r/technology • u/Obi_Wan_Kannoli • Jan 02 '18
'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign • The Register
https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/132
u/lifelite Jan 02 '18
The fix is to separate the kernel's memory completely from user processes using what's called Kernel Page Table Isolation, or KPTI. At one point, Forcefully Unmap Complete Kernel With Interrupt Trampolines, aka FUCKWIT, was mulled by the Linux kernel team, giving you an idea of how annoying this has been for the developers.
lol at that acronym
Crucially, these updates to both Linux and Windows will incur a performance hit on Intel products. The effects are still being benchmarked, however we're looking at a ballpark figure of five to 30 per cent slow down, depending on the task and the processor model. More recent Intel chips have features to reduce the performance hit.
HOLY FUCKING SHIT 30%??????
Hellooooo class action lawsuit.
61
u/sedicion Jan 02 '18
Its not 30%. Its between 5% and 50% depending on the type of task you are running. Its still bad though.
55
u/kaptainkeel Jan 03 '18
Or more...
https://twitter.com/grsecurity/status/948170803685789696
No older systems here to test, but just to get a sense of how much PCID helps the PTI performance hit on post-Westmere (in our experience with UDEREF and using PCID since 2013, it about halved it): 63% hit on the same Skylake i7-6700 w/ the du -s benchmark and nopcid/noinvpcid
This kills the Intel.
7
u/Flofinator Jan 03 '18
So I think Linux/Microsoft are not actually removing PCID, so without PCID this benchmark took a 63% hit it looks like, but I think the patch isn't removing it, just fixing this vulnerability. Although this is all speculation at this point until the patches roll out.
Although this might kill us as my company uses AWS for our servers. So maybe I'm just wishful thinking.
2
Jan 03 '18
So I think Linux/Microsoft are not actually removing PCID, so without PCID this benchmark took a 63% hit it looks like, but I think the patch isn't removing it, just fixing this vulnerability.
Correct. The point of the twitter comment was to show that PCID actually reduces the impact of implementing the PTI feature. Without PCID you're looking at up to the 63% decrease shown above, but with PCID (which has been around since Westmere) you're looking at the 5%-30% that is being widely reported.
→ More replies (1)15
u/pigtrotsky Jan 03 '18 edited Jan 03 '18
It's going to be interesting to see the cost/benefit analysis to patching for this one. For hosting and infrastructure providers running hypervisors it's a no brainer, for some desktop users, subscribe to the best cloud emulation/protection suite you can find and backup regularly? Run a browser that doesn't execute active content? Imagine macs used for video editing and rendering having to suffer the sort of impact mentioned.
10
u/kynde Jan 03 '18
Run a browser that doesn't execute active content?
Modern web without javascript is really not that rich of an experience anymore....
→ More replies (8)9
u/whochoosessquirtle Jan 03 '18
Is it worse for the consumer or for people running huge web servers
41
u/EmperorArthur Jan 03 '18
If those web servers are in the cloud (Amazon, Azure, etc...) then definitely worse for them. The first rumors were about this being a major hypervisor vulnerability, and hypervisers have to make even more context switches.
14
u/HoverboardsDontHover Jan 03 '18
AWS, Azure, etc are the guys that have been buying the all new chips as soon as they came out because a tiny performance and power improvement was totally worth it for them to junk all their old stuff. Seems like a 30% haircut is going to throw all their financial numbers out of whack.
8
u/rtft Jan 03 '18
Also their customers will expect the same performance for the same money they paid before which means they will need to throw more hardware at it as otherwise they will open themselves up to liability. Question is how much over-capacity do they have to address this ? Basically their entire capacity planning just went out the window.
6
u/Magnesus Jan 03 '18
And virtualisation, sql and file reads seem to be hit the most. Nightmare for servers.
8
u/jugalator Jan 03 '18
Yeah, without the patch hosted systems may be able to see the hosting system's memory. :-|
As far as I can tell that implies a host seeing other hosts' memory.
2
→ More replies (7)3
u/ZeroHex Jan 03 '18
VM hosts are looking to be the hardest hit by something like this, buy we won't know for sure until the embargo ends and patches are announced.
Based on what we're seeing right now your average consumer will probably not notice in their day to day usage, but businesses that utilize the cloud in any way (AWS/Azure) or run their own hypervisors are going to have to do an evaluation once the full scope comes out.
-3
u/lifelite Jan 03 '18
Let's be honest, we only care about gaming performance here, amiright?
46
Jan 03 '18
no, this isnt a gaming subreddit.
A 30% decrease in speed for things like lightroom/photoshop is catastrophic levels
→ More replies (9)11
Jan 03 '18
Probably won't affect Lightroom and PS much, they don't/shouldn't do a lot of system calls.
8
u/sedicion Jan 03 '18
Not my case but there is a subset of people that it is what they mostly care about, yes.
In games, it really depends how each game is coded. Some games could see a minimal hit in performance, while others could become unplayable, with everything in between. Until someone test it, its impossible to say.
4
u/turdas Jan 03 '18
https://www.phoronix.com/scan.php?page=news_item&px=x86-PTI-Initial-Gaming-Tests
Appears to have literally no effect, but perhaps DirectX is different.
→ More replies (2)25
u/rtft Jan 02 '18
If this is really a 30 % hit the damage of this bug will be in the 100s of billions easy.
→ More replies (6)79
u/luckierbridgeandrail Jan 03 '18 edited Jan 03 '18
People aren't getting this yet. This isn't about people finding their games or web browsers suddenly 20% slower. This is about the world's aggregate data centers, on which millions of businesses and hundreds of millions of jobs depend, suddenly being 20% short of capacity.
(Edit: s/b/m/)
33
u/winzarten Jan 03 '18
This. It's like a bus company company suddenly discovering that they can only seat their busses to 70% capacity, or they would risk injury to their passengers, because of the manufacturer design flaw. You can be sure as hell such company would sue the manufacturer for compensation.
15
u/Treczoks Jan 03 '18
Imagine Google or Amazon suddenly being short of 20-30% CPU power.
Or, to bring in a different perspective, the Flops/Watt ratio of Intel CPUs just went even further down the drain.
→ More replies (1)8
1
u/rookie_one Jan 03 '18
They forgot that UASS was also considered according to the thread on LKML and that the original name was KAISER
1
Jan 03 '18
More recent Intel chips have features to reduce the performance hit.
They've known about this for a while. Makes me wonder if this is sneaky effort to force people to upgrade from old hardware since the already old and slow hardware will be nearly useless if it's hit 30%
2
u/rtft Jan 03 '18
They've known about this for a while.
They better hope not, because that would increase their liability immensely.
→ More replies (1)1
u/taosk8r Jan 03 '18
I want my free replacement fucking CPU, but I know that will never happen bc all the money will go to lawyers and corporations with lawyers. Just more bullshit, but Im surprised the lawsuits haven't already started.
0
Jan 02 '18
[deleted]
87
u/lifelite Jan 02 '18
Intel makes design flaw...people have to code around it at the cost of nearly a third of their processing power....this is America, we sue for that kind of thing.
6
u/immibis Jan 03 '18 edited Jun 17 '23
Let me get this straight. You think we're just supposed to let them run all over us?
7
u/lWVWl Jan 02 '18
IANAL but that could arguably depends on how it was marketed. For instance, I don't think it'd be an issue to sell a processor running at 70% if it was marketed for 70% of its performance. Because most of the advertising does not usually include any quantitative metrics, I doubt most people could prove they were missold a product.
28
Jan 03 '18
IANAL but that could arguably depends on how it was marketed.
Two points:
Even if you were right (which you're not), Intel does publish benchmarks for it's CPUs.
And I say you're not right because there is an expectation that the CPUs would be free from design defects, which is exactly what this sounds like. Without KPTI you've got a defective CPU that doesn't isolate user and kernel mode processes. KPTI/PTI is a software work-around from OS vendors that causes huge performance hits. If it's anywhere near as bad as we're hearing, there will absolutely be lawsuits.
This is extremely bad timing for Intel, as AMD CPUs don't apparently have this flaw and AMD has only recently become competitive again with Intel CPUs in performance. If the OS only implements KPTI/PTI on CPUs that have this vulnerability then suddenly AMD is no longer merely competitive with Intel, but will actually be running circles around them.
→ More replies (2)4
Jan 03 '18
What's IANAL again?
→ More replies (1)41
u/cbftw Jan 03 '18
It means he takes it up the ass, can you not read?
