Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security Google Intel Microsoft Privacy Software Technology

Google and Microsoft Disclose New CPU Flaw, and the Fix Can Slow Machines Down (theverge.com) 83

An anonymous reader quotes a report from The Verge: Microsoft and Google are jointly disclosing a new CPU security vulnerability that's similar to the Meltdown and Spectre flaws that were revealed earlier this year. Labelled Speculative Store Bypass (variant 4), the latest vulnerability is a similar exploit to Spectre and exploits speculative execution that modern CPUs use. Browsers like Safari, Edge, and Chrome were all patched for Meltdown earlier this year, and Intel says "these mitigations are also applicable to variant 4 and available for consumers to use today." However, unlike Meltdown (and more similar to Spectre) this new vulnerability will also include firmware updates for CPUs that could affect performance. Intel has already delivered microcode updates for Speculative Store Bypass in beta form to OEMs, and the company expects them to be more broadly available in the coming weeks. The firmware updates will set the Speculative Store Bypass protection to off-by-default, ensuring that most people won't see negative performance impacts.

"If enabled, we've observed a performance impact of approximately 2-8 percent based on overall scores for benchmarks like SYSmark 2014 SE and SPEC integer rate on client 1 and server 2 test systems," explains Leslie Culbertson, Intel's security chief. As a result, end users (and particularly system administrators) will have to pick between security or optimal performance. The choice, like previous variants of Spectre, will come down to individual systems and servers, and the fact that this new variant appears to be less of a risk than the CPU flaws that were discovered earlier this year.

This discussion has been archived. No new comments can be posted.

Google and Microsoft Disclose New CPU Flaw, and the Fix Can Slow Machines Down

Comments Filter:
  • by JoeyRox ( 2711699 ) on Monday May 21, 2018 @08:15PM (#56650356)
    Or perhaps that's just the skeptic in me talking.
    • by Anonymous Coward

      Just to note, commercially available computers are buggy, insecure POS's

      This has been noted before, particularly in reviews for acceptable levels of security that used to require a PC have no network, keyboard or monitor, and be in a locked room in order to be considered secure.

      Why this surprises anybody is beyond me, maybe the gov will slip up and let us all have the specs for whatever Multics led to

    • Close, it's a great way for Intel to marginalize used PC/server market as none of the old machines get the microcode/BIOS patches. All old servers are now for air-gapped applications only.

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        Close, it's a great way for Intel to marginalize used PC/server market as none of the old machines get the microcode/BIOS patches. All old servers are now for air-gapped applications only.

        Responding as AC but... they have provided beta microcode back to the first core processor. I've personally seen it. The people who are NOT providing microcode updates are the hardware vendors that ship your motherboard. However, there are other ways to update the microcode, such as through your operating system. From what I have seen in beta testing, the update does not seem to affect the stability of machines with old BIOS but obviously there is no way to be certain until it starts rolling out.

    • by Anonymous Coward on Monday May 21, 2018 @08:44PM (#56650510)

      Or perhaps that's just the skeptic in me talking.

      I'm replying AC because this affects my company but Intel basically says in the advisory that the one mitigation that DOES affect CPU performance is not really necessary if you have a modern OS and modern web browser. I'm not certain this is true, I am not affiliated with Microsoft, GPZ, or Intel, but I do know that this issue has been researched by Intel, Microsoft, and GPZ for many months. In fact, the initial indications suggested that it was worse than it actually is after applying January microcode updates and updating OS and browser.

      That update is going to be enabled/disabled by the user based on a BIOS or OS toggle and Intel recommends it be disasbled under most circumstances. I don't know when they recommend that you enable it, but I assume it is going to be important for cloud hosting providers.

      • It's hard to take anything that Intel says seriously. Last time they said the hit would be a few percent, and people were seeing 60%.

        Best to avoid them altogether. And sue in small claims court of you are already a victim.

      • by thegarbz ( 1787294 ) on Tuesday May 22, 2018 @06:35AM (#56651984)

        To be honest I struggle to get upset about this speculative execution business, but then I don't fall into the categories of people who need to worry. For most of these cases the exploit requires a significant chunk of privileged code to already be running. On nearly everyone's PC you have already lost. Your system is at this point no longer yours.

        Where this would be scarier is on virtual machines where one OS can break the isolation that the hypervisor provides. A computer where it's function is to give strangers access to running code on your machine.

        Frankly I think Intel is right about most of this and so is Microsoft and the Linux kernel devs when they made the various fixes for the various speculative execution bugs optional.

    • The benchmark sites need to start using or disclosing speeds with the "feature" turned on.

  • Speed Reduction (Score:5, Interesting)

    by mentil ( 1748130 ) on Monday May 21, 2018 @08:26PM (#56650418)

    After all the speculative execution flaws are found and fixed (in hardware or software) the question won't be how much of a slowdown those fixes cause, but how much of a speedup from speculative execution remains.

    • Re:Speed Reduction (Score:5, Insightful)

      by AmiMoJo ( 196126 ) <mojo@wo[ ]3.net ['rld' in gap]> on Monday May 21, 2018 @10:40PM (#56650930) Homepage Journal

      The problem for Intel is that they sold these processors with certain features and performance, and now have found design defects in them.

      That's a classic consumer protection scenario. Car engine fails catastrophically after 50k km due to badly designed part? Under EU law you should not be out of pocket.

      • Re:Speed Reduction (Score:5, Insightful)

        by macraig ( 621737 ) <mark@a@craig.gmail@com> on Monday May 21, 2018 @11:26PM (#56651064)

        Intel has been getting a free pass from such consumer protections for decades now. Are we finally so enlightened that we can take away their hoard of Get Out Of Jail Free cards and make them pay for their failures rather than profit from them?

