Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

eva2000 · Jan 8, 2018

hmm bad Intel Intel Released "Coffee Lake" Knowing it Was Vulnerable to Spectre and Meltdown

By the time Intel launched its 8th generation Core "Coffee Lake" desktop processor family (September 25, 2017, with October 5 availability), the company was fully aware that the product it is releasing was vulnerable to the three vulnerabilities plaguing its processors today, the two more publicized of which, are "Spectre" and "Meltdown." Google Project Zero teams published their findings on three key vulnerabilities, Spectre (CVE-2017-5753 and CVE-2017-5715); and Meltdown (CVE-2017-5754) in mid-2017, shared with hardware manufacturers under embargo; well before Intel launched "Coffee Lake." Their findings were made public on January 3, 2018.

Intel's engineers would have had sufficient time to understand the severity of the vulnerability, as "Coffee Lake" is essentially the same micro-architecture as "Kaby Lake" and "Skylake." As one security researcher puts it, this could affect Intel's liability when 8th generation Core processor customers decide on a class-action lawsuit.
Click to expand...

eva2000 · Jan 8, 2018

Window 10 updates and AMD cpu issues http://windowsreport.com/amd-display-issues-windows-update/

Severe display problems on AMD computers
Our readers confirmed that AMD systems lock up with the Windows logo showing on a black screen as soon as they update their computers.
Click to expand...

eva2000 · Jan 9, 2018

Benchmarking Linux With The Retpoline Patches For Spectre - Phoronix

While the Kernel Page Table Isolation (KPTI) patches were quick to land in the mainline Linux kernel for addressing the Meltdown CPU vulnerability, the "Retpoline" patches are still being worked on as the leading approach on the Linux side for dealing with the Spectre CPU vulnerability. The Retpoline patches are said to have little impact on performance, but here are our benchmarks of these kernel patches for seeing how they affect a variety of AMD and Intel systems.

Retpoline is the Google-led approach for dealing with Spectre or "speculative execution" and preventing branch target injection attacks by avoiding speculative indirect branches within the kernel code. Google has said Retpoline has a "negligible impact on performance" and is already being used on all of their systems and is also found in use already by some other vendors.
Click to expand...

eva2000 · Jan 9, 2018

Cloudflare An Explanation of the Meltdown/Spectre Bugs for a Non-Technical Audience

Virtuozzo Addresses Intel Bug Questions - Virtuozzo

What Spectre and Meltdown Mean For WebKit

eva2000 · Jan 9, 2018

Update: January 8th, 2018 Linode blog update Linode Blog » CPU Vulnerabilities: Meltdown & Spectre

Update: January 8, 2018

We are continuing to make progress with our internal testing, but are still waiting for microcode updates from our hardware providers. Both the microcode update and the kernel update are required in order to ensure there is proper mitigation to the three variants of Meltdown and Spectre.
Click to expand...

eva2000 · Jan 9, 2018

Meltdown and Spectre get their own Wiki entries

Meltdown (security vulnerability) - Wikipedia

Spectre (security vulnerability) - Wikipedia

eva2000 · Jan 10, 2018

Redhat has updated the controlling tunables guide for updated Linux Kernel backported Controlling the Performance Impact of Microcode and Security Patches for CVE-2017-5754 CVE-2017-5715 and CVE-2017-5753 using Red Hat Enterprise Linux Tunables - Red Hat Customer Portal

eva2000 · Jan 10, 2018

Potentially bad news that some older Intel cpus aren't getting microcode updates like v1/v2/v3 sandybridge, ivybridge and haswell microcode updates for Sandy/Ivy Bridge? • r/intel

Well, I've contacted MSI support and they've told me that they won't be updating their z87 motherboards. Which is Haswell.

Also according the Asus' website they are not planning to update any motherboard before x99 and 1xx chipsets.

