There is a serious security flaw in billions of Intel CPUs that can let attackers steal confidential data like passwords and encryption keys. Firmware updates can fix it, but at a potential significant performance loss.

Oh no.

    • DarkThoughts
      3•2 years ago

      I got a 10400F because AMD completely abandoned the budget segment at that time.

    • @[email protected]English
      24•2 years ago

      No luck, it’s a systemic issue (practice):

      Update: Intel’s Downfall was closely followed by AMD’s Inception, a newfound security hole affecting all Ryzen and Epyc processors. The first independent testing of the mitigation microcode patches show that it can drastically lower performance in certain workloads. We’ve included details throughout this post.

      • r00ty
        6•2 years ago

        Is that the same as zenbleed or in addition? How easy zenbleed was to test and the kind of information gained was terrifying.

        • @[email protected]English
          5•2 years ago

          yea, it’s another one https://www.xda-developers.com/amd-inception/ :/

          Inception differs from other transient execution attacks by inserting new predictions into the branch predictor during the transient window, creating more powerful transient windows that can be used to overflow the Return Stack Buffer and gain control of the CPU. Mitigating the impact of this attack is apparently challenging.

          In the wake of Zenbleed, researchers from ETH Zurich have designed a new class of transient execution attacks, dubbed Training in Transient Execution (TTE). Using TTE, the researchers built an end-to-end exploit called Inception. It can leak kernel memory at a rate of up to 39 bytes per second on AMD Zen 4, and the researchers were able to leak /etc/shadow on a Linux machine in 40 minutes. This file contains hashed user account passwords and is safeguarded by the system, only accessible by the root user. In other words, this exploit is really bad.

          • r00ty
            3•2 years ago

            Damn. I just recently patched up my dedicated box for zenbleed. This seems far worse.

            I mean I’m not going to be a high value target. But still, this isn’t looking good for either chip maker right now.

            • @[email protected]English
              5•2 years ago

              My understanding is the newest AMD bug is probably not too much of an issue because it’s very limited in how much data it can leak at a time and there’s no way to target it at specific data so if you wanted to use it to do something like grab a password it’s extremely unwieldy and not really practical.

  • @[email protected]English
    74•2 years ago

    It took them a year for a microcode fix and it still has a performance loss of 50% in some cases? Ew

  • @[email protected]English
    2•2 years ago

    Seems very similar to Zenbleed in terms of using certain register optimisation and speculative execution to get crippling security exploits. Thus far I haven’t read too much into the detail of the attack but This article on Zenbleed, written by the attack’s author, describes how the attack in detail and how he came to find it using fuzzing techniques - in this case two sets of instructions that should have had the same result, but they didn’t.

    The write-up for this one is presumably this one.

  • @[email protected]English
    206•2 years ago

    Intel claims most consumer software shouldn’t see much impact, outside of image and video editing workloads…

    But that’s, like the one place other than games where consumers are looking for performance. What’s left, web browsing and MS Office?

    • FaceDeer
      71•2 years ago

      I just skimmed through the article and it seems like this vulnerability is only really meaningful on multi-user systems. It allows one user to access memory dedicated to other users, letting them read stuff they shouldn’t. I would expect that most consumer gaming computers are single-user machines, or only have user accounts for trusted family members and whatnot, so if this mitigation causes too much of a performance hit I expect it won’t be a big risk to turn it off for those particular computers.

      • ArghblargEnglish
        21•2 years ago

        this vulnerability is only really meaningful on multi-user systems

        Well, that says it all. CPU manufacturers have no incentive at all to secure the computations of multiple users on a single CPU (or cores on the same die)… why would they? They make more cash if everyone has to buy their own complete unit, and they can outsource security issues to ‘the network’ or ‘the cloud’…

        Years ago when I was in University this would have been a deathblow to the entire product line, as multi-user systems were the norm. Students logged into the same machines to do their assignments, employees logged into the same company servers for daily tasks.

        I guess that isn’t such a thing any more. But wow, what a sh*tshow modern CPU architecture has become, if concern for performance has completely overridden proper process isolation and security. We can’t even trust that a few different users on the same machine can be separated properly due to the design of the CPU itself?

        • FaceDeer
          1•2 years ago

          You’re reading an awful lot into what I said that wasn’t put in there.

