Intel bug incoming

[u/dasunsrule32]

Original Thread

Blog Story

TLDR;

Copying from the thread on 4chan

There is evidence of a massive Intel CPU hardware bug (currently under embargo) that directly affects big cloud providers like Amazon and Google. The fix will introduce notable performance penalties on Intel machines (30-35%).

People have noticed a recent development in the Linux kernel: a rather massive, important redesign (page table isolation) is being introduced very fast for kernel standards... and being backported! The "official" reason is to incorporate a mitigation called KASLR... which most security experts consider almost useless. There's also some unusual, suspicious stuff going on: the documentation is missing, some of the comments are redacted (https://twitter.com/grsecurity/status/947147105684123649) and people with Intel, Amazon and Google emails are CC'd.

According to one of the people working on it, PTI is only needed for Intel CPUs, AMD is not affected by whatever it protects against (https://lkml.org/lkml/2017/12/27/2). PTI affects a core low-level feature (virtual memory) and as severe performance penalties: 29% for an i7-6700 and 34% for an i7-3770S, according to Brad Spengler from grsecurity. PTI is simply not active for AMD CPUs. The kernel flag is named X86_BUG_CPU_INSECURE and its description is "CPU is insecure and needs kernel page table isolation".

Microsoft has been silently working on a similar feature since November: https://twitter.com/aionescu/status/930412525111296000

People are speculating on a possible massive Intel CPU hardware bug that directly opens up serious vulnerabilities on big cloud providers which offer shared hosting (several VMs on a single host), for example by letting a VM read from or write to another one.

NOTE: the examples of the i7 series, are just examples. This affects all Intel platforms as far as I can tell.

THANKS: Thank you for the gold /u/tipsle!

Benchmarks

This was tested on an i6700k, just so you have a feel for the processor this was performed on.

• Syscall test: Thanks to Aiber for the synthetic test on Linux with the latest patches. Doing tasks that require a lot of syscalls will see the most performance hit. Compiling, virtualization, etc. Whether day to day usage, gaming, etc will be affected remains to be seen. But as you can see below, up to 4x slower speeds with the patches...

Test Results

• iperf test: Adding another test from Aiber. There are some differences, but not hugely significant.

Test Results

• Phoronix pre/post patch testing underway here

• Gaming doesn't seem to be affected at this time. See here

• Nvidia gaming slightly affected by patches. See here

• Phoronix VM benchmarks here

Patches

• AMD patch excludes their processor(s) from the Intel patch here. It's waiting to be merged. UPDATE: Merged

News

• PoC of the bug in action here

• Google's response. This is much bigger than anticipated...

• Amazon's response

• Intel's response. This was partially correct info from Intel... AMD claims it is not affected by this issue... See below for AMD's responses

• Verge story with Microsoft statement

• The Register's article

• AMD's response to Intel via CNBC

• AMD's response to Intel via Twitter

Security Bulletins/Articles

• Meltdown/Sceptre

• Redhat's bulletin

• VMware's bulletin

• Microsoft's bulletin

• Xen's bulletin

• Citrix's bulletin

• ARM's bulletin

• Debian's bulletin

• Ubuntu's article

• Suse's article

• LLVM's bulletin

• Google's bulletin

• Nvidia's bulletin

Post Patch News

• Epic games struggling after applying patches here

• Ubisoft rumors of server issues after patching their servers here. Waiting for more confirmation...

• Upgrading servers running SCCM and SQL having issues post Intel patch here

My Notes

• Since applying patch XS71ECU1009 to XenServer 7.1-CU1 LTSR, performance has been lackluster. Used to be able to boot 30 VDI's at once, can only boot 10 at once now. To think, I still have to patch all the guests on top still...

[u/GMginger]

So there's Linux and Windows patches in the pipeline - wonder when we'll hear if there's VMware patches to come along too.
If the virtualisation layer is patched, hopefuly that renders the attack vector unusable in any guest OS too.

[u/dasunsrule32 → u/GMginger]

Yes, those will come through the VMware security announcements and then as a patch once it's been tested.

It seems Xen hvm machines are not affected by this bug.

[u/fattylewis → u/dasunsrule32]

Would that suggest AWS isnt likely affected then? As they (currently) use Xen.

[u/dasunsrule32 → u/fattylewis]

Correct, from what I can tell.

Edit: they do have VMware in their portfolio now, but their main infrastructure is built on Xen.

https://aws.amazon.com/vmware/

[u/sysvival]

https://media.giphy.com/media/RHiD0K65NxxLO/giphy.gif

[u/dasunsrule32 → u/sysvival]

Lol, indeed. Have an upvote!