So don't expect a motherboard update for Sandy/Ivy...
Click to expand...

eva2000 · Jan 10, 2018

Benchmarking Clear Linux With KPTI + Retpoline Support (Meltdown + Spectre Patches) - Phoronix

Since yesterday's debut of the rolling-release Clear Linux 20240, this Linux distribution using Linux 4.14.12 is patched with Kernel Page Table Isolation (KPTI) to safeguard against the Meltdown vulnerability. Additionally, this build adds in the (currently out-of-tree patches) for Retpoline support for fighting Spectre. There is not only the kernel Retpoline patches now in Clear Linux but its GCC 7.2 compiler was also patched with its respective Retpoline patches for offering full protection.

These tests today are comparing Clear Linux 20190 from Sunday's state to Clear Linux 20240 on Monday. Thus this is a comparison without any Spectre/Meltdown supprot now going to the "full protection" as is currently available right now for both these CPU vulnerabilities
Click to expand...

eva2000 · Jan 10, 2018

Intel's CES 2018 Key Note presentation Intel at CES 2018: Brian Krzanich Keynote Live Blog (18:30 PT, 02:30 UTC). So it could be as long as one month later to get all Intel CPUs patched up microcode/bios update wise.

09:44PM EST - Thanking the industry for coming to getting together about Meltdown/Spectre

09:44PM EST - 'Security is job number 1 for Intel and our industry'

09:44PM EST - 'No info that these exploits have been used to obtain customer data'

09:45PM EST - 'We recommend that users apply updates as soon as the vendor makes it available'

09:45PM EST - 90% of people covered within a week, the rest within the monht

09:45PM EST - some workloads will have a larger impact than otehrs

09:45PM EST - work with the industry to minimize the impact
Click to expand...

eva2000 · Jan 10, 2018

since Windows 10 update fix for meltdown, had a couple of system hangs and windows event viewer logged these errors, wonder if it's related ?

on Samsung ATIV Book 8 laptop with Core i7 3635QM 4C/8T cpu

The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.
Click to expand...

eva2000 · Jan 10, 2018

The Combined Impact Of Retpoline + KPTI On Ubuntu Linux - Phoronix

ouch full result in the OpenBenchmarking.org result file

nginx test - This is a test of ab, which is the Apache Benchmark program running against nginx. This test profile measures how many requests per second a given system can sustain when carrying out 2,000,000 requests with 500 requests being carried out concurrently

apache test - This is a test of ab, which is the Apache benchmark program. This test profile measures how many requests per second a given system can sustain when carrying out 1,000,000 requests with 100 requests being carried out concurrently

nginx ~21-26% reduction with KPTI + Retpoline Kernel patch fixes

Apache ~21-32% reduction with KPTI + Retpoline Kernel patch fixes

Redis ~6.5-11% drop

eva2000 · Jan 10, 2018

Conducting my own Nginx benchmarks before/after KPTI enabeld Linux Kernel Nginx Benchmarks After CentOS Linux Kernel KPTI Meltdown & Spectre Fixes

eva2000 · Jan 10, 2018

Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems

Performance
One of the questions for all these fixes is the impact they could have on the performance of both PCs and servers. It is important to note that many of the benchmarks published so far do not include both OS and silicon updates. We’re performing our own sets of benchmarks and will publish them when complete, but I also want to note that we are simultaneously working on further refining our work to tune performance. In general, our experience is that Variant 1 and Variant 3 mitigations have minimal performance impact, while Variant 2 remediation, including OS and microcode, has a performance impact.

Here is the summary of what we have found so far:

With Windows 10 on newer silicon (2016-era PCs with Skylake, Kabylake or newer CPU), benchmarks show single-digit slowdowns, but we don’t expect most users to notice a change because these percentages are reflected in milliseconds.

With Windows 10 on older silicon (2015-era PCs with Haswell or older CPU), some benchmarks show more significant slowdowns, and we expect that some users will notice a decrease in system performance.

With Windows 8 and Windows 7 on older silicon (2015-era PCs with Haswell or older CPU), we expect most users to notice a decrease in system performance.

