Info Meltdown and Spectre Vulnerabilities Information

[goldstone77]

Meltdown and Spectre FAQ: How the critical CPU flaws affect PCs and Macs
It varies widely depending on your hardware, operating system, and workload.
By Brad Chacos and Michael Simon
PCWorld | FEB 1, 2018 2:05 PM PT
https://www.pcworld.com/article/3245606/security/intel-x86-cpu-kernel-bug-faq-how-it-affects-pc-mac.html

Meltdown and Spectre CPU flaw FAQ
Editor’s note: This article was most recently updated to mention that AV-Test and other security vendors are beginning to see some prototype malware that exploits the two vulnerabilities, and that Microsoft's latest patch disables Spectre mitigations because of potential system instability.

 

[goldstone77]

AMD Is Served: Class Action Lawsuit Launched Over Spectre Vulnerabilities
by Raevenlord Thursday, January 18th 2018 14:17
https://www.techpowerup.com/240745/amd-is-served-class-action-lawsuit-launched-over-spectre-vulnerabilities

Despite the grunt of the media's attention and overall customer rage having been thrown largely at Intel, AMD hasn't moved past the Spectre/Meltdown well, meltdown, unscathed. News has surfaced that at least two law firms have announced their intention of filing a class action lawsuit against AMD, accusing the company of not having disclosed their products' Spectre vulnerability, despite knowledge of said vulnerabilities.

AMD stated loud and clear that their processors weren't affected by the Meltdown flaw. However, regarding Spectre, AMD's terms weren't as clear cut. The company stated that its CPUs were vulnerable to the Spectre 1 flaw (patchable at a OS level), but said that vulnerability to Spectre 2's variant had "near-zero risk of exploitation". At the same time, the company also said that "GPZ Variant 2 (Branch Target Injection or Spectre) is applicable to AMD processors", adding that "While we believe that AMD's processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat.
The problem, according to the law firms, are these two disparate remarks from AMD regarding said vulnerability to Spectre 2. I'll just take it straight from the source, as Pomerantz wrote:

"In response to the Project Zero team's announcement, a spokesperson for AMD advised investors that while its own chips were vulnerable to one variant of Spectre, there was "near zero risk" that AMD chips were vulnerable to the second Spectre variant. Then, on January 11, 2018, post-market, AMD issued a press release entitled "An Update on AMD Processor Security," acknowledging that its chips were, in fact, susceptible to both variants of the Spectre security flaw."

This editor would just like to invite all readers to think this through with him - "Near Zero Risk of Exploitation Does Not Equal Zero Risk", which automatically means that AMD's processors were susceptible to both Spectre variants. At no point in time, in these statements that are being brought to the stage, did AMD say their processors weren't vulnerable.

AMD, naturally, has already responded to these lawsuit announcements, saying that these allegations are "without merit" and that it intends "to vigorously defend against these baseless claims." You can read both law firms' statements via the source links.
Sources: Tom's Hardware, Rosen Legal Case 1269, Pomerantz Law Firm

 

[goldstone77]

Microsoft's Spectre Fix For AMD CPUs Is Now On Windows Update
by Leon Chan February 1, 2018 at 9:35 AM
http://www.tomshardware.com/news/microsoft-spectre-fix-amd-cpu-windows-update,36440.html

The AMD-compatible Spectre fix for Windows 10 is now live and being distributed through Windows Update.

When the Meltdown/Spectre vulnerabilities first surfaced, Microsoft was quick to respond by rolling out software mitigations in its operating systems. Unfortunately, the fixes in Windