woss this all about?

Phil_aka_Pip

http://www.bbc.co.uk/news/technology-42562303

CPUs having "security flaws"? is it April 1st already?

Heartfeltdawn

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

https://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

https://www.theregister.co.uk/2018/01/04/intels_spin_the_registers_annotations/

Boom. 

It's far from a joke. 

Axe_meister

This is going to be a mini nightmare. All of a sudden everything you do that is hosted on the cloud could slow down by up to 30%. Virtually every server will need to be patched.
And my customers are going to ask for another 30% extra servers "for free".

FX_Munkee

Intel fucked up again.
In simple terms, as far as I understand it, they implemented "speculative execution" (where as many code branches as will fit into cache are executed at the same time to increase performance) but forgot to add any permission checks before doing it. Fairly dumb stuff.
The fix will cost CPU cycles, ie slow down your machine. Mainly affecting any process that does a lot of system level calls, eg IO or socket stuff.

Phil_aka_Pip

Well stone me, I wouldn't have thought of that in a million years!

I guess you would need to know a fair bit about what you were looking for if you hoiked out information at such a low level, in order to piece it together to make something meaningful out of it.

FX_Munkee

Not really, looking for passwords in plain text in kernel memory would be trivial. There's no obfuscation at that level because, why would there need to be <sigh>.

axisus

FX_Munkee said:

Intel fucked up again.
In simple terms, as far as I understand it, they implemented "speculative execution" (where as many code branches as will fit into cache are executed at the same time to increase performance) but forgot to add any permission checks before doing it. Fairly dumb stuff.
The fix will cost CPU cycles, ie slow down your machine. Mainly affecting any process that does a lot of system level calls, eg IO or socket stuff.

I put that in Google translate but I still didn't understand it.

Axe_meister

axisus said:

FX_Munkee said:

Intel fucked up again.
In simple terms, as far as I understand it, they implemented "speculative execution" (where as many code branches as will fit into cache are executed at the same time to increase performance) but forgot to add any permission checks before doing it. Fairly dumb stuff.
The fix will cost CPU cycles, ie slow down your machine. Mainly affecting any process that does a lot of system level calls, eg IO or socket stuff.

I put that in Google translate but I still didn't understand it.

Think of two people walking down two separate roads talking on the the phone, neither can hear each other. Then the roads join all of a sudden the people on the other side of the phone calls can hear each other load and clear and exchange information without the walkers knowing.

Legionreturns

Axe_meister said:

axisus said:

FX_Munkee said:

Intel fucked up again.
In simple terms, as far as I understand it, they implemented "speculative execution" (where as many code branches as will fit into cache are executed at the same time to increase performance) but forgot to add any permission checks before doing it. Fairly dumb stuff.
The fix will cost CPU cycles, ie slow down your machine. Mainly affecting any process that does a lot of system level calls, eg IO or socket stuff.

I put that in Google translate but I still didn't understand it.

Think of two people walking down two separate roads talking on the the phone, neither can hear each other. Then the roads join all of a sudden the people on the other side of the phone calls can hear each other load and clear and exchange information without the walkers knowing.

Nope. I've still got nothing. Is that Chinglish?

bodhi

Basically, much of the world is going to slow down by up to 30%.  Probably.  For a while at least.

I quite like the idea.

joeyowen

Worth adding the head of intel may be in trouble for inside trading

Apparently he sold a lot of stock knowing this announcement was coming out

FX_Munkee

axisus said:

FX_Munkee said:

Intel fucked up again.
In simple terms, as far as I understand it, they implemented "speculative execution" (where as many code branches as will fit into cache are executed at the same time to increase performance) but forgot to add any permission checks before doing it. Fairly dumb stuff.
The fix will cost CPU cycles, ie slow down your machine. Mainly affecting any process that does a lot of system level calls, eg IO or socket stuff.

I put that in Google translate but I still didn't understand it.

imagine this code:-
if(x==1)
{
  do this bit of code;
}
else if(x==2)
{
  do this other code thing;
}
else
{
  do something else;
}
In speculative execution the CPU will do all 3 possibilities at the same time because it has the bandwidth. Then when it has calculated what x actually is it will use the 1 bit of code that it requires, discarding the other 2.

Sassafras

I prefer a more sedate, leisurely lifestyle.

Clashman

Just checked, mines an AMD

Clashman

But my laptop is intel

siremoon

Clashman said:

Just checked, mines an AMD

Word is they may have a problem too

Phil_aka_Pip

siremoon said:

Clashman said:

Just checked, mines an AMD

Word is they may have a problem too

Said as much on The Register. Their explanation made a fair bit of sense.

EDIT: This bit was good ...

To help put Intel's claims into context, we've annotated the text. Bold is Intel's spin.

Intel and other technology companies have been made aware of new security research describing software analysis methods that, when used for malicious purposes, have the potential to improperly gather sensitive data from computing devices that are operating as designed.

Translation: When malware steals your stuff, your Intel chip is working as designed. Also, this is why our stock price fell. Please make other stock prices fall, thank you.

Clashman

As long as my 150,00 bitcoins are safe I'm not bothered.

FX_Munkee

siremoon said:

Clashman said:

Just checked, mines an AMD

Word is they may have a problem too

They are affected but by the lower level vulnerability, which is pretty difficult to pull off, also there's a possibility it could be patched at the microcode level so no performance hit.

57Deluxe

they won't get into my Atari STf...

djspecialist

Clashman said:

As long as my 150,00 bitcoins are safe I'm not bothered.

I just Spectre'd you and stole a zero off the end of your number of bitcoins.