Windows Server on any silicon, especially in any IO-intensive application, shows a more significant performance impact when you enable the mitigations to isolate untrusted code within a Windows Server instance. This is why you want to be careful to evaluate the risk of untrusted code for each Windows Server instance, and balance the security versus performance tradeoff for your environment.

For context, on newer CPUs such as on Skylake and beyond, Intel has refined the instructions used to disable branch speculation to be more specific to indirect branches, reducing the overall performance penalty of the Spectre mitigation. Older versions of Windows have a larger performance impact because Windows 7 and Windows 8 have more user-kernel transitions because of legacy design decisions, such as all font rendering taking place in the kernel. We will publish data on benchmark performance in the weeks ahead.
Click to expand...

eva2000 · Jan 10, 2018

Meltdown and Spectre a big deal for enterprises

Spectre can be mitigated only with microcode updates, but fixing Spectre permanently requires replacing the affected processors. However, the bad news is there is nothing without the flaw that enterprises could immediately replace affected processors with.

Given new processors and architectures can take five to 10 years to hit the market, Forrester says sacrificing performance for the microcode fixes is the best option.

However, given the complexity of distributing those fixes by device manufacturers, Forrester says enterprises should plan to use other techniques to protect data from users and companies that have not applied the fixes.

In addition to applying fixes to microcode, enterprises should:

Recompile applications built in-house using Retpoline instructions introduced by Google to isolate indirect branches from speculative execution

Plan to staff additional support resources during releases because there may be a spike in demand due to application performance issues or other problems related to the microcode patches

Prioritise application software updates related to Spectre as they are released

Click to expand...

Both exploits lower the requirements for unauthorised parties to access and exfiltrate data from machines. For example, attackers no longer need code execution on a specific device or operating system instance because side channels for data leakage exist if an attacker is present on a system with an unpatched processor.

Enterprises must, therefore, expect that any information on their systems is being read by someone else as long as they remain unpatched.

To target a firm specifically, attackers must find a way to force the cloud infrastructure provider to place them on the same bare metal server where your systems reside. According to Forrester, this is difficult to achieve, and the most likely scenario is criminals will begin mining the systems of their cloud “neighbours” for monetisable information.
Click to expand...

eva2000 · Jan 10, 2018

Dell and bios updates Microprocessor Side-Channel Vulnerabilities (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754): Impact on Dell products | Dell Australia

CVE ID: CVE-2017-5715, CVE-2017-5753, CVE-2017-5754

Dell is aware of the new side-channel analysis vulnerabilities, known as Meltdown and Spectre, affecting many modern microprocessors that were discovered and published by a team of security researchers on January 3, 2018. No "real-world" exploits of these vulnerabilities have been reported to date, though researchers have produced proof-of-concepts.

Patch Guidance:
There are two essential components that need to be applied to mitigate the above-mentioned vulnerabilities:

Apply the firmware update via BIOS update listed below, see the table in Dell Consumer and Commercial Client Products Affected section below.

Apply the applicable operating system patch, see the OS Patch Guidance section below.

Click to expand...

Looks like I need to update my Dell Inspiron 13 7000 (D7378) too

eva2000 · Jan 10, 2018

Meltdown-Spectre: Four things every Windows admin needs to do now | ZDNet

Meltdown and Spectre are impressively ecumenical in their ability to create havoc, affecting devices running nearly every desktop and mobile operating system. (BleepingComputer has an excellent list of advisories, patches, and updates for both vulnerabilities.)

And while software patches can mitigate the effects for now, the long-term solution involves fundamental changes to CPU design that could take years to reach the market.

One week after the (premature) public disclosure of the details of these attacks, we now know enough to survey the threat landscape and plan the long-term response.
Click to expand...

In addition, devices that use pre-Haswell Intel CPUs (Ivy Bridge and earlier designs) are most likely to suffer serious performance issues as a result of software updates.

In either case, even for a device that's less than four years old, the correct strategy might be to retire it early and replace it with a newer, faster, more secure model
Click to expand...

