X86-64 Intel Security Issue

From Daily Fail.

http://www.dailymail.co.uk/sciencetech/article-52320...

Anyone know anything about it?

It's a cache coherency problem, I think. It's been known about for ages. Applications can access data from other processes in the processor's cache. You don't even need elevated privileges to do it. I can't remember if you need to be running on the same core as the previous process. I've no idea what the workaround is, but I'm guessing that Windows will have to clear the cache before it switches processes. This will also flush data that is not stale from the cache. Linux will also have to do it. The statement that Intel have just released the information is laughable. Basically, allocate a block of memory but don't initialise it. Then read it and see what you get. Simples. "Look inside", as Intel says. Maybe the kernel will have to clear all allocated memory. That would explain the 30% overhead.

Edited by micksharpe (Wed 03-Jan-18 19:25:58)

The Mail article links to another in El Reg which gives more information.

I don't think it's the same bug that you're referring to.


edit- plenty more references available with a quick google.

Edited by billford (Wed 03-Jan-18 19:28:46)

Thanks

Looks like my old t5870 core2duo will need to be retired if speed reduction is 50%.

In reply to a post by flippery:

Thanks

Looks like my old t5870 core2duo will need to be retired if speed reduction is 50%.

The Microsoft insiders have been testing this patch for over 3 months and nobody has reported any speed reductions

In reply to a post by flippery:

Looks like my old t5870 core2duo will need to be retired if speed reduction is 50%.

That 50% may be the usual Mail hysterics... figures in El Reg suggest more like 15-25%, and there's a comment that for a lot of uses (document processing, browsing etc) you might be pushed to see any difference. Even a slow processor is faster than you are

I might be able to support that... the El Reg article update says that macOS has had the update since 10.13.2, which is what I'm running. It does seem a bit slower for some things (eg shifting images around the display, but that could be the new video system on old hardware) but no difference for "ordinary" use. I haven't tried anything that really hammers the system (like video encoding etc) since the update.

Edited by billford (Wed 03-Jan-18 20:12:09)

More... Intel say "It's not only us".

But AMD beg to differ

50% is coming from other sources - though may be AMD related which doesn't need the fix and possibly Linux related - thread on Reddit discussing it

There are literally vulnerabilities discovered all of the time.
Most devices you use are not bang up-to date on patching and therefore vulnerable.

News articles such as this one make it seem like a rare thing.

In reply to a post by Kenneth:

- thread on Reddit discussing it

Ta for that- an interesting read.

Seems like the 50% is an extreme case which, in effect, does little but highlight the slowdown by making continuous syscalls, whereas programs that also do something useful will suffer a lot less. Except maybe cloud VMs.

But it's sure not going to do Intel any good... patching an OS is one thing, how long does it take to get a new chip design into circulation, I wonder?