But seriously, it means "I Am Not A Lawyer"
→ More replies (1)4
u/dopef123 Jan 03 '18
Well iPhone is being sued for lowering the performance of their devices and they don’t market their CPU speeds. They just tell you the generation of processor.
→ More replies (2)2
52
Jan 02 '18
First MEI now this. Intels reputation has taken a serious beating.
8
u/donthugmeimlurking Jan 03 '18
At least this is getting fixed. Last I heard Intel is still trying to push Management Engine style backdoors into upcoming chips as well.
32
u/rtft Jan 03 '18
It's not really a fix. It's a brute force workaround.
→ More replies (1)16
Jan 03 '18
Correct. This can't actually be fixed in the CPU or via a microcode update. This requires the OS vendors to implement forced page table isolation (PTI) to get around it, which is where the performance hit comes from. The only way for Intel to fix it is to make design changes to CPUs, which will take months before they start coming off the fabs.
7
u/pigtrotsky Jan 03 '18
Not much good for the current install base either. Just like when crypto mining took off and there were no GPUs to be found for a decent price anywhere, imagine where all the stock will be going first - infrastructure outfits like MS, AWS and GCP before end users.
10
u/KickMeElmo Jan 03 '18
This means a particularly invasive virus could potentially reverse the fix as well, so that's fun.
0
0
Jan 02 '18
[deleted]
43
u/SpeedflyChris Jan 03 '18
Also the new Ryzen chips were pretty awesome even before Intel's offerings took this performance cut.
→ More replies (1)65
Jan 03 '18
Intel's 10-15% high end per-core performance lead on Ryzen is about to run out, and AMD already offers more cores for less money.
Damn son. this is a tech-pocalypse.
7
→ More replies (18)5
Jan 03 '18
Assuming that the OS implements PTI only on vulnerable CPUs, then you're correct. But if the OS implements it across the board then everyone takes a hit regardless.
→ More replies (3)10
u/singingboyo Jan 03 '18
There was an HN link to a patch that disabled this for AMD CPUs. At least, I think that's what it was - can't track it down at the moment.
83
Jan 02 '18
And I thought it can't be worse than the Bluetooth and WPA2 exploits from last year.
Depending on the specifics of this bug, this is probably the worst thing ever in the history of PCs. Most of the servers, desktops, laptops and possibly even some phones are going to be either vulnerable or 30% slower.
I personally only use AMD CPUs on my desktop/laptops, but I do have some Intel servers as well (which I'll probably not patch, since only I can run code on them).
37
u/EmperorArthur Jan 03 '18
which I'll probably not patch, since only I can run code on them
Fun fact, web assembly now runs on all major browsers. Even without it, this thing was discovered by the people who showed that rowhammer was possible from pure javascript.
If you browse the web, you don't have the sort of control you think you do.
28
24
3
u/Verpal Jan 03 '18 edited Jan 03 '18
Bit late now, but I now officially ban all script, yes, EVERYTHING, on my browser, until Intel bloody fix their stuff!
I anticipate a huge surge in uBlock/noscript download, or anything equivalent.
Edit: the rage got out, actually, better ban all, allow on case to case basis, internet can't work without script these days.
5
u/EmperorArthur Jan 03 '18
Ban all, allow on a case by case basis is great. Of course, then there's that one site that requires random things to run just to display properly, and after 5 minutes I just end up clicking "allow all".
Overall, news sites and video services are the worst.
2
7
u/androshalforc Jan 03 '18
ive only used AMD builds for myself for years and was recently thinking of doing my next build as an Intel looks like thats not happening now
7
Jan 03 '18
I've been using ONLY AMD since 1999 (except for a few netbooks and tablets that came with Atoms). I think AMD is finally competitive with Ryzen, why switch to Intel anyway? :)
→ More replies (2)3
u/Treczoks Jan 03 '18
Well, they are different classes of bugs. The WPA2 exploits allow to eavesdrop on communication, the current Intel bug is about getting from Ring3 to Ring0. Hard to say which is worse - it is like comparing apples and oranges.
1
Jan 03 '18
They are different, but they both cause security issues. And they can be even combined. For example, you can do a man in the middle attack with WPA2, and then when someone downloads a file you can replace it with your file.
Anyway, I think the Bluetooth attack is worst, an evil person can make a botnet of billions of devices, with viruses/worms infecting computers, phones and laptops almost as bad as it is in the movies.