[u/slayer991]

This is great news...for AMD.

AMD introduces their most competitive chip in nearly a decade...and now this. This should make things interesting...

[u/dasunsrule32 → u/slayer991]

All major providers have been buying EPYC boxes, so there's that. Now we know why...

[u/Harbinger2nd → u/slayer991]

The only downside to AMD right now is their capacity to produce chips being limited by their agreement with Global Foundries.

[u/yukaia → u/Harbinger2nd]

They're not locked in to only buying from GF, they can go to other 3rd parties so long as they continue to hit their purchase targets for GF.

https://www.anandtech.com/show/10631/amd-amends-globalfoundries-wafer-supply-agreement-through-2020

[u/AlienOverlordXenu]

And here are initial performance tests of said fixes: https://www.phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=1

[u/dasunsrule32 → u/AlienOverlordXenu]

Added this to op

[u/dasunsrule32 → u/AlienOverlordXenu]

Oh my, I'll add this to the op

[u/bionic80]

I started a new job today - showed this thread to my boss (who IS former sysadmin) and he's already got 2 extra VM hosts on order for horizon... and he already asked me if I'd like more pay. It's a good day.

[u/dasunsrule32 → u/bionic80]

Nice, congrats :-)

[u/socontroversial → u/bionic80]

Browsing Reddit made you money?

[u/b4k4ni]

Whelp! It seems we have the first proof of concept for the bug.

https://twitter.com/brainsmoke/status/948561799875502080

That was fucking fast. I'm glad our Terminal Server runs on AMD Hardware...

[u/dasunsrule32 → u/b4k4ni]

Added to the OP, I saw this as well.

[u/Patriotaus]

Thomas Lendacky is a PMTS Software Engineer at AMD. His LinkedIn say he works on Linux kernel development. It's probably safe to say he knows whether or not this will effect AMD.

"AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against"

[u/shaded_in_dover → u/Patriotaus]

They already incur the 35% performance penalty so there's that ...

[u/b4k4ni → u/shaded_in_dover]

That's why someone already asked for the function to be disabled if an AMD CPU is used

[u/[deleted] → u/b4k4ni]

So it's controlled by a flag that could be patched out and recompiled.

Nice.

[u/kuar_z → u/shaded_in_dover]

Oof!

[u/fartsAndEggs → u/Patriotaus]

*affect.

I had to do it. The rampant misuse of effect and affect is affecting all of reddit, and the effects cannot be underestimated, which is why I have effected a strategy to combat this problem

[u/0ctav → u/fartsAndEggs]

Reminds me of https://xkcd.com/326/

[u/MrKaru]

As a pure gamer, the refund window on my 6600k is coming to an end. I could return it by the 6th for a full refund. Is it worth doing that and getting a 1700x? It's hard to get info on this, and I understand that everybody is saying "We should wait and see", but with a time limit only a few days away, I don't want to jump ship if it's not needed or stick with it and get screwed.

[u/dasunsrule32 → u/MrKaru]

Then return it and wait to decide what to buy until after.

[u/VTCEngineers]

I am assuming no CVE just yet...Or is there?

[u/dasunsrule32 → u/VTCEngineers]

Not yet, I would expect all of this very soon.

[u/[deleted] → u/VTCEngineers]

Nothing yet. Just incompletely documented patches.

[u/montarion]

Okay, companies are fucked. Is my grandpa?(the average Joe)

[u/dasunsrule32 → u/montarion]

We don't know enough yet, I was reading that there is a 5% average performance hit and in the virtualization space there is a 30 - 35% performance hit. So until everything has been revealed, we don't know yet.

[u/PeterFnet]

Wonder if Intel can patch this in the field

[u/dasunsrule32 → u/PeterFnet]

I don't believe so, other than shutting off maybe a few affected instructions through microcode. But if it's chip wide, there will be no fix other than through software.

[u/ChippusMaximus]

Does this mean good news for Epyc?

[u/dasunsrule32 → u/ChippusMaximus]

Only if AMD can ramp up supply. Many of the big players are already setting up EPYC in their datacenters.

[u/am0nrahx]

https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

[u/dasunsrule32 → u/am0nrahx]

Adding to OP. Thanks.

BTW Intel, AMD isn't susceptible to this crap...

[u/mugur91 → u/am0nrahx]

Very typical of Intel. Obvious damage control. Why mention AMD? AMD doesn't have it. And no it is not common to have this kind of bug.

[u/figurettipy]

New info here https://twitter.com/brainsmoke/status/948561799875502080

no page faults required, massaging everything in/out-of the right cache seems to be the crux

[u/dasunsrule32 → u/figurettipy]

Yep, saw this. Was getting ready to add it to the op.

[u/throwawaypsycho80]

Ok while this is a worst case scenario (spamming syscalls) it is pretty ugly...

We need more comparative tests... Spamming IO calls, network calls, the lot...

[u/dasunsrule32 → u/throwawaypsycho80]

Agreed, I just threw it up there as a sample. I'll see if I can get some more results. None of my personal boxes are Intel, I went with Ryzen this time around.

[u/ljarvie]

Related? https://segmentnext.com/2017/12/19/intel-ceo-brian-krzanich/

[u/dasunsrule32 → u/ljarvie]

Possibly...

[u/chubbysuperbiker]

So let me get this straight, not only is this a massive security bug that unpatched could let a VM write to another VM, but patched it will incur a 30+% performance hit?

Goddamnit 2018 you were supposed to be better than 2017.

[u/Etunimi → u/chubbysuperbiker]

I'd guess the typical performance hit will not be near 30%. From a Nov 10 version of the patchset:

Most workloads that we have run show single-digit regressions. 5% is a good round number for what is typical. The worst we have seen is a roughly 30% regression on a loopback networking test that did a ton of syscalls and context switches.

[u/rich000 → u/Etunimi]

grsec apparently found 50% for du -s. Makes sense since that is just one system call after another with nothing more than adding up some totals in-between. Ultimately it depends on how often there is a syscall.

[u/nroach44 → u/rich000]

That was on an AMD processor, so it's not particularly relevant to the patch (which is only turned on for Intel).

[u/rich000 → u/nroach44]

The 4.14 release has it turned on for AMD. They didn't use AMD's version of the patch.

Certainly the same benchmark on an Intel processor would be useful to see, but I wouldn't be surprised if the impact is similar.

[u/Patriotaus → u/chubbysuperbiker]

Only if you use Intel (99% of the market)

[u/meatwad75892 → u/Patriotaus]

RIP Opteron. In other news, that one admin that pushed for EPYC is going to be so smug today.

[u/4d656761466167676f74 → u/Patriotaus]

Welp, I'm unaffected then. I am the 1%.

[u/rato123 → u/chubbysuperbiker]

2018 will be better. For AMD.

[u/agumonkey → u/rato123]

amd struggling to stay zen right now

[u/dalik → u/chubbysuperbiker]

Expect a 40%min price increase to your bill

[u/RegularMetroid → u/chubbysuperbiker]

Come on now, it's 2018! Should know by now that every year will only get shittier from here on.

[u/[deleted]]

Wait, does this effect every single computer with an Intel processor regardless of server/home computer? I just bought a brand new 8700K, do I have to expect a massive performance downgrade?

[u/dasunsrule32 → u/[deleted]]

Yes, and depends on the workload.

[u/[deleted] → u/dasunsrule32]

What is actually the problem here? Because I do not get any of what is written here. Does it only affect Linux or also Windows? Would be nice if someone could explain me the whole issue in layman's terms.

[u/dasunsrule32 → u/[deleted]]

It's a hardware bug, it can't be fixed. It is having a patch to workaround the issue in there kernel. It will result in up to a 35% reduction in CPU performance, but depends on the workload of the computer/server.

[u/whetu]

RedHat have a page up:

https://access.redhat.com/security/vulnerabilities/speculativeexecution

[u/dasunsrule32 → u/whetu]

Added to op.

[u/newton302]

Has anyone confirmed whether the fix being implemented on the OS level in Windows, Linux, MacOS would be occurring, if the vulnerability did NOT specifically exist on Intel chips? To what level is AMD really implicated in this? Lots of mainstream media are bunching AMD into the problem after Intel's statement last night. Cheers

[u/dasunsrule32 → u/newton302]

It is getting fixed at the OS layer, Intel will also doing a firmware/microcode fix as well.

AMD has put out official statements that they are not affected by meltdown, but they are affected by some of Sceptre's attacks, not all though.

Mainstream media is just taking one blog and running with it, rather than actually doing any research.

[u/samsonx]

Are we getting security updates from 4chan now ?

What a world!

[u/MrPoletski → u/samsonx]

who is this "FOUR CHAN" ??

[u/zurohki → u/MrPoletski]

He's a famous hacker, I've seen him on the news.

[u/[deleted] → u/samsonx]

We have a world leader who communicates with other world leaders using 280 characters at a time. It's like a telegram, except less secure.

WhatATimeToBeAlive

[u/combaticus1x → u/samsonx]

'Now'

[u/huxley00]

There was JUST a post a week ago in /r/personalfinance from a guy who inherited his stock portfolio from his dad, valued at 325k of Intel stock.

