Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5354 > unrolled thread

Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit

Back to article view | Back to linux.debian.security

Contents

  Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With  Up To 30% Performance Hit Vincent Deffontaines <vincent@gryzor.com> - 2018-01-03 12:00 +0100
    Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability  With  Up To 30% Performance Hit Henrique de Moraes Holschuh <hmh@debian.org> - 2018-01-03 15:10 +0100
    Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability  With Up To 30% Performance Hit Pavel Alyev <aliech@aliech.ru> - 2018-01-03 17:00 +0100
      Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability  With Up To 30% Performance Hit Waylon Robertson <wrobertson1981@gmail.com> - 2018-01-04 00:40 +0100
      Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit Rushan <debsec@irush.su> - 2018-01-04 12:40 +0100

#5354 — Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit

Greetings,

And happy new year.

This is hitting all of us soon.
In short : a huge (and long lasting) hardware bug, present in about all 
Intel CPUs that have been sold for the last 10 years.
It is not fixable by microcode, and requires ugly patching from the 
kernel layer. Other OSes such as Microsoft are concerned as well.

Nice overview of the thing :
https://hothardware.com/news/intel-cpu-bug-kernel-memory-isolation-linux-windows-macos

More detail :
http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table

Linus' patch :
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5aa90a84589282b87666f92b6c3c917c8080a9bf


Vincent Deffontaines

[toc] | [next] | [standalone]

#5355 — Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit

On Wed, 03 Jan 2018, Vincent Deffontaines wrote:
> It is not fixable by microcode, and requires ugly patching from the kernel
> layer. Other OSes such as Microsoft are concerned as well.

Nobody but Intel knows whether it is fixable in microcode or not for a
given processor family.  And Intel has *NOT* published any public
information about this yet, AFAIK.

Take for example the LAPIC memory sinkhole issue[1], which is quite
dangerous (allows for persistent, stealth ring -2 malware that is
invisible to the BIOS, hypervisor and operating system).  It was widely
discussed, it was officialy acknowledged, and it was touted everywhere
as "impossible to fix" in microcode because it was an architectural
thing.

Well, the LAPIC issue was not just fixable in microcode: it *was indeed
fixed* by a set of microcode updates.  The fixing was done silently(!),
though.  My best guess is that this particular set of updates could not
be issued to the wide public because it *does* change an architectural
behavior, and thus it is supposed to always be deployed along with a
BIOS update to ensure compatibility.  But it is available to vendors,
and at least one vendor of corporate desktops and servers *did* deploy
such firmware updates with the new microcode for systems with processors
as old as the Core2 duo...

Most likely, this new X86_BUG_CPU_INSECURE issue either cannot be fixed
in microcode on every affected processor model (some have more hardwired
paths than others) so you would still need a software-level fix anyway,
or it is just too painful performance-wise to do it in the microcode.

But this, too, is just speculation.  Until Intel document it somewhere
public, I am not assuming it is not possible to fix it with an microcode
update.

[1] http://www8.hp.com/us/en/intel-processor-memory-sinkhole.html

-- 
  Henrique Holschuh

[toc] | [prev] | [next] | [standalone]

#5356 — Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit

It's main reason why coreboot developers recommend to include LATEST 
microcode patch in build of BIOS image.

And if this can't be fixed... Nothing happened. There is many bugs in 
CPUs. And kernel have workarounds for this. Look on non x86 sources. 
Look on huge errata's lists of ARM, for example. It's normal practice.