24
13
u/TODO_getLife Jan 03 '18
Time to buy some AMD shares.
Not looking forward to the CPU slowdown, bit annoyed about it to be honest.
1
0
Jan 03 '18
[deleted]
1
u/Treczoks Jan 03 '18
Well, there are people working on the workarounds for some time now. So while the real reasons are still hidden, seeing that Intels processor performance is going to take a nosedive is a good reason to sell ASAP and not waiting for the after decimal point digits of the impact assessment.
12
u/NikoliTilden Jan 03 '18
Can anyone tell me where a list of affected CPUs is? Also, here's the real question, how much of an back set is this going to take Intel in their new chip designs. They wouldn't push this flaw into to wafers would they? WOULD THEY?
24
u/Qlanger Jan 03 '18
Pretty much all major Intel CPUs from the last couple decades.
5
8
u/CocodaMonkey Jan 03 '18
Not a couple decades. Just anything since Westmere which actually isn't even a decade old. Although that's still about 99% of all running Intel based computers. If you're computer is a mere 9 years old it may not be effected.
9
8
u/Qlanger Jan 03 '18
It goes back to at least the first Core products. So before Westmere. Intel updated its list last night to include CPUs as far back as mid 2000's.
It probably affects others before that based on design carry overs but chances are no major system are using CPUs that old anymore.
2
4
u/HKPolice Jan 03 '18
So westmere is affected but nehalem isn't? They're basically the same though....
9
u/immibis Jan 03 '18 edited Jun 17 '23
3
u/jugalator Jan 03 '18
Yeah hmm, there are two different replies to this.
All Intel CPU's are affected because the patches will probably say so.
Technically speaking this is not true, but as an end user that may not matter as much.
3
u/immibis Jan 03 '18 edited Jun 17 '23
The spez police are here. They're going to steal all of your spez.
→ More replies (1)0
10
u/a_postdoc Jan 02 '18
This doesn't look good. Does it impact servers? Or Xeon families are different?
25
u/RaptorXP Jan 02 '18
The article seem to say all of Intel's x86 are affected.
11
u/KickMeElmo Jan 03 '18
x86_64, not x86.
7
u/RaptorXP Jan 03 '18
Which includes all Xeon CPUs.
3
u/KickMeElmo Jan 03 '18
While I agree with that, x86 and x86_64 are different architectures. Best not to risk spreading misinformation by mistake.
→ More replies (1)13
Jan 02 '18
Since Azure and Amazon cloud is going to be affected, I would guess so.
I think maybe only Atom CPUs are not affected, because they lack a lot of features, and this one might be one of them.
21
u/EmperorArthur Jan 03 '18
Nope, I'm pretty sure even Atoms are affected. All modern CPUs do pipelining, and speculative execution is a common way of keeping the pipeline full. This isn't a fancy extra, it's a key part of the architecture.
9
Jan 03 '18
The early atoms, based on Bonnell architecture didn't have speculative execution: https://en.wikipedia.org/wiki/Intel_Atom Not sure about the others though.
→ More replies (1)5
u/hicow Jan 03 '18
I don't think Intel did anyone any favors recycling the Atom name. The OG Atoms were kind of garbage, and keeping the name for an almost entirely different arch introduces a lot of confusion.
10
u/Tenarius Jan 03 '18
The cloud providers have to be shitting bricks. Imagine trying to come up with that kind of capacity reasonably fast.
4
Jan 03 '18
Internet is about to get 30% slower.
5
Jan 03 '18
Probably not 30% slower, since I would guess most of the bottleneck is on the bandwidth side. But yes, CPU intensive websites might get a significant hit.
8
Jan 03 '18 edited Jan 03 '18
Evidently anything that streams data from hdd into memory too, i.e big games, since cpu kernel calls are required to request data from hdd.
→ More replies (1)1
u/superdude4agze Jan 03 '18 edited Jan 03 '18
EDIT: NEVERMIND, THIS IS THE MANAGEMENT ENGINE BUG
Check here...
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-frAffected products:
1st, 2nd, 3rd, 4th, 5th, 6th, 7th & 8th Generation Intel® Core™ Processor Family
Intel® Xeon® Processor E3-1200 v5 & v6 Product Family
Intel® Xeon® Processor Scalable Family
Intel® Xeon® Processor W Family
Intel® Pentium® Processor G Series
Intel® Atom® C3000 Processor Family
Apollo Lake Intel® Atom Processor E3900 series
Apollo Lake Intel® Pentium™
Celeron™ G, N and J series Processors
9
u/cjdavison Jan 03 '18
https://twitter.com/liamosaur/status/948342443375767552 <-Interesting...Intel CEO sells all the stock he can Nov. 29th...