Sadly, my Samsung ATIV Book 8 laptop is using Ivybridge based Intel Core i7 3635QM 4C/8T cpu Maybe AMD Ryzen mobile cpus will come soon Ryzen Mobile is Launched: AMD APUs for Laptops, with Vega and Updated Zen

eva2000 · Jan 11, 2018

Online.net has one of the most comprehensive running updates for meltdown and spectre related fixes for their servers I have seen

Important note about the security flaw impacting ARM & Intel hardware

Spectre and Meltdown vulnerabilities status - Scaleway

Update #18 - 01/08/18 12pm UTC
Two new cloud providers AWS, Tata Communications and core members of the Red Hat and Ubuntu team joined the task force!

Scaleway Cloud Platform and Online Web Hosting

We are currently working on:

improving the Hypervisor upgrade process to reduce downtime

Spectre 2 mitigation using an IBRS enabled Kernel (still waiting for patches to be merged) + Microcode Upgrade

Retpoline Testing

Update #19 - 01/09/18 5:00pm UTC
Today, Moritz Lipp, Daniel Gruss, Michael Schwarz from Graz University of Technology who are one of the team discovered Meltdown & Spectre, joined our response communication platform to provide us additional details about the vulnerabilities.

As the 180 days embargo they provided ended today, they just released a Meltdown proof of concept. GitHub - IAIK/meltdown: This repository contains several applications, demonstrating the Meltdown bug.

On our side, we are still waiting for hardware vendors microcodes, we should receive them in the coming hours for the Scaleway platform.
We're tracking and testing the kernel IBRS patches and will start to upgrade the Scaleway platforms once we've fully qualified them.

Update #20 - 01/10/18 11:30am UTC
Following the embargo lifting, the official proof of concept for Spectre 2 from Google was disclosed 1272 - CPUs: information leak using speculative execution - project-zero - Monorail. Following analysis, we believe the PoC is only working on a specific software configuration. As far as we know, the Scaleway platform is not impacted but our security team is still investigating & working hard to confirm.

Meanwhile, we are performing benchmarks to identify performance impact introduced by the Meltdown mitigation, we will release them later today.

Important: Ubuntu update kernel to mitigate Meltdown is not working according to Bug #1742323 “Meltdown Update Kernel doesnt boot” : Bugs : linux package : Ubuntu. We strongly recommend you to do not update your kernel to 4.4.0-108.

Important2 (01/10/18 12:20pm UTC): kernel 4.4.0-109 has been pushed and fix the problem.

We are actively investigating all possibilities to mitigate Spectre 2, mainly IBRS & Retpoline
Click to expand...

buik · Jan 11, 2018

Sorry to say but if you asked me.
Its more and more a story of big company's.
And that goes as follows:

Heeej hi look at me, how well I am working.
How important I think that security is (so-called).

They would like to make it seems that all is going fine,
that they are startled because they just know about Spectre and Meltdown.

Boeeeeee boeee I did not know that and now I have to cry.
And now have to make a quick solution and thats difficult, because of the complexity
, so they ask for understanding.

But in fact it appears that they already knew it for 180 days.
They could have easily taken measures.

But now only a week before the embargo the news leaked.
Everyone is in turmoil.

What a shame.

Only Red Hat has succeeded.
Their EL changelog show that they already had a solution ready in December.

Finally, every provider has been emailing all the week long about how dangerous and critical it is. That they have to take measures immediately etc etc.

Once gain. The impact is NOT critical but Important / Moderate.

Kernel Side-Channel Attacks - CVE-2017-5754 CVE-2017-5753 CVE-2017-5715 - Red Hat Customer Portal
Synology-SA-18:01 Meltdown and Spectre Attacks | Synology Inc.

eva2000 · Jan 11, 2018

LOL @bassie

Well has begun for Linode Linode - Critical Maintenance for CPU Vulnerabilities

Log in / Register

Forums

Welcome to Centmin Mod Community

Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

.