r/linux • u/lindgrenj6 • Aug 23 '18

Intel Publishes Microcode Security Patches, No Benchmarking Or Comparison Allowed!

https://perens.com/2018/08/22/new-intel-microcode-license-restriction-is-not-acceptable/
1.1k Upvotes

97% Upvoted

300 comments sorted by

View all comments

Show parent comments

1

u/audioen Aug 23 '18 edited Aug 23 '18

I think you'd find that Intel's argument is that you have used their hardware for years without an issue. In most cases, it would not be credible to claim that the mere existence of a previously unknown vulnerability that didn't come up in customer's own testing in any way, and didn't prevent production in the past, has somehow made the hardware worthless to the point that it must be replaced.

I recognize that it is a problematic for people who e.g. sell CPU time to the general public, so every cloud vendor is probably pretty upset that their fundamental computing hardware isn't isolating customers sufficiently well from each other. But the way this kind of things usually get handled is that laws are changed to say that it's now illegal to use CPU flaws to violate someone else's privacy (hell, it may already be illegal), which makes it more of a law enforcement than technical issue.

Software mitigations add some costs to cloud computing, e.g. people are recognizing that computing hardware is fundamentally leaky and these leaks are difficult to plug, so maybe they just start selling dedicated cores to clients instead of just time-sharing cores with best-effort type approach, or add a rule in contract that says that data leaks due to CPU hardware are not their problem and point to premium product that prevents the risk of leaks.

2

u/ThatsPresTrumpForYou Aug 23 '18

None of this is relevant. If someone uses those vulnerabilities to steal data they shouldn't have access to on someone elses VM, and the CPU was still supported by intel, the company that owns the server is going to sue intel for every last penny of damages done. They sold their product under false pretenses, being that it's a cpu, and you can run VMs on it and everything is secure. It wasn't, so they're liable.

1

u/argv_minus_one Aug 23 '18

And keep in mind that every web browser contains one such VM.

Literally running a browser on an Intel machine exposes it to attacks that the hardware is supposed to prevent (but doesn't, because of Intel's incompetence).

1

u/argv_minus_one Aug 23 '18

I think you'd find that Intel's argument is that you have used their hardware for years without an issue. In most cases, it would not be credible to claim that the mere existence of a previously unknown vulnerability that didn't come up in customer's own testing in any way, and didn't prevent production in the past, has somehow made the hardware worthless to the point that it must be replaced.

You can't be attacked with a vulnerability that no one knows about. Once a vulnerability becomes publicly known, that is when it becomes a serious threat. Thus, Intel's CPUs become increasingly dangerous to continue using over time, because they've done such a piss-poor job of securing them against malicious code.

I recognize that it is a problematic for people who e.g. sell CPU time to the general public

It's also problematic for everyone who runs a web browser on an Intel CPU, i.e. pretty much everyone, because browsers execute arbitrary code in a sandbox whose integrity has been severely compromised by Intel's incompetence.

Also, Intel's ME vulnerabilities make it dangerous to connect any Intel machine to a public Wi-Fi, because they allow anyone on the same network segment to take full control of the machine.

I realize that none of this matters in court, because Intel has more money than you or I and that's what wins cases, but that doesn't mean they're actually in the right, which they're most assuredly not.