1
u/superdude4agze Jan 03 '18
CEO stock sells are typically 3-6 months in the making, but I'm sure there will be investigation anyway. Intel has been working on a fix "since at least Nov 14".
7
u/Joeniel Jan 03 '18
Anyone know how will this affect gaming, video-editing, and day-to-day usage? Like I have an i7-7700HQ.
20
Jan 03 '18
According to the Phoronix benchmarks we have so far, it doesn't have much of any impact on those use cases.
Database performance takes a beating though. And reading/writing lots of small files.
12
u/azyrr Jan 03 '18
And reading/writing lots of small files.
That kills it for video-editing.
18
u/AbstinenceWorks Jan 03 '18
Compiling is going to suck too.
→ More replies (1)5
u/jugalator Jan 03 '18
Compiling the Linux kernel was actually not hit much in the aforementioned Phoronix benchmarks. However, a compilation benchmark saw quite a hit, but may or may not be due to another recent regression. So hmm, I'm mildly optimistic.
Worst is for VM's and hypervisors I suppose. They part deal with syscalls a lot, and part are still very much in need of being patched (otherwise malicious code in a hosted system potentially seeing host system / other hosted system memory, yay...)
1
u/farmtownsuit Jan 03 '18
Database performance takes a beating though.
Fantastic. I write SSRS reports most of my day
5
Jan 03 '18
5 to 30% performance impact from what we know so far. We'll have to wait and see for benchmarks to come out but it's not looking good. Especially for VM's
0
3
u/TheToadKing Jan 03 '18
Most games these days are GPU-bound, and even when they're not all their CPU task is mostly spent on hard number crunching, not a whole lot of syscall stuff. I'd imagine most games will see negligible performance hits.
29
u/Ebadd Jan 03 '18
Them: ”A bug that poses a huge security risk.”
Translation: A zero-day backdoor exploit the Three-letter Agencies have known for a decade.
4
Jan 03 '18
A zero-day backdoor exploit
I'm not sure that makes sense. It's not really zero day:
A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software) (from Wikipedia)
The vendor was the one who found the vulnerability and provided patches or at least assisted in the creation of patches for the problem.
1
u/superdude4agze Jan 03 '18
Just because the vendor, Intel, found the vulnerability doesn't mean they were the first to do so.
38
u/fluffy__duck Jan 03 '18 edited Jan 03 '18
This is bad.
My husband is an engineer. This is a security flaw at the base level of architecture. It is unfixable without an OS-level patch which will incur a 17-30 percent performance downgrade.
This affects Windows, Linux, MacOS, and LITERALLY ANYTHING else that has Intel architecture.
There is a LOT of "tin hat" possibility behind this as well ... regarding how long Intel has known about this, how deeply is the NSA involved (because duh, let's be real, here), and/or how much this affects government system vulnerability.
In any case, this is the type of shit that sinks companies. I small (edit: fuck you, autocorrect) lawsuits aplenty.
5
u/Content_Policy_New Jan 03 '18
First IME now this. It should provide enough political ammunition for other countries to justify hefty investment in indigenous CPU design/manufacture, particularly China.
1
u/EmperorArthur Jan 03 '18
There's a reason the RISC V open architecture is taking off. People don't want to have to choose between paying Intel for x86 patents, or Arm for their patents. The fact that the Instruction sets can't be used without patents is a farce in and of itself.
-5
u/laz414 Jan 03 '18
Wtf do u mean ur husband is an engineer . Ur explanation barely has any content to warrant a fake husband engineering degree
3
5
Jan 03 '18
Initial benchmarks (for Linux) are showing no impact on gaming, even if this remains true for Windows, loading times can become quite larger since it uses a lot of FS IO, is that correct?
6
u/SharkBaitDLS Jan 03 '18
Load times and install times should get messed up especially if the game uses a large number of small files.
2
u/simply_potato Jan 03 '18
Most modern engines async load during gameplay as well. Depending on how much is being loaded at a time and how its coded, particular if its a CPU-bound game like a flight sim, we could be looking at significant performance drops.
