Massive Intel bug regarding virtual memor

previous thread

There is evidence of a massive Intel CPU hardware bug (currently under embargo) that directly affects big cloud providers like Amazon and Google. The fix will introduce notable performance penalties on Intel machines (30-35%).

People have noticed a recent development in the Linux kernel: a rather massive, important redesign (page table isolation) is being introduced very fast for kernel standards... and being backported! The "official" reason is to incorporate a mitigation called KASLR... which most security experts consider almost useless. There's also some unusual, suspicious stuff going on: the documentation is missing, some of the comments are redacted (twitter.com/grsecurity/status/947147105684123649 (embed)

) and people with Intel, Amazon and Google emails are CC'd.

According to one of the people working on it, PTI is only needed for Intel CPUs, AMD is not affected by whatever it protects against (lkml.org/lkml/2017/12/27/2). PTI affects a core low-level feature (virtual memory) and has severe performance penalties: 29% for an i7-6700 and 34% for an i7-3770S, according to Brad Spengler from grsecurity. PTI is simply not active for AMD CPUs. The kernel flag is named X86_BUG_CPU_INSECURE and its description is "CPU is insecure and needs kernel page table isolation".

Microsoft has been silently working on a similar feature since November: twitter.com/aionescu/status/930412525111296000 (embed)

People are speculating on a possible massive Intel CPU hardware bug that directly opens up serious vulnerabilities on big cloud providers which offer shared hosting (several VMs on a single host), for example by letting a VM read from or write to another one.

fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

overclock.net/t/1645071/computerbase-intel-serious-vulnerability-speculation-in-all-cpus#post_26528208

TL;DR syscalls are being slowed by as much as 4x after the fix.

Other urls found in this thread:

intel.com/content/www/us/en/support/articles/000025619/software.html
lists.infradead.org/pipermail/linux-arm-kernel/2017-November/542751.html
phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2
foxbusiness.com/markets/2017/12/27/intel-corp-cancels-coffee-lake-x-gaming-chip.amp.html
lkml.org/lkml/2017/12/27/2
twitter.com/AnonBabble

Reminder that Brian Krzanich sold ~50% of his holdings in Intel leaving him with 250000 shares which is the contractually required minimum he can hold without losing his position as CEO.

Brian sold these shares mid December of 2017.

INTELDIOTS BTFO AHAHAHAHAHAHAHAHAH AH AH HAH AHHAHAH

>buy intel
>get hacked

Linux is an AMD shill, who would of thought?!
@64111635: nice try shill!!

More info here: intel.com/content/www/us/en/support/articles/000025619/software.html

Basically only vulnerable if you can flash the firmware. You can only do this with valid Intel management credentials. So its mostly a non issue.

>g4560
its already slow and this.. what the fuck intel.

IT ISN'T TRUE! THE BUG IS MADE UP LIES BY AMD RUSSIAN HACKERS!!!

Are you really surprised?

This has literally nothing to do with the issue in OP

You pajeetel shill, this is a SEPARATE problem from the PTI vulnerability.

In fact, this just shows how hilariously fucked intel is.

mfw we will witness the fall on Intel

That's the wrong completely devastating issue, baka.

>He doesn't actually know what intel ME is
lel

...

It is still under embargo retard, this is a different bug

Intel is:
[_] Finished
[_] Bankrupt
[X] FINISHED AND BANKRUPT

...

If this is bait, its fucking excellent

...

>Intel has so many vulnerabilities that shills can't even keep track of which one they're supposed to damage control at a given moment

totally nothing suspicious goin on here..nope.

Windows 10 users are now finally fucked with the automatic updates

>Syscall overhead roughly doubles
>Insignificant performance loss for most desktop applications, but VERY significant loss for syscall-heavy applications
>That includes GPU drivers
>Gaymers are going to flock to AMD because AMD doesn't nerf their GPU performance
>Intel's monopoly on desktop CPUs will collapse because entire segments of the market will refuse to use their CPUs
holy shit guys
this might be it

Windows 7/8 users are now finally fucked if they don't install the patch.

Time to buy cheap intel machines and just use them offline

Reminder that ARM Aarch64 is also fucked

>lists.infradead.org/pipermail/linux-arm-kernel/2017-November/542751.html
>The performance hit from this series isn't as bad as I feared: things like cyclictest and kernbench seem to be largely unaffected, although syscall micro-benchmarks appear to show that syscall overhead is roughly doubled, and this has an impact on things like hackbench which exhibits a ~10% hit due to its heavy context-switching.

People are better off with a slower system than a vulnerable one in this case.

>doubles
Potentially quadruples, I think, judging by the dude on /r/sysadmin.

> November
Wtf?
Does that mean it's already known that long?

This vulnerability is very severe. It has to be patched

That's before they figured out that AMD is not affected.

ARM

AMD =/= ARM

That's when Intel's CEO sold his stocks, so clearly.

Let's summarize guys
>diversity
>shitty yields
>constantly delayed 10 nm process
>foreskin thermal paste instead of solder in the ihs
>even in their fucking xeons
>netburst 2.0 like temps
>unscallable ringbus
>massive thermal infernos in their i9 processors
>that let the PowerPC 970 and the fucking 9590 like a winter look like a candle in the fucking Minnesota
>now this horrible bug that will hamper at least 30% of the performance
AMD did nothing and its winning this year.
Hell, even they will a FX renaissance.

>all that green

>@

>>that let the PowerPC 970 and the 9590 look like a cande flame in the fucking Minnesota's winter
FTFM.

They've been working on this from at least early 2017 but it turned into a serious push near the end of the year.

I think there's been studies about exploiting speculative execution feature for even longer time.

Phoronix has done benchmarks with the fix in:
phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2

IT DOESN'T AFFECT NEHALEM
IT DOESN'T AFFECT NEHALEM
IT DOESN'T AFFECT NEHALEM
MY I7 920 FINE

You forgot how they blew lots of cash on failed Atoms in smartphone and tablets, the bricked Atoms C2000, and several remotely-exploitable Management Engine bugs.

guys guys what if this is a plot to make people buy ryzen

don't believe this news until theres hard proof aka a patch and benchmarks before&after. DONT FALL FOR THIS

AAAAAAAAAAAAAAAAAAAAAAHHHHHHHHHHHHHHHHHHHHHH everyone running a DB or network centric application on Intel is screwed!

Intel stock will drop 20% by the end of Q1 2018. Screenshot this.
>Intel Corporation Common Stock Real Time Stock Quotes
>$47.30

Time to spend all my spare 3000 usd to buy some AMD stocks.

so there is no point in these threads until the update hits and we see if there is any difference at all

phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2

>that hit to storage access on the SSD
Oh boy.

>Intel stock will drop 20% by the end of Q1 2018.
Not just their stock, but also their performance.

Sauce please.

holy fuck!

...

Go back to Twitter, kid

Guess we know how they achieved their "single-threaded" performance now.

Feels good to use a secure CPU.

on a secure os!

what about BSD?
any relevant patches anyone?

Dude that's nothing, have you seen the I/O performance? OVER 50% SLOWER, fucking insane, this is going to be a fatal blow to Intel.

Welp, looks like it might finally be the end of my 2500K.

It was fun while it lasted.

Goodbye, old friend.

...

Optane is fucking dead now.

you are forgetting about most motherboard vendors whom haven't even patched all their system affected by the intel management engine bug.
"intel management engine bug" has a good sound to it, given current events, brian is probably the exploit that management engine

Include me in the meme screenshot

I wonder how Intel will advertise their next couple generation when they fixed the bug and can't use this speculative execution anymore to improve IPC.

New Intel core i9-9870k with -10% IPC
Kek

THEY SAID IT'S WESTMERE ONWARD

I'll upgrade to some minimal distro and make an imageboard, like that dude some days ago

>OPTANE NVDIMMS STILL NOT AVAILABLE
OPTANE NVDIMMS STILL NOT AVAILABLE
>OPTANE NVDIMMS STILL NOT AVAILABLE
OPTANE NVDIMMS STILL NOT AVAILABLE
>OPTANE NVDIMMS STILL NOT AVAILABLE
OPTANE NVDIMMS STILL NOT AVAILABLE
>OPTANE NVDIMMS STILL NOT AVAILABLE
OPTANE NVDIMMS STILL NOT AVAILABLE
I summon Charlie.

I need to fucking short intel

...

However, it may be that the vulnerability in Intel's chips is worse than the above
mitigation bypass. In an email to the Linux kernel mailing list over Christmas, AMD
said it is not affected. The wording of that message, though, rather gives the game
away as to what the underlying cockup is:

>AMD processors are not subject to the types of attacks that the kernel page
>table isolation feature protects against. The AMD microarchitecture does not
>allow memory references, including speculative references, that access higher
>privileged data when running in a lesser privileged mode when that access
>would result in a page fault.

A key word here is "speculative." Modern processors, like Intel's, perform speculative
execution. In order to keep their internal pipelines primed with instructions to perform,
the CPU cores try their best to guess what code is going to be run next, fetch it, and
execute it.
It appears, from what AMD software engineer Tom Lendacky was suggesting above,
that Intel's CPUs speculatively execute code potentially without performing security
checks. It seems it may be possible to craft software in such a way that the processor
starts executing an instruction that would normally be blocked – such as reading
kernel memory from user mode – and completes that instruction before the privilege
level check occurs.
That would allow ring-3-level user code to read ring-0-level kernel data.

If I'm not running VMs is there any reason why I would be affected by this update?

>Intel's low-powered Bonnell microarchitecture employed in early Atom processor cores also uses an in-order dual pipeline similar to P5

Why would you buy anything now wait for black friday

Yes. This flaw has nothing to do with virtualization.

Depends, is your CPU Intel and running OS?

Depends on what you do and how utilized your processor currently is.

>If I'm not running VMs is there any reason why I would be affected by this update?

The defacto loss (I can read your keys yo) of all privilege separation on all OSs.

FreeBSD is being patched as well.

There's already a patch and benchmarks. Just not from news sites.

Everything is fine if it can't go below ring 0

VMs ≠ Virtual Memory. Affects all CPUS.

...

...

INTEL IS BANKRUPT AND FINISHED
HOW WILL INTELLETS EVER RECOVER?

foxbusiness.com/markets/2017/12/27/intel-corp-cancels-coffee-lake-x-gaming-chip.amp.html

Intel is literally going to collapse.

If I run a host with VMs, do I only have to patch the host OS or the VMs, too?

As a more or less computer illiterate retard, what does this mean for my computer?

>Otellini
Fuck you, at least he was competent enough to not let shit like this happen.
I miss him. ;_;

5-30% performance hit in a few cases.

It will get slower if you install windows updates
If you don't then your system has virtually no security any more

If you like your computer, then you can keep your computer.

If I apply the patch? I haven't used windows update since mid '16.

Both.

Time to turn off windows updates for good

54% slower IO speed on NVME samsung 950 with a i7 8700k First graph

phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2

lkml.org/lkml/2017/12/27/2
Signed-off-by: Tom Lendacky
---
arch/x86/kernel/cpu/common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c47de4e..7d9e3b0 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -923,8 +923,8 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)

setup_force_cpu_cap(X86_FEATURE_ALWAYS);

- /* Assume for now that ALL x86 CPUs are insecure */
- setup_force_cpu_bug(X86_BUG_CPU_INSECURE);
+ if (c->x86_vendor != X86_VENDOR_AMD)
+ setup_force_cpu_bug(X86_BUG_CPU_INSECURE);

fpu__init_system(c);

If you don't apply the patch your computer will get compromized and taken over by a hacker.

It's a feature you filthy goys, you should be happy.

When can I sue the Intel/NSA?

ayymdee bros WW@

I already have no AV anyway

In reality this is a plot to force people to hastily adopt a rigged security update. Rigged by the merchants.