Major security flaw found in Intel processors

[seeteeyou]

Intel plans to release chips that have built-in Meltdown and Spectre protections later this year
http://www.businessinsider.com/intel-says-new-spectre-and-meltdown-proof-chips-coming-this-year-2018-1

Quote

Krzanich did not immediately address the controversy over his massive stock sale in November. He gained $24 million by selling off all the shares and stock options he was allowed to divest.

 

He made that sale months after the company was informed of the Spectre and Meltdown attacks but before they had been publicly announced. Intel has said that his sale was "unrelated" to knowledge of the security vulnerabilities.

 

In other words, he no longer cares if Intel were getting sued or otherwise.

[mansr]

8 minutes ago, seeteeyou said:

Intel plans to release chips that have built-in Meltdown and Spectre protections later this year

And you trust them?

[seeteeyou]

Addressing Questions Regarding Additional Security Issues | Intel Newsroom

https://newsroom.intel.com/articles/addressing-questions-regarding-additional-security-issues/

 

Exclusive: Spectre-NG - Multiple new Intel CPU flaws revealed, several serious

https://www.heise.de/ct/artikel/Exclusive-Spectre-NG-Multiple-new-Intel-CPU-flaws-revealed-several-serious-4040648.html

 

8 New Spectre Security Flaws Found in Intel CPUs, One Variant More Critical Than Any Before

http://www.game-debate.com/news/25018/8-new-spectre-security-flaws-found-in-intel-cpus-one-variant-more-critical-than-any-before

 

Lots of fun for sure, third time's a charm so let's wait and see.

[botrytis]

Actually, all modern processors have these flaws. Even the ones in your phones, etc.

[mansr]

18 minutes ago, botrytis said:

Actually, all modern processors have these flaws. Even the ones in your phones, etc.

There are many variants of these attacks, and not all processors are vulnerable to all of them. A few actually seem to be uniquely affecting Intel CPUs.

[botrytis]

As far as the branch prediction and read ahead flaws, all modern processors have them.

 

The Intel is dealing with the security code they put in their processes. AMD has part but not all in their processors as well. Not all Intel chip have this issue, either part of the 3rd generation Intel chips have it and all newer. The 2nd generation Intel's are immune, like the i5-2500K processor.

 

Most of this is dealt with a bios upgrade on the motherboard and you will have no issues.

[mansr]

3 minutes ago, botrytis said:

As far as the branch prediction and read ahead flaws, all modern processors have them.

Yes, in some form or other. As I said, some variants of the attacks work only on some CPUs. The success rate of those that do work also varies.

[seeteeyou]

KB4100347: Intel microcode updates
https://support.microsoft.com/en-us/help/4100347/intel-microcode-updates-for-windows-10-version-1803-and-windows-server

Applies to: Windows Server version 1803, Windows 10 version 1803

 

2018-05 Update for Windows 10 Version 1803 for x86-based Systems (KB4100347)
http://download.windowsupdate.com/d/msdownload/update/software/updt/2018/05/windows10.0-kb4100347-x86_626ea1e8760527840c3eb367518c291855b849cf.msu

 

2018-05 Update for Windows 10 Version 1803 for x64-based Systems (KB4100347) 
http://download.windowsupdate.com/d/msdownload/update/software/updt/2018/05/windows10.0-kb4100347-x64_89793c02681ab9df96565ca4c5ee601e4475ec8f.msu

[yamamoto2002]

Here it is updated list. Spectre v2 CVE-2024-2201 should be added soon on this list. End of servicing lifetime processors are not listed (computer should be updated to supported processor to get security fix service from Intel)

 

https://github.com/intel/Intel-affected-processor-list/blob/main/Intel_affected_processor_list.csv

 

From my understandings, “software mitigation” adds extra synchronization wait instruction command after every specific machine instruction call and “microcode update (MCU) fix” does it by CPU itself.