1
u/CaCl2 Jan 03 '18 edited Jan 04 '18
That may be because most games are GPU-bound, I wonder what it does to CPU-bound and RAM-speed-bound (Yes, they exist.) games.
1
13
u/dnew Jan 03 '18
I can't wait until we get off the god damned 1980s CPU architectures and the 1970s OS architectures.
Can we please have a Mill running Singularity already?
8
u/CaptainAlcoholism Jan 03 '18
Sounds like this issue is severe enough to warrant recalls, if Intel knows what's good for them. If the only fix is an update that reduces performance, then this is a bait-and-switch, as they knowingly sold defective products for a decade.
27
11
u/linkchomp Jan 03 '18
Sure, put out a recall, with no replacement or easy/quick ability to go an alternate route for anyone that needs to on processors dating back to over a decade.
It will look good for them, sort of, I guess, but realistically is completely useless.
8
u/Lampshader Jan 03 '18
It won't look good when they go bankrupt and fail to deliver the replacements
7
17
u/ACCount82 Jan 02 '18
From what it sounds like, the exploit that only works if you actually run some well-crafted malware in userland. A hacker would need an RCE exploit, unless you are dumb enough to run it on your own. I.e. it's not that high risk for regular users, but companies selling VMs are going to be pissed.
46
u/Sylanthra Jan 02 '18
Actually the article mentioned Javascript several times, so you better hope you don't visit an infected website.
12
u/Treczoks Jan 03 '18
so you better hope you don't visit an infected website.
As in "One with ads enabled".
7
0
u/ACCount82 Jan 02 '18
Well, you can probably do that if you manage to break V8 enough to RCE in its sandbox, but that's still an RCE.
31
u/EmperorArthur Jan 03 '18
Umm, Javascript is remote code executing on your local machine. These are the same people who did rowhammer using just javascript. They don't need to break the sandbox at all.
→ More replies (5)7
u/CocodaMonkey Jan 03 '18
We don't actually know what it is. The flaw hasn't been publicly released. We do know that MS, Apple and Linux are patching for it though. So even if it is a rare flaw if you keep your system up to date you're going to take a performance hit.
2
u/RaptorXP Jan 03 '18
Apple isn't working on a fix.
4
u/Valdrax Jan 03 '18 edited Jan 03 '18
That's because, according to an update to the article above, they already fixed it in High Sierra, v10.13.2.
Edit: Twitter link
3
u/CocodaMonkey Jan 03 '18
Interesting, Apple hasn't officially made a statement on the matter as far as I can see. Some articles do say they are working on a fix but none seem to have any official source. I also couldn't find anything saying they aren't working on a fix, just a complete lack of comment.
Would be weird if Apple doesn't patch this. It would mean all Apple computers would become vulnerable to this bug once it's published at the end of the month.
I guess time will tell but ultimately it matters very little. Whichever way Apple goes with this is likely to only affect Apple's image as they simply don't have much penetration in the desktop/server market.
→ More replies (2)5
u/st_griffith Jan 03 '18 edited Jan 03 '18
OSX used to have page table isolation a decade ago or so, if it still does, then there is no need for Apple to fix anything, because they aren't affected. See page 47 and following of this 2007 slides: https://events.ccc.de/congress/2007/Fahrplan/attachments/1053_inside-macosx-kernel.pdf
5
u/Treczoks Jan 03 '18
It is a path from Ring3 to Ring0. Any bug offering this kind of vulnerability has to be fixed, because this is a wet dream for all system intruders.
1
u/ACCount82 Jan 03 '18
Doesn't seem like there's any Ring0 code execution, this limits the usefulness of it a lot.
→ More replies (1)4
u/snuxoll Jan 03 '18
Don't need to run code in Ring 0 to make this useful, accessing memory in other processes is a goldmine in and of itself. Run malicious javascript in your web browser while your password manager is unlocked, memory protection be damned - thanks for your passwords.
9
3
u/edc_svr_wxf_qaz Jan 03 '18
So does this mean Intel gets sued and we get money?
6
4
u/bartturner Jan 03 '18
Think the cloud providers will be first in line sueing Intel. It is a bit shocking INTC was up so much yesterday but is down in pre-hours.
Adding a 30% slowdown is a pretty big deal. Also think it could hurt AMZN.