        • by AmiMoJo ( 196126 )

          Yes. I took then to small claims court and won.

          • by macraig ( 621737 )

            And if we individually sued them for something that is a collective wrong, we'd tie up the judicial system for decades with a waiting list encircling the globe several times, wouldn't we? I'm glad "you got yours", but that's not a solution for the societal wrong, is it?

            • by AmiMoJo ( 196126 )

              I'm such cases the judges usually start fast tracking decisions based on previous cases, and then to save paying court and legal fees the company just pays out without contest in future.

              It sucks but there is no other option.

      • Car engine fails catastrophically after 50k km due to badly designed part? Under EU law you should not be out of pocket.

        The car engine didn't fail catastrophically. What did happen is you applied an optional fix to a problem that under a very small set of specific circumstances would cause the car door to unlock and then after you put your car with its optional fix on a dyno you discovered you actually had 10 horsepower less than you thought.

        You'll be hard pressed getting that through even an EU regulator.

        • Yes and no. You could with new model cars that they knew they were going to be applying the fix to in the coming months but sold under the old numbers. Specifically that would be fraud, so anyone who bought Coffee Lake before the fixes were published is arguably entitled to a full refund.

          • so anyone who bought Coffee Lake before the fixes were published is arguably entitled to a full refund

            Not really because Intel don't publish performance figures, hence it isn't fraud. Not only that but the processor itself still does exactly what it said on the box. The fact that someone else can use those feature nefariously and that Intel gives you an option for added security at the cost of performance doesn't change what the processor is now and what it will be after the optional fix gets released.

            The key part here is that you still have every bit the same device that was advertised and sold to you doin

      • by jwhyche ( 6192 )

        I see where you are going with this. Basically, we have been sold a flawed product that isn't performing as advertised.

  • by ad454 ( 325846 ) on Monday May 21, 2018 @08:28PM (#56650426) Journal

    ... Security or Performance.

    Not everyone is a gamer, video editor, etc.

    Many people would gladly sacrifice 50% CPU performance, in exchange for more secure and stable processors.

    But Intel and its OEMs are reluctant to even give us consumers the choice to obtain decent microcode security fixes that slow down our computers too much.

    Intel already provides the NSA with the ME backdoor, so why won't they at least try harder to close the other security holes?

    • ... Security or Performance.

      Not everyone is a gamer, video editor, etc.

      Many people would gladly sacrifice 50% CPU performance, in exchange for more secure and stable processors.

      But Intel and its OEMs are reluctant to even give us consumers the choice to obtain decent microcode security fixes that slow down our computers too much.

      Intel already provides the NSA with the ME backdoor, so why won't they at least try harder to close the other security holes?

      Read the advisory. They DID give you the option to choose and recommend that vendors ship with it disabled as it's only needed in specific circumstances.

    • by Tablizer ( 95088 )

      Not everyone is a gamer, video editor, etc.

      But who doesn't re-edit their porn to match their own stroke rate?

    • Not everyone is a gamer, video editor, etc.

      Pfft amateurs. What do they need a decent CPU for. Real men need Real CPUs for Real workloads like running McAfee.

    • This will never be in OpenBSD. Back in 2005, Theo de Raadt would not give any ground when I implored him to build with position independent executables. He maintained that PIE was "very expensive"--the overall impact on x86 is about 0.06% additional CPU usage, so about 2.16 seconds lost per hour pegged at 100% CPU usage, minus any time spent not at 100% CPU usage.

      8%? He'll never accept that. It's way too performance-expensive.

    • You are right, but rgere are far more intel costumers thst care about performance than gamers and wideo editors, SaAS providers, metreologists, intel sells to other costumers than consumers. i would imagine rhat googlebwould not be thrilled if the 1000s of servers they run in a Dc dropped even 1% in performance, that would potenttionsly mean 100s of extra servers to do the same amount of work wit extra switchports power an cooling, not cheap

  • And my professor laughed when I held the single-cycle CPU design to be the holy grail of the industry...

  • by Anonymous Coward

    When this is all done and dusted I will be left with a z80

  • by Anonymous Coward

    > The firmware updates will set the Speculative Store Bypass protection to off-by-default, ensuring that most people won't see negative performance impacts.

    Devices will remain insecure by default to protect our brand image and shareholders. How the f* do you think it is a good idea to set a security patch as off-by-default?

    • Because original Meltdown and Spectre mitigations already cover this one as well. This is a secondary layer of protection that comes with a performance impact. That's why.
  • by l3v1 ( 787564 ) on Tuesday May 22, 2018 @05:49AM (#56651924)
    So, in the future CPU makers don't need to invent new names. We'll just identify CPUs with the name of the newest vulnerabilities they have :) it'll be much easier :)
    • Re:cpuid (Score:4, Informative)

      by Wolfrider ( 856 ) <kingneutronNO@SPAMgmail.com> on Tuesday May 22, 2018 @07:59AM (#56652238) Homepage Journal

      > So, in the future CPU makers don't need to invent new names. We'll just identify CPUs with the name of the newest vulnerabilities they have :)

      --You joke, but the Linux kernel already does this when you do ' cat /proc/cpuinfo ':

      model name : Intel(R) Core(TM) i5-x400 CPU @ 2.70GHz
      bugs : cpu_meltdown spectre_v1 spectre_v2

  • "Safari, Edge, and Chrome" - but where is Firefox? Then also Chromium but that is assumed to be patched along with Chrome. Nobody cares about Free software anymore?
  • Planned obsolescence at its best.

Neutrinos have bad breadth.

Working...