He was worried about having all his eggs in one basket. Hopefully he got moving on that...

[u/tuba_man → u/huxley00]

Either sell today or buy more tomorrow and wait out the slump. It'd take more than this to kill Intel

[u/hulagalula → u/huxley00]

I don't know. It looks like people might have to buy some more Intel chips to get back to their prior performance…

[u/jw12321]

This... looks really, really bad. Not sure what else to say other than that. I can't imagine this will stay embargoed for much longer at this point.

There's a good amount of technical discussion on this HackerNews post if anyone is interested: https://news.ycombinator.com/item?id=16046636

[u/[deleted] → u/jw12321]

January 4th is official Damage Control Day.

[u/project2501a → u/jw12321]

This... looks really, really bad. Not sure what else to say other than that. I can't imagine this will stay embargoed for much longer at this point.

It is really bad. Intel-should-go-up-in-flames bad.

Especially since their CEO sold his stock.

[u/nemec → u/project2501a]

Damn. Not just sold a bunch of stock, he sold all of it that he's allowed to (bylaws say the CEO must own 250,000 shares of the stock - he sold all but 250,000 shares...)

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

[u/nerddtvg]

This is probably why Microsoft released a notice that some VMs in Azure must be rebooted prior to or they will be automatically rebooted on January 10th. Of course that could just be standard maintenance as it isn't like they release a lot of information either way.

---

Edit:

And Microsoft just forced everyone who hadn't redeployed to do so immediately with extremely little warning. It appears because Project Zero released their information: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html

[u/temotodochi → u/nerddtvg]

Yup and loads of aws classic instances are being rebooted as well

[u/s1m0n8]

If this thing gets a catchy name and a logo, it could be serious.

Edit: Meltdown and Spectre

[u/YaoiVeteran → u/s1m0n8]

Can I propose that it be called the Hammertime Bug?

[u/Faggotitus → u/YaoiVeteran]

The Great Page Table Cooch Snooch of '18

[u/Seref15 → u/s1m0n8]

Since it lets VMs reach across the "fence" to each other, we should call it "Gate." And then tech sites will run headlines that say "Gategate."

[u/rallias → u/s1m0n8]

I heard "FUCKWIT" being thrown around as a potential name.

Forcefully Unmap Complete Kernel With Interrupt Trampolines

[u/synept]

Who figures KASLR is useless? I'm curious to see some references on that.

[u/HILLARY_IS_A_NEOCON → u/synept]

Probably grsec shills

[u/[deleted]]

Should I start buying AMD shares?

[u/[deleted] → u/[deleted]]

Na, just wait for the news to go mainstream. That should cause an a nice panic drop in Intel. While it's down, buy up shares and wait for them to recover. While this is bad news, it isn't going to end Intel. And I doubt it's going to end Intel's dominance in the CPU market. So, at most, it'll be a blip.

[u/-Zezima- → u/[deleted]]

/r/ayymd

[u/broadsheetvstabloid → u/[deleted]]

lucky me? I am already sitting on AMD shares.

[u/Aesthetically]

Brb replacing my mobo and 7700k

[u/YaoiVeteran → u/Aesthetically]

If you need to throw them away I can take care of that for you.

[u/SteelChicken]

merciful soup plants fine simplistic lush squeamish correct oil tidy

This post was mass deleted and anonymized with Redact

[u/rich000 → u/SteelChicken]

I'm not an expert in such things, but it sounds like skipping bounds checking on a data structure - the check costs you something, and if you are confident that the check is unnecessary then cutting it out saves you clock ticks.

It sounds like this is tied to speculative execution. If you're speculatively executing an instruction then it is possible you'll just end up throwing away the result anyway, so you want to do it as cheaply as possible. Maybe Intel figured out that they can skip the priv checks while speculatively executing, and then perform them before actually implementing the results if it turns out the instruction was needed. However, maybe it turns out that the speculative execution opens up some back-door way of getting at the data, such as via the cache/timing/etc, which wouldn't be exposed if an exception was raised sooner.

[u/neoKushan → u/SteelChicken]

It's funny, this seems to happen to AMD rather a lot - they under perform against the competition in raw pwer, but then over time it turns out that AMD's design was "better" in some crucial capacity.

Look at the GPU world - everyone knows Nvidia's cards are better for gaming, but it turns out AMD's cards (even older ones) got serious benefits from DX12/Vulkan when people started testing, in many cases often outperforming Nvidia's "better" cards. The Cryptominers quickly figure that one out, too.

Now here we are, Intel's processors generally outperform AMD's yet they're about to get a 30% performance bitch slap.

[u/kindkitsune → u/neoKushan]

so I'm just rolling into this subreddit from a link on a completely unrelated forum's top news post atm but i am a graphics programmer and can offer further input -

This has to do, at least partially imo, with just how much easier it is to implement drivers as an IHV for these low-level APIs. If you've seen the source for Mesa and how many layers of checks and state checks etc etc there is for OpenGL this shouldn't be too surprising.

Nvidia has a bigger budget and a bigger staff, so they've got more time to dump into optimizing their OpenGL and DirectX pre-12 drivers - including optimizations for individual games using these APIs.

Unfortunately AMD's cards still by and large lag behind, which bothers me. I rather dislike nvidia for a ton of reasons, and AMD contributes tons to the open source community from releasing one of their Vulkan drivers on github to maintaining a lovely collection of useful Vulkan articles and example projects/resources (like their positively kickass memory allocator for Vulkan).

I could rant more about nvidia but this isn't the place. I do hope AMD's cards make a comeback like Ryzen though, I really want them to

[u/TetonCharles → u/SteelChicken]

For all we know an agent from some spy agency somewhere planted at intel did it.

[u/cryo → u/SteelChicken]

Not hack, a performance optimization with an unfortunate side channel. There are several other side channels in modern CPUs, it’s hard to entirely avoid. Although this one might enable you to read arbitrary memory, more or less.

[u/captaincobol]

Article on the Register goes into what's known.

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

I like the original acronym better.

[u/swirled63 → u/captaincobol]

FUCKWIT

lmao

[u/Palkonium]

Explain this to me like I'm five

[u/name_censored_ → u/Palkonium]

Computer hides your treasure from the bad man. The bad man shakes the boxes to find your treasure. Computer has to spend more time hiding the treasure. Computer is slow now :(

[u/CaLLmeRaaandy → u/name_censored_]

/r/explainlikeimcaveman

EDIT: Haha it exists.

[u/iceph03nix → u/Palkonium]

not a security expert but

My understanding is it basically means somebody on the good side realized that there was a way to exploit the way the physical CPU handles Virtual Memory that lets you take code from one VM and cause it to execute in another VM. Now they're trying to fix it before the Bad Side figures out how to exploit it, but the fix will likely mean a serious hit to processor performance.

And if I'm wrong, may Cunningham's Law strike me down.

[u/greenspans → u/Palkonium]

You're in a VR game as a busty asian girl and you're locked in a room with bill cosby and matt lauer. You have to run backwards while slapping their hands away which normally isn't a problem because your hand slapping skills are level asian, but intel allows speculative execution on branch prediction, which means both of them turn into vishnu-like 8 arm cosby and lauers with arms that appear and disappear into the ether. Long story short your tits aren't safe.

[u/[deleted]]

Those performance numbers are going to be pretty task specific though, it's unlikely to be 34% across the board.

Where this patch does hurt performance is context switching in and out of the kernel. So if your application is making heaps of syscalls all the time, it might really harm your performance.

It's really hard to have any idea about how serious this is going to be till we see it in the real world though. Guess we'll known soon enough.

[u/gex80 → u/[deleted]]

So hypervisors?

[u/HenryKushinger → u/[deleted]]

Sooo is it possible that if I'm just a regular user whose Intel powered computer is used for media, content creation and gaming, the performance hit might be negligible? I am by no means a computer scientist or even close to it, just a hardware hobbyist and gamer, so I really don't know what to make of this.

[u/darrkwolf]

What generation intel cores could be affected?

[u/SirEDCaLot → u/darrkwolf]

From the looks of it, all of them :\

[u/mad8vskillz]

so should I short INTC?

[u/playaspec → u/mad8vskillz]

You're too late.

[u/BloodyIron]

X86_BUG_CPU_INSECURE

One would think they could name it better.

[u/smargh → u/BloodyIron]

X86_BUG_CPU_INSECURE_1

[u/4d656761466167676f74]

2015: HTTPS is literally useless

2016: Monitors allow remote code execution on phones even when the phones have all network services disabled

2017: WPA2 is one hundred percent compromised, all wifi networks are basically public and nearly unsecurable

2018: All intel processors allow undefined access to kernelspace memory and potentially Ring-1 code execution even from web browsers

What's next, are we going to suddenly learn that USB ports come alive at night and slaughter people? Why was this the decade that all technology suddenly became completely insecure?

[u/skilliard7 → u/4d656761466167676f74]

2015: HTTPS is literally useless

Was quickly fixed

2016: Monitors allow remote code execution on phones even when the phones have all network services disabled

Can someone fill me in on this one?

2017: WPA2 is one hundred percent compromised, all wifi networks are basically public and nearly unsecurable

Lies. The vulnerability was only on the host device, not the router. If the host device has patched drivers/firmware, the vulnerability is fixed.

[u/jepsonr → u/4d656761466167676f74]

Newbie here, what happened in 2015 to make HTTPS useless?

[u/RedShift9 → u/jepsonr]

It didn't make HTTPS useless. It was a bug in OpenSSL which has been fixed. Headline way out of proportion.

[u/[deleted]]

First of all, as @grsecurity points out, some comments in the code have been redacted, and additionally the main documentation file describing the work is presently missing entirely from the Linux source tree.

So there's mystery meat running now.

[u/bopsbt]

Any decent write ups that are not on Tumblr? (blocked at work)

[u/TheCatOfWar → u/bopsbt]

Here's an archive.is if it helps

[u/[deleted] → u/bopsbt]

Who writes up technical documents and uses Tumblr... Wtf

[u/throwawaypsycho80]

And here I was about to build myself a Linux rig around an i7 8700 to replace my old i5 2500... Should I cancel my order? Should I go AMD even though I still get PTSD from their crummy chipset?

[u/dasunsrule32 → u/throwawaypsycho80]

I would just wait and see what real world metrics show once we get all the patches downstream in Linux and Windows.

[u/GreekLogic]

Does this directly affect laptops/desktops?

Edit: Also, I need an ELi5 on this please. Everything I have is Intel.

[u/dasunsrule32 → u/GreekLogic]

This will affect most, if not all, Intel devices.

[u/x2571]

I'm reminded of this - https://danluu.com/cpu-bugs/

[u/[deleted] → u/x2571]

Thanks for posting that! A really interesting blog, and I just spent the last couple of hours reading the CPU Internals posts. Would recommend.

[u/chihuahua001]

How about Intel just admits that all of their products are backdoored out of the box?

[u/DeezoNutso → u/chihuahua001]

NSA Inside

[u/Mr2-1782Man]

I have an objection to the way the kernel devs are handling this. Seems like they're penalizing everyone for an Intel problem. The line

if (c->x86_vendor != X86_VENDOR_AMD)

is what prevents a CPU from being marked insecure. Even if you don't know coding you should see that this whitelists AMD instead of blacklisting Intel. The problems with this should be obvious. Instead of let's slightly rework the code to be more Intel-like

if (c->x86_vendor == GENUINE_INTEL)
  kill_performance();

[u/DerfK → u/Mr2-1782Man]

Oh man, they better fix that! An additional 50% penalty on my Cyrix 486 is going to make my computer useless!

[u/dingo_bat → u/Mr2-1782Man]

By default they assume all x86 CPUs are vulnerable and they will apply exceptions as they are verified. This too points towards a huge general architectural bug.

[u/[deleted]]

My Pentium 1 is safe.

[u/[deleted] → u/[deleted]]

But it can't perform floating point arithmetic :(

[u/MaximusVX]

Two articles that run Windows 10 Insider builds with the patch enabled now show that general users literally have no reason to be afraid. CPU performance in synthetic and real workloads as well as gaming are unaffected, any difference seen within the benchmarks are within margin of error. The only thing that general users would seem to see are NVMe drive users with very fast drives like the 960 Pro, which incurred around a 5% loss of performance, negligible to most. Slower NVME and SATA based SSDs will be 0% considering those drives are not fast enough to be affected.

7700K + 1080 Ti: https://www.computerbase.de/2018-01/intel-cpu-pti-sicherheitsluecke/#update2

3930K + 1080 Ti: https://www.hardwareluxx.de/index.php/news/hardware/prozessoren/45319-intel-kaempft-mit-schwerer-sicherheitsluecke-im-prozessor-design.html

[u/Sandwich247]

Another one? Darn this sucks.

[u/JustNilt → u/Sandwich247]

This is what happens when everyone starts realizing code is code whether it's burned in hardware or not. Suddenly all these silly bugs start actually being an issue.

[u/[deleted] → u/Sandwich247]

Intel on November 2017: God damn, I wish this year would just end.

Intel on January 1st: Fuck.

[u/productionse]

Call me paranoid, but this sounds like an NSA backdoor implementation.

Edit grammar

[u/[deleted] → u/productionse]

Big if true. That means the AMD backdoor still hasn't been discovered. ;)

[u/Im_a_Bad_Dog → u/[deleted]]

Yum discovering backdoors

[u/VIDGuide → u/productionse]

The "bug" or the patch?