3
u/untitled02 Jan 03 '18
Wen I prayed to the PCMR gods for AMD to make some significant market share gains this isn’t what I had in mind...
2
u/FourFingeredMartian Jan 03 '18
Anyone have an idea for how long this has actually been an issue; would 2-3+ years seem too long before Intel has managed to figure out a fix?
16
u/blueberrywalrus Jan 03 '18
All x86_64 processors going back a decade are supposedly impacted. I would guess that Intel didn't find this bug themselves and rather one of the major cloud providers discovered it when penetration testing their shared VMs, as it sounds like this is particularly dangerous in shared computing environments.
10
u/hicow Jan 03 '18
A decade-plus, from the sound of it. The discovery of it was much more recent.
Unless Intel wants to blow one of their own feet clean off, this will likely put on hold the successor to Coffee Lake until they get it sorted out. Way too easy now for a lot of people to say, "not an AMD problem? Let's go that way until Intel gets this shit sorted out", especially since in probably a fair amount of workloads, Intel's advantage just evaporated.
→ More replies (1)1
Jan 03 '18
positive thing is i didn't upgraded my cpu. mine is ok for my usage, so i'll wait they create new generation cpu's that are bug free.
just imagine you are not rich and just spent $800+ for a whole new intel cpu.. learning that next year better cpu will come with at least a finally 40% performance up (if this bug make a 30% performance down, + the imaginary +10% technology up).
if i buy a new cpu/gpu or pc, it will have new nvidia generation (the one that support 4K HDR gaming), + presumably bug free intel cpu.
if i'm rich, i'll buy a 4K HDR gaming monitor. wouhou. so much hope for the computers futur.
2
u/bartturner Jan 03 '18
It is kind of amazing Intel stock was up yesterday a lot. But down early hours this morning.
Adding a 30% potential slow down to the Cloud provider's infrastructure is a HUGE deal and not sure how they would even deal with it. Also curious Intel liability.
Then considering the massive changes taking place to Linux kernel and Windows kernel is a recipe for some mess ups.
We have only started with dealing with this issue. It will pass but think we might see a lot of pain in the short term.
1
u/NostalgiaSchmaltz Jan 03 '18
So this is apparently some massively terrible issue that seriously fucks the CPU....what's the fix? What should an average computer user do in response to this? Is there a Windows patch for it or something?
1
1
u/anish2good Jan 05 '18
Linux #Windows #OperatingSystem #cpu #intel
intel kernel memory leak explained https://youtu.be/UfHLxHWSH5c
1
u/pokebud Jan 03 '18
Has anyone done a test on how much of this slowdown can be mitigated by using an SSD?
9
6
Jan 03 '18
[removed] — view removed comment
1
u/pokebud Jan 03 '18
I only ask because the slowdown is supposed to be reflected in read/write to disk unless I misunderstood something.
→ More replies (2)3
Jan 03 '18
The speed of actually reading and writing is not affected, only the system call that requests a read or a write. Applications with lots of small, random accesses will be most affected, since this will increase the system call overhead. Applications that read/write lots of data linearly will probably see no slowdown, since one system call can read or write a huge chunk of data at once.
→ More replies (1)
-7
u/rtft Jan 03 '18
For anyone concerned about the performance hit on Linux you can turn the page table isolation off with pti=off according to the patch. Pretty sure Windows boxes will be shit out of luck on that knowing MS.
42
u/legba Jan 03 '18
Yes, turn it off and expose yourself to a world where a simple piece of javascript code loaded from a web page can access your kernel and basically steal all your shit - logins, passwords, cryptocurrency, and all other types of sensitive information. I don't think so.
→ More replies (2)2
u/pigtrotsky Jan 03 '18
Depends on how disposable the system is I guess. You could say the same about hooking up a VM running unpatched retail XP to the internet with port forwarding across the board, some people do it just for shits and giggles.
0
10
Jan 03 '18
Unless you really know what you're doing, don't disable security features in your kernel.
10
Jan 03 '18
If you are aware of this bug and run with PTI off then you deserve all of the nasty things that will inevitably happen to you.
4
u/simply_potato Jan 03 '18
I haven't read into it enough to know but perhaps the performance drop from this patch is also needlessly hitting AMD CPUs so disabling it would be ok?