          There’s nothing wrong with multi-user systems existing, there’s plenty of use for such things. This bug is really bad for those sorts of things. I was explicitly and specifically talking about consumer gaming computers, which are generally single-user machines. Concern for performance is a very real and normal thing on a gaming computer, it’s not some kind of weird plot. An actual multi-user system would obviously need to be patched.

        • El BartoEnglish
          28•2 years ago

          I’m not happy with what’s happening and I know that corporations are money making evil machines.

          But to say that chip makers have no incentive at all to secure their hardware is quite the hyperbole.

          • ArghblargEnglish
            1•2 years ago

            Fair enough, probably was hyperbole :) But performance does seem to be a higher priority than security; they can always spin PR after the next exploit, after all, users already have the CPU in their system, they’ve made their money; what are users really gonna do if an issue comes up after they’ve bought their box?

        • @[email protected]English
          12•2 years ago

          Processor manufacturers target their devices and sales towards cloud computing so they have a huge incentive to avoid having issues like these. It’s ridiculous to suggest otherwise.

          • ArghblargEnglish
            7•2 years ago

            I see the reasoning, fair enough. Just grumpy this evening I suppose :p.

        • Square SingerEnglish
          1•2 years ago

          I am so incredibly happy that those terrible multi-user systems are a thing of the past. Multiple seconds wait time for every mouse click are no fun.

          • @[email protected]English
            4•2 years ago

            Hey! I’ll have you know that a 68000 based server was good enough for about 60 users running X11 desktops back in the day!

            Kids today with their vodoo cards and whatnot.

            • Square SingerEnglish
              1•2 years ago

              When I was in university, they were probably running the same server, but with Ubuntu and for 500 sessions at the same time. That crap was totally unusable.

        • @[email protected]English
          19•2 years ago

          Are you aware that the majority of cpus sold today go to cloud computing? Believe it or not, but that is an application space with multiple users on the same machine.

          • @[email protected]English
            4•2 years ago

            Even on a single user machine, multiple users are very much a thing. Even Apple has left behind the DOS-like architecture where everything runs with the same rights. All current systems run with multiple concurrent users, notably root (or the Windows equivalent) and the keyboard operator (as well as dedicated ones for the various services, although that’s maybe more a thing in Unix/Linux than Windows).

          • ArghblargEnglish
            1•2 years ago

            Good point. But I think performance is still a greater priority for those who make purchasing decisions, rather than basic security, and that’s the problem.

            • @[email protected]English
              6•2 years ago

              Not at the enterprise level.
              Security means compliance, which means getting/keeping contracts and not getting sued.
              And they care more about performance-per-watt and density.

      • Espi
        45•2 years ago

        All these kind of CPU level vulnerabilities are the same, they are only really “risky” if there is malicious software running in the computer in the first place.

        The real problem is that these CPU-level vulnerabilities all break one of the core concepts of computers, which is process separation and virtual memory. If process separation is broken then all other levels of security become pointless.

        While for desktops this isn’t a huge problem (except when sometimes vulnerabilities might even be able to be exploited though browsers), this is a huge problem for servers, where the modern cloud usually has multiple users in virtual machines in a single server and a malicious user could steal information across virtual machines.

        • @[email protected]English
          31•2 years ago

          Your first paragraph isn’t quite right.
          Modern hacks/cracks aren’t a “do this and suddenly you are in” type deal.
          It’s a cascade chain of failures of non-malicious software.
          Saying “don’t have a virus” is absolutely correct, however that’s not the concern here.
          The concern is about the broadening of the attack surface.

          A hacker gets minor access to a system. Leverages some CVE to get a bit more access, and keeps poking around and trying CVEs (known or unknown) until they get enough access to run this CVE.
          And then they can escape the VM onto the host or other VMs on the same system, which might then give them access to a VM on another host, and they can escape that VM to get access to another VM, and on and on.

          Very quickly, there is a fleet of VMs that are compromised. And the only sign of someone poking around is on the first VM the hacker broke into.
          All other VMs would be accessed using trusted credentials.

          ETA:
          Infact, it doesn’t even need to be a hacker.
          It could be someone uploading a CI/CD task using their own account. It extracts all API keys, usernames and passwords it can find.
          Suddenly, you have access to a whole bunch of repositories and APIs.
          Then you can sneak in some malicious code to the git repo, and suddenly your malicious code is being shipped within legit software that gets properly signed and everything.