03.01.2018 13:43, Vincent Deffontaines пишет:
> Greetings,
>
> And happy new year.
>
> This is hitting all of us soon.
> In short : a huge (and long lasting) hardware bug, present in about 
> all Intel CPUs that have been sold for the last 10 years.
> It is not fixable by microcode, and requires ugly patching from the 
> kernel layer. Other OSes such as Microsoft are concerned as well.
>
> Nice overview of the thing :
> https://hothardware.com/news/intel-cpu-bug-kernel-memory-isolation-linux-windows-macos 
>
>
> More detail :
> http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table 
>
>
> Linus' patch :
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5aa90a84589282b87666f92b6c3c917c8080a9bf 
>
>
>
> Vincent Deffontaines
>

-- 
With best regards

[toc] | [prev] | [next] | [standalone]

#5357 — Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit

oh crud. there goes playing games on this laptop. 30% loss where it
can only just play some games... oh fun. <div
id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br />
<table style="border-top: 1px solid #D3D4DE;">
	<tr>
        <td style="width: 55px; padding-top: 13px;"><a
href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail"
target="_blank"><img
src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif"
alt="" width="46" height="29" style="width: 46px; height: 29px;"
/></a></td>
		<td style="width: 470px; padding-top: 12px; color: #41424e;
font-size: 13px; font-family: Arial, Helvetica, sans-serif;
line-height: 18px;">Virus-free. <a
href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail"
target="_blank" style="color: #4453ea;">www.avast.com</a>
		</td>
	</tr>
</table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1"
height="1"></a></div>

On Thu, Jan 4, 2018 at 4:20 AM, Pavel Alyev <aliech@aliech.ru> wrote:
>
> It's main reason why coreboot developers recommend to include LATEST
> microcode patch in build of BIOS image.
>
> And if this can't be fixed... Nothing happened. There is many bugs in CPUs.
> And kernel have workarounds for this. Look on non x86 sources. Look on huge
> errata's lists of ARM, for example. It's normal practice.
>
>
> 03.01.2018 13:43, Vincent Deffontaines пишет:
>
>> Greetings,
>>
>> And happy new year.
>>
>> This is hitting all of us soon.
>> In short : a huge (and long lasting) hardware bug, present in about all
>> Intel CPUs that have been sold for the last 10 years.
>> It is not fixable by microcode, and requires ugly patching from the kernel
>> layer. Other OSes such as Microsoft are concerned as well.
>>
>> Nice overview of the thing :
>>
>> https://hothardware.com/news/intel-cpu-bug-kernel-memory-isolation-linux-windows-macos
>>
>> More detail :
>>
>> http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table
>>
>> Linus' patch :
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5aa90a84589282b87666f92b6c3c917c8080a9bf
>>
>>
>> Vincent Deffontaines
>>
>
> --
> With best regards
>

[toc] | [prev] | [next] | [standalone]

#5358 — Re: Huge Intel CPU Bug Allegedly Causes Kernel Memory Vulnerability With Up To 30% Performance Hit

However this is not just Intel. AMD, ARM and others are also affected by spectre attack[0]. And this one is much more harder to mitigate.
There are already available patches, so roll out security updates and stay tuned.

[0]: https://spectreattack.com/

-- 
Kind regards,
Rushan.



03.01.2018, 18:53, "Pavel Alyev" <aliech@aliech.ru>:
> It's main reason why coreboot developers recommend to include LATEST
> microcode patch in build of BIOS image.
>
> And if this can't be fixed... Nothing happened. There is many bugs in
> CPUs. And kernel have workarounds for this. Look on non x86 sources.
> Look on huge errata's lists of ARM, for example. It's normal practice.
>
> 03.01.2018 13:43, Vincent Deffontaines пишет:
>>  Greetings,
>>
>>  And happy new year.
>>
>>  This is hitting all of us soon.
>>  In short : a huge (and long lasting) hardware bug, present in about
>>  all Intel CPUs that have been sold for the last 10 years.
>>  It is not fixable by microcode, and requires ugly patching from the
>>  kernel layer. Other OSes such as Microsoft are concerned as well.
>>
>>  Nice overview of the thing :
>>  https://hothardware.com/news/intel-cpu-bug-kernel-memory-isolation-linux-windows-macos
>>
>>  More detail :
>>  http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table
>>
>>  Linus' patch :
>>  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5aa90a84589282b87666f92b6c3c917c8080a9bf
>>
>>  Vincent Deffontaines
>
> --
> With best regards

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web