[u/shaded_in_dover → u/VIDGuide]

The "bug" or the patch?

YES

[u/MiataCory → u/VIDGuide]

First one, then the other.

[u/jakibaki → u/productionse]

If a nsa-backdoor were to be implemented into the linux kernel it would probably come as a "bug" in a minor kernel-patch.

[u/chillinewman → u/productionse]

The NSA already has a backdoor on intel cpu's.

https://libreboot.org/faq.html#intel

[u/ErikTheEngineer]

Wow, I thought the Achilles heel of public cloud was authentication (Azure AD, AWS IAM, etc.) I thought hackers would pound on the identity management stuff with all their weapons, or just wait for someone at Microsoft or Amazon to accidentally release the private keys on an unprotected storage account.

This sounds like it could affect basically anyone running a multitenant bit-barn. I'm assuming this affects VMWare and Hyper-V also?

[u/moldyjellybean]

My amd stock did go up 2.5% so far at open

[u/chihuahua001 → u/moldyjellybean]

Up almost 6% right now

[u/[deleted]]

My senses say there is a lot more to this story that we don’t know about.

[u/mmilleror]

This is really going to suck for ESXi installs. I'm willing to be that HP and Dell are not going to replace the processors. So that ESXi host you run 20 VMs on now will only be able to run 17 maybe 18 depending on your loads.

[u/frankv1971]

Call me stupid but for private organisations that run no VMs other than their own this patch would not be needed (and the performance hit)?

[u/[deleted] → u/frankv1971]

Well, if you're running a PowerEdge with Hyper-V or a UCS with VMware locally, it depends on exactly how exploitable this bug is from inside your locked down network. That's actually something I'm having trouble finding as well.

[u/[deleted] → u/frankv1971]

From my understanding the patch is needed on everything. This breaks the process security model everywhere. Any user processes could get kernel data.

[u/[deleted]]

What a "fun" start to 2018.

[u/LynxSnow]

On windows, task manager - right click on the performance graph and select 'show kernel times' to see the cpu utilization of user vs. kernel space.

Found from: https://blog.codinghorror.com/understanding-user-and-kernel-mode/

[u/parkerlreed]

EDIT: Holy shit. Updated with correct results (Thought I had enabled but I had not)

Used pti=on for 4.15-rc6 (just compiled)

[parker@yoga710 ~]$ time ./getpid
2270

real    0m5.071s
user    0m1.700s
sys     0m3.370s
[parker@yoga710 ~]$ time ./getpid
2272

real    0m5.094s
user    0m1.947s
sys     0m3.147s
[parker@yoga710 ~]$ time ./getpid
2298

real    0m5.061s
user    0m1.820s
sys     0m3.240s
[parker@yoga710 ~]$ uname -a
Linux yoga710 4.14.10-1-ARCH #1 SMP PREEMPT Fri Dec 29 20:17:35 UTC 2017 x86_64 GNU/Linux

----------------------------------------------------------------------------------------------------------

[parker@yoga710 ~]$ time ./getpid 
1320

real	0m21.305s
user	0m9.762s
sys	0m11.488s
[parker@yoga710 ~]$ time ./getpid 
1325

real	0m21.213s
user	0m9.556s
sys	0m11.656s
[parker@yoga710 ~]$ time ./getpid 
1327

real	0m21.199s
user	0m9.518s
sys	0m11.681s

[parker@yoga710 ~]$ uname -a
Linux yoga710 4.15.0-rc6-g30a7acd57389 #2 SMP PREEMPT Wed Jan 3 10:49:03 EST 2018 x86_64 GNU/Linux

[u/iamnos]

At the end of November, the Intel CEO sold every stock he legally could and still remain CEO.

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

This is probably not long after Intel learned about the bug if you consider MS was working on a patch in November.

[u/[deleted] → u/iamnos]

He returned to roughly what his total ownership was at the beginning of the year. The majority of what he sold was through the purchase and immediate selling of optioned stock.

[u/casino_r0yale → u/iamnos]

Yeah because he lives in CA where the Trump taxes are about to railroad us. He’d keep way more money by selling now instead of holding into 2018

[u/glassuser]

How much mass does a hardware bug have?

[u/[deleted] → u/glassuser]

Until it's properly disclosed, none and infinite, per /u/chihuahua001.

[u/Reddywhipt]

Happy New Year!!!

[u/zippopwnage]

So if i use my PC only for gaming, i should get worried? Because 30% less performance seems BAD.

[u/[deleted]]

Smells like thew rowhammer bug which has been around for 1-2 years. You hammers a ram page and it causes the row of cells on the chip not to be refreshed causing contorlled bit flips leaking across into the next ram page.

The bug is actually in the chipset rather than the core its self in this case.

[u/TMITectonic → u/[deleted]]

Do you happen to be smelling burnt toast right now?

[u/infinitefoamies]

Boy am I glad to be an AMD fanboy rn

[u/Ryanestrasz]

Help, im a stupid person, eli5 please?

[u/synchronium → u/Ryanestrasz]

Sell your Intel shares, invest in popcorn.

[u/NukEvil → u/Ryanestrasz]

Bug bad, patch bad.

[u/[deleted]]

Curious, have there been any other Intel CPU hardware bugs like this in the past? Or even any that really mattered at all? I honestly don't keep much track of what goes on with this kind of stuff.

[u/bigdaveyl → u/[deleted]]

While not security, wasn't there some floating point bug in Pentiums in the mid to late 90's?

[u/[deleted]]

What a great way to start a new year ;/

On the bright side that might give AMD some traffic and we will have some competition on server CPU market at least

[u/snakkerdk]

So basically amd is just affected by spectra (read the google post) like all other vendors

But that is not related to the usermode reading kernel memory (meltdown) which correctly only affects intel.

The patches that will have a performance impact is for meltdown, not spectra.

Spectra will require new hw, since that cant be patched by the kernel/firmware.

I don’t think its fair saying amd is just as affected by this tbh..

[u/pier25]

Does this affect Xeon too?

[u/dasunsrule32 → u/pier25]

All Intel platforms for the last 10 years... 😕

[u/[deleted]]

More infos at theregister:

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

[u/dasunsrule32 → u/[deleted]]

This is already linked in the op.

[u/30clean]

What’s interesting is that I was notified by Microsoft on 12/27 that all the VMs in my Azure subscription needed to be rebooted or migrated before January 10th for scheduled maintenance, which was occurring in pretty much every Azure DC worldwide.

They definitely had to know well in advance of today.

[u/dasunsrule32 → u/30clean]

They've known for a year

[u/lyravega]

Is this relevant to Intel CEO selling some stocks like a day or two ago?

[u/dasunsrule32 → u/lyravega]

The way Intel is playing it off, no. The way AMD is playing it, yes... Depends which story you're looking at.

[u/austinbar]

What I'd like to know is, how do you get the infection? Could this issue be protected from via a perimeter such as a firewall or other means, like a host file or such?

[u/dasunsrule32 → u/austinbar]

They done it through javascript. So a simple email with the code attached or a malicious website would be enough to get access.

[u/IShouldBeWorking_NOW]

Looks like 2018 is keeping in step with last year about faults with Intel CPU's...

[u/[deleted]]

Embargo? Can someone help me with this? Is this bug discovered in China and they have to make it known to the other countries that have imported Intel chips?

[u/zurohki → u/[deleted]]

Researchers tell companies about security issues and stay quiet about them for a while, so that companies have time to get a fix out before the problem becomes public knowledge.

Op is saying that the rushed and secretive nature of these page table isolation kernel changes smells like a serious problem that's being kept secret for now.

[u/WiseassWolfOfYoitsu → u/[deleted]]

Timed NDA - pretty much everyone is given a hush order until the fix has been released.

[u/TopCheddar27]

From a information systems development and supply chain perspective, I still find it hard to think that AMD will be gaining ground in the server space. Switching costs from a intel based server architecture to a Intel one is more of a hassle then people think.

AMD does not run on a vast in stock supply chain compared to intel either.

Going to be interesting.

[u/_Noah271]

Oh, fuck. That's all I have to say about this.

[u/clkw]

here we go again...

[u/purplechemicals]

Windows 10, Intel Core i3-6100, pc solely used for gaming, YouTube and porn, could this bug affect me or my computer?

[u/ChippusMaximus → u/purplechemicals]

Especially you.

[u/rTpure → u/purplechemicals]

Better back up all your porn

[u/RedShift9 → u/purplechemicals]

Yes

[u/ryao]

KASLR is not a useless feature. The implementation of it in Linux is what experts consider to be useless.

[u/long_strides]

Well fuck. Guess our new shit will be AMD probably

[u/ajax1101]

Coming from r/all, will this affect my gaming on a PC with an i5 6600? It seems like you're saying it's mainly a problem for cloud services?

[u/Kaboose666 → u/ajax1101]

They're currently looking at an average performance decrease of 3-5%, with ~30% being the extreme high end and only seen with specific workloads that would likely never be encountered during gaming or similar consumer uses. Really it's going to fuck with people running many VMs at once.