      • The OctonautEnglish
        84•2 years ago

        Would it mean that a malicious application being run in non-admin mode by one user could see data/memory in use by an admin user?

        • @[email protected]English
          82•2 years ago

          It would indeed imply that which is why this vulnerability is also serious for single user contexts.

          The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal hardware registers to software. This allows untrusted software to access data stored by other programs, which should not normally be accessible.

      • deejay4amEnglish
        16•2 years ago

        Processes that run on the same system can run as different users (including kernel) which is used for privilege separation. This can still allow a program in userland to peer into otherwise restricted system processes or the kernel. Every system is a “multi-user” system, even if there is only a single human user.

        • FaceDeer
          6•2 years ago

          Yes, but all the data that I care about is in my single human user’s account already. If I install malicious software then I’m already hooped regardless.

          Look, I’m not saying this is no biggie. There are plenty of systems out there that will have to install this patch. Single-user computers probably should too. The situation I’m addressing is the case where a gaming computer has its performance as a gaming measurably harmed by the patch’s overhead, which is reportedly significant in some cases. In those cases it’s reasonable to weigh the merits and decide that this vulnerability isn’t all that big a problem.

      • @[email protected]English
        32•2 years ago

        It allows memory access across virtual machines as well, meaning the all cloud VMs are vulnerable.

        • FaceDeer
          4•2 years ago

          The machines that are running cloud VMs should obviously be patched. I wasn’t talking about those.

      • fmstratEnglish
        12•2 years ago

        Disagree. For non-security conscious users who install that helper tool or plugin for their game, it can now read bank credentials from the browser.

        • FaceDeer
          4•2 years ago

          If you’re a non-security-conscious user installing malicious software on your computer then I don’t think there’s much that could help you.

          • fmstratEnglish
            1•2 years ago

            But these are the people we (the security community) should be helping. If we don’t help those who don’t have the skills to help themselves, scammers have a large target and keep on scamming. We are not a target.

            Granted, this post isn’t necessarily about that, but they’ll be the one’s targeted regardless. Sometimes the best way to reduce the attack vector is about people, not software.

    • Eager Eagle
      English
      82•2 years ago

      "whew* my horrible bubble sort implementation is safe from performance impacts

  • @[email protected]English
    12•2 years ago

    I’m curious if there’s a silver lining of all current DRM keys being accessible through this.

  • @[email protected]English
    179•2 years ago

    Install backdoors and sell that info to governments and companies, then years later reveal the issue to justify downgrading performance of older CPUs to encourage people to upgrade.

  • HexesofVexesEnglish
    52•2 years ago

    Guess it’s time for another FPS hit…

    While the article says it won’t impact most applications, I suspect it’s closer to saying “won’t impact most applications as much”.

    • StarDreamerEnglish
      5•2 years ago

      I would say you’ll be fine. Most games don’t compile with avx-2 anyways since it’ll crash if you run it on something that doesn’t have them (which is a lot of CPUs) and AVX-512 is straight up only available on Xeons, Epyc and zen 4. Nobody is going to use that for consumer software.

      The only game I can think of using AVX is a Skyrim mod for realistic physics, where the author provided binaries for AVX-2/AVX-512. So it won’t affect most compiled applications much since you need to compile with it first (which almost nobody does).

  • dual_sport_dork 🐧🗡️English
    67•2 years ago

    Ha-ha. My chip’s too old to be affected. I don’t see my architecture on the list.

    I knew putting off upgrading for around a decade would pay off. (Windows Update tells me my PC is not “ready” for Windows 11 due to its hardware, either. Oh no, whatever shall I do.)

    • @[email protected]English
      13•2 years ago

      This inspires confidence with my 2010 ass toshiba sattelite with an i5 and 8gb DDR3. I need to look and see if mine is too old lol.

    • @[email protected]English
      14•2 years ago

      Dont the older chips suffer from a greater performance drop from spectre and meltdown vulnerabilities?

  • @[email protected]English
    33•2 years ago

    Jokes on them. I’m already watched by criminals and am used to companies throttling products.

  • @[email protected]English
    37•2 years ago

    Yikes the performance hit is scary but if you’re running a server, what option do you have?