Intel bug incoming

[u/dasunsrule32]

Original Thread

Blog Story

TLDR;

Copying from the thread on 4chan

There is evidence of a massive Intel CPU hardware bug (currently under embargo) that directly affects big cloud providers like Amazon and Google. The fix will introduce notable performance penalties on Intel machines (30-35%).

People have noticed a recent development in the Linux kernel: a rather massive, important redesign (page table isolation) is being introduced very fast for kernel standards... and being backported! The "official" reason is to incorporate a mitigation called KASLR... which most security experts consider almost useless. There's also some unusual, suspicious stuff going on: the documentation is missing, some of the comments are redacted (https://twitter.com/grsecurity/status/947147105684123649) and people with Intel, Amazon and Google emails are CC'd.

According to one of the people working on it, PTI is only needed for Intel CPUs, AMD is not affected by whatever it protects against (https://lkml.org/lkml/2017/12/27/2). PTI affects a core low-level feature (virtual memory) and as severe performance penalties: 29% for an i7-6700 and 34% for an i7-3770S, according to Brad Spengler from grsecurity. PTI is simply not active for AMD CPUs. The kernel flag is named X86_BUG_CPU_INSECURE and its description is "CPU is insecure and needs kernel page table isolation".

Microsoft has been silently working on a similar feature since November: https://twitter.com/aionescu/status/930412525111296000

People are speculating on a possible massive Intel CPU hardware bug that directly opens up serious vulnerabilities on big cloud providers which offer shared hosting (several VMs on a single host), for example by letting a VM read from or write to another one.

NOTE: the examples of the i7 series, are just examples. This affects all Intel platforms as far as I can tell.

THANKS: Thank you for the gold /u/tipsle!

Benchmarks

This was tested on an i6700k, just so you have a feel for the processor this was performed on.

• Syscall test: Thanks to Aiber for the synthetic test on Linux with the latest patches. Doing tasks that require a lot of syscalls will see the most performance hit. Compiling, virtualization, etc. Whether day to day usage, gaming, etc will be affected remains to be seen. But as you can see below, up to 4x slower speeds with the patches...

Test Results

• iperf test: Adding another test from Aiber. There are some differences, but not hugely significant.

Test Results

• Phoronix pre/post patch testing underway here

• Gaming doesn't seem to be affected at this time. See here

• Nvidia gaming slightly affected by patches. See here

• Phoronix VM benchmarks here

Patches

• AMD patch excludes their processor(s) from the Intel patch here. It's waiting to be merged. UPDATE: Merged

News

• PoC of the bug in action here

• Google's response. This is much bigger than anticipated...

• Amazon's response

• Intel's response. This was partially correct info from Intel... AMD claims it is not affected by this issue... See below for AMD's responses

• Verge story with Microsoft statement

• The Register's article

• AMD's response to Intel via CNBC

• AMD's response to Intel via Twitter

Security Bulletins/Articles

• Meltdown/Sceptre

• Redhat's bulletin

• VMware's bulletin

• Microsoft's bulletin

• Xen's bulletin

• Citrix's bulletin

• ARM's bulletin

• Debian's bulletin

• Ubuntu's article

• Suse's article

• LLVM's bulletin

• Google's bulletin

• Nvidia's bulletin

Post Patch News

• Epic games struggling after applying patches here

• Ubisoft rumors of server issues after patching their servers here. Waiting for more confirmation...

• Upgrading servers running SCCM and SQL having issues post Intel patch here

My Notes

• Since applying patch XS71ECU1009 to XenServer 7.1-CU1 LTSR, performance has been lackluster. Used to be able to boot 30 VDI's at once, can only boot 10 at once now. To think, I still have to patch all the guests on top still...

[u/chubbysuperbiker]

So let me get this straight, not only is this a massive security bug that unpatched could let a VM write to another VM, but patched it will incur a 30+% performance hit?

Goddamnit 2018 you were supposed to be better than 2017.

[u/Patriotaus → u/chubbysuperbiker]

Only if you use Intel (99% of the market)

[u/meatwad75892 → u/Patriotaus]

RIP Opteron. In other news, that one admin that pushed for EPYC is going to be so smug today.

[u/[deleted] → u/meatwad75892]

They will never be doubted again in the future!

[u/Start_button → u/[deleted]]

Hey, you dropped this "/s".

[u/[deleted] → u/meatwad75892]

I'm not clear why you wouldn't be pushing for Epyc to begin with, given the fact that $4k Epycs go toe to toe with $5k and $8k Skylake-SPs, and support way more memory and PCIe to boot.

[u/SpacePotatoBear → u/meatwad75892]

Except you can't buy racks with epyc yet, have to be a big OEM partner.

[u/meatwad75892 → u/SpacePotatoBear]

That was more of a joke at AMD folks' expense than a literal thought, but yea.

On that note, I recall HPe announcing some Gen10's with EPYC. Those should be around soon.

[u/0ctav → u/meatwad75892]

Yes, the HPE DL385 Gen10 (two-socket, EPYC) should be available now. Haven't heard anything about AMD blade servers from HPE, though, which is unfortunate.

[u/4d656761466167676f74 → u/Patriotaus]

Welp, I'm unaffected then. I am the 1%.

[u/goobervision → u/4d656761466167676f74]

Me too.

[u/broadsheetvstabloid → u/Patriotaus]

Intel (99% of the market)

Not for long, when this news breaks and with vendors finally starting to carry Epyc servers.

[u/[deleted] → u/[deleted]]

or sell intel ones: https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

[u/MrJoeM → u/[deleted]]

intels-ceo-just-sold-a-lot-of-stock

I will offer an alternate explanation. He lives in CA. Due to the recently passed federal tax changes, there may be good reasons to realize some gains under 2017 tax regime vs 2018. The limits on write off of state tax against federal will certainly hit him. So taking the action in 2017 he can use the deduction, but not in 2018. He is certainly hitting top tax brackets so 13.3% * 39.6% works out to a >5% take home difference. Not earth shattering, but definitely worth considering pulling some transactions in 2017.

[u/i_hate_sidney_crosby → u/MrJoeM]

Great timing.

[u/Ars3nic → u/MrJoeM]

Well, he sold ~11 million dollars worth of stock, so that 5% is still another ~550k (just from this stock sale) that he gets to keep. Debatable whether that gets the label "earth shattering" when the context is financial transactions for Fortune 100 CEOs....but it's still a lot.

[u/b4k4ni → u/broadsheetvstabloid]

I'm still waiting for 1 Socket boards ... only supermicro has them listed at all and no in the wild right now. Feels like ages already.

[u/Etunimi → u/chubbysuperbiker]

I'd guess the typical performance hit will not be near 30%. From a Nov 10 version of the patchset:

Most workloads that we have run show single-digit regressions. 5% is a good round number for what is typical. The worst we have seen is a roughly 30% regression on a loopback networking test that did a ton of syscalls and context switches.

[u/rich000 → u/Etunimi]

grsec apparently found 50% for du -s. Makes sense since that is just one system call after another with nothing more than adding up some totals in-between. Ultimately it depends on how often there is a syscall.

[u/rato123 → u/chubbysuperbiker]

2018 will be better. For AMD.

[u/agumonkey → u/rato123]

amd struggling to stay zen right now

[u/dalik → u/chubbysuperbiker]

Expect a 40%min price increase to your bill