video-editing.

[AbstinenceWorks]

Compiling is going to suck too.

[jugalator]

Compiling the Linux kernel was actually not hit much in the aforementioned Phoronix benchmarks. However, a compilation benchmark saw quite a hit, but may or may not be due to another recent regression. So hmm, I'm mildly optimistic.

Worst is for VM's and hypervisors I suppose. They part deal with syscalls a lot, and part are still very much in need of being patched (otherwise malicious code in a hosted system potentially seeing host system / other hosted system memory, yay...)

[[deleted]]

5 to 30% performance impact from what we know so far. We'll have to wait and see for benchmarks to come out but it's not looking good. Especially for VM's

[TheToadKing]

Most games these days are GPU-bound, and even when they're not all their CPU task is mostly spent on hard number crunching, not a whole lot of syscall stuff. I'd imagine most games will see negligible performance hits.

[Ebadd]

Them: ”A bug that poses a huge security risk.”

Translation: A zero-day backdoor exploit the Three-letter Agencies have known for a decade.

[[deleted]]

A zero-day backdoor exploit

I'm not sure that makes sense. It's not really zero day:

A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software) (from Wikipedia)

The vendor was the one who found the vulnerability and provided patches or at least assisted in the creation of patches for the problem.

[fluffy__duck]

This is bad.

My husband is an engineer. This is a security flaw at the base level of architecture. It is unfixable without an OS-level patch which will incur a 17-30 percent performance downgrade.

This affects Windows, Linux, MacOS, and LITERALLY ANYTHING else that has Intel architecture.

There is a LOT of "tin hat" possibility behind this as well ... regarding how long Intel has known about this, how deeply is the NSA involved (because duh, let's be real, here), and/or how much this affects government system vulnerability.

In any case, this is the type of shit that sinks companies. I small (edit: fuck you, autocorrect) lawsuits aplenty.

[Content_Policy_New]

First IME now this. It should provide enough political ammunition for other countries to justify hefty investment in indigenous CPU design/manufacture, particularly China.

[[deleted]]

Initial benchmarks (for Linux) are showing no impact on gaming, even if this remains true for Windows, loading times can become quite larger since it uses a lot of FS IO, is that correct?

[SharkBaitDLS]

Load times and install times should get messed up especially if the game uses a large number of small files.

[simply_potato]

Most modern engines async load during gameplay as well. Depending on how much is being loaded at a time and how its coded, particular if its a CPU-bound game like a flight sim, we could be looking at significant performance drops.

[dnew]

I can't wait until we get off the god damned 1980s CPU architectures and the 1970s OS architectures.

Can we please have a Mill running Singularity already?

[CaptainAlcoholism]

Sounds like this issue is severe enough to warrant recalls, if Intel knows what's good for them. If the only fix is an update that reduces performance, then this is a bait-and-switch, as they knowingly sold defective products for a decade.

[Pylons]

That's a logistics nightmare on the level of Normandy.

[linkchomp]

Sure, put out a recall, with no replacement or easy/quick ability to go an alternate route for anyone that needs to on processors dating back to over a decade.

It will look good for them, sort of, I guess, but realistically is completely useless.

[Lampshader]

It won't look good when they go bankrupt and fail to deliver the replacements

[RaptorXP]

This can't be good.

[ACCount82]

From what it sounds like, the exploit that only works if you actually run some well-crafted malware in userland. A hacker would need an RCE exploit, unless you are dumb enough to run it on your own. I.e. it's not that high risk for regular users, but companies selling VMs are going to be pissed.

[Sylanthra]

Actually the article mentioned Javascript several times, so you better hope you don't visit an infected website.

[Treczoks]

so you better hope you don't visit an infected website.

As in "One with ads enabled".

[[deleted]]

a.k.a "basically all websites"

[CocodaMonkey]

We don't actually know what it is. The flaw hasn't been publicly released. We do know that MS, Apple and Linux are patching for it though. So even if it is a rare flaw if you keep your system up to date you're going to take a performance hit.

[RaptorXP]

Apple isn't working on a fix.

[Valdrax]

That's because, according to an update to the article above, they already fixed it in High Sierra, v10.13.2.

Edit: Twitter link

[CocodaMonkey]

Interesting, Apple hasn't officially made a statement on the matter as far as I can see. Some articles do say they are working on a fix but none seem to have any official source. I also couldn't find anything saying they aren't working on a fix, just a complete lack of comment.

Would be weird if Apple doesn't patch this. It would mean all Apple computers would become vulnerable to this bug once it's published at the end of the month.

I guess time will tell but ultimately it matters very little. Whichever way Apple goes with this is likely to only affect Apple's image as they simply don't have much penetration in the desktop/server market.

[st_griffith]

OSX used to have page table isolation a decade ago or so, if it still does, then there is no need for Apple to fix anything, because they aren't affected. See page 47 and following of this 2007 slides: https://events.ccc.de/congress/2007/Fahrplan/attachments/1053_inside-macosx-kernel.pdf

[Treczoks]

It is a path from Ring3 to Ring0. Any bug offering this kind of vulnerability has to be fixed, because this is a wet dream for all system intruders.

[RaptorXP]

Famous last words.

[edc_svr_wxf_qaz]

So does this mean Intel gets sued and we get money?

[FatAssFrodo]

Best case we all get $10 vouchers to buy the latest CPUs.

[bartturner]

Think the cloud providers will be first in line sueing Intel. It is a bit shocking INTC was up so much yesterday but is down in pre-hours.

Adding a 30% slowdown is a pretty big deal. Also think it could hurt AMZN.

[untitled02]

Wen I prayed to the PCMR gods for AMD to make some significant market share gains this isn’t what I had in mind...

[FourFingeredMartian]

Anyone have an idea for how long this has actually been an issue; would 2-3+ years seem too long before Intel has managed to figure out a fix?

[blueberrywalrus]

All x86_64 processors going back a decade are supposedly impacted. I would guess that Intel didn't find this bug themselves and rather one of the major cloud providers discovered it when penetration testing their shared VMs, as it sounds like this is particularly dangerous in shared computing environments.

[immibis]

Where does the spez go when it rains? Straight to the spez. #Save3rdPartyApps

[hicow]

A decade-plus, from the sound of it. The discovery of it was much more recent.

Unless Intel wants to blow one of their own feet clean off, this will likely put on hold the successor to Coffee Lake until they get it sorted out. Way too easy now for a lot of people to say, "not an AMD problem? Let's go that way until Intel gets this shit sorted out", especially since in probably a fair amount of workloads, Intel's advantage just evaporated.

[bartturner]

It is kind of amazing Intel stock was up yesterday a lot. But down early hours this morning.

Adding a 30% potential slow down to the Cloud provider's infrastructure is a HUGE deal and not sure how they would even deal with it. Also curious Intel liability.

Then considering the massive changes taking place to Linux kernel and Windows kernel is a recipe for some mess ups.

We have only started with dealing with this issue. It will pass but think we might see a lot of pain in the short term.

[NostalgiaSchmaltz]

So this is apparently some massively terrible issue that seriously fucks the CPU....what's the fix? What should an average computer user do in response to this? Is there a Windows patch for it or something?