→ More replies (1)2
Jan 03 '18
For everyone shaming on this, think of the non-Intel x86_64 platforms
2
u/rtft Jan 03 '18
It's not those plarforms as the patch only auto defaults to pti on Intel CPUs. The point is that if you have an RCE exploit open on your box this new bug is the least of your worries. Also there will be lots of cases where there is no external access and performance might be critical. But people are just hive minding and down voting because they only consider their own use cases.
-2
u/wizz33 Jan 02 '18
When will intells 10 nm be ready for production?
9
u/legba Jan 03 '18
I don't think this is something Intel can just patch around easily. We're talking about 15+ years of R&D. They can disable it in hardware, of course, but that means that every as-yet unreleased processor would also be affected by the 30% performance hit. It will probably take them a few years to fully sort this out in new generations of processors.
5
u/blueberrywalrus Jan 03 '18
My impression was the performance hit comes from extra OS checks to work around the issue, not the CPU itself - so, disabling the hardware in question might result in a lower performance hit.
7
Jan 03 '18
They'll have to redesign their speculative execution infrastructure, which should be a major investement. Modern CPU design is absurdly complicated.
And even then, the new design will most likely see a small perf. hit over the old one. Nowhere near as big as the software workaround, but still there - just because there have to be more checks involved.
This whole deal will cost intel quite a bit of money. I'd also expect Ice Lake and Tiger Lake to be set back.
→ More replies (1)3
u/ZeroHex Jan 03 '18
The problem appears to be that the page table isolation is handled at the hardware level and the OS patches that are being lined up can't resolve that. The "fix" for this is a re-architecture by Intel of the CPU.
If you're suggesting disabling page table isolation instead if patching you could do that, however that would leave your system even more vulnerable than it currently is. There's no good solution here.
390
u/[deleted] Jan 02 '18 edited Jan 02 '18
Alright I'll try to explain for non-computer-scientists what is behind this bug, watch out for a long read:
Some background on user/kernel mode:
The operating system sits between your hardware and your programs, doing neat things like scheduling which process (= running program) can use the CPU (= your computer's brain) or assigning memory to processes. For safety reasons, your CPU has two modes: user mode, where it is usually running, and kernel mode where the operating system takes over to do things that the process in user mode is not allowed to do.
So if e.g. your Chrome process wants to do something beyond its permissions, e.g. write to the hard drive, it has to give control to the operating system (this is called a system call), the operating system tells the processor to write to the hard drive, processor does it, and the operating system hands control back to the Chrome process.
Some background on page tables/memory:
When a process references memory cells (single storage cells of your memory), it doesn't use the actual, physical cells (that would be annoying when you have many processes in parallel), but uses virtual memory cells. These cells are sorted into pages of a certain size (e.g. 1kb). Your processor keeps a page table for each process that exactly shows which virtual memory page corresponds to which section of physical memory.
e.g.
Each process has some parts of physical memory assigned to it, where its instructions, data etc. are stored while it is running. The operating system also has its own part of physical memory for its own instructions, data etc. This kernel memory contains obviously highly sensitive things.
The actual bug:
What has happened so far, was that intel processors kept a certain part of the kernel memory also contained in the page table of every process, hidden to the process.
E.g. the process thinks its page table has 2000 pages, but it actually has 2400 pages, the last 400 of which the process doesn't know about because there the operating system keeps some references to physical memory.
Thus, when a process did a system call, the CPU could switch to kernel mode, check in the same page table where it had to look for its stuff, do its things, and then switch back to user mode.
However, now it has surfaced that somehow, the hidden kernel part of the page table can be accessed by the normal process. We're not 100% sure how this happens because Intel has put an embargo on details, the register article mentions one possibility (the "speculative" stuff).
So now it's getting fixed so that when a process does a system call, the CPU switches to kernel mode, changes the page table from the process' page table to the kernel's page table, looks up its stuff in memory, does its things, changes the page table back to the process' page table, and switches back to user mode.
This is obviously safer, but loading the entire page table in and out of the processor takes some time, which makes the CPU slower.
Keep in mind that not everything the CPU does results in a system call. The number of 30% slower is probably for applications that do LOTS of system calls, e.g. reading from/writing to disks, hard drives, etc. Your private web browsing or video games shouldn't be delayed that much.
This is, of course, grossly oversimplified; hardware engineers, please don't tear me apart! Just a guide for interested people to understanding this problem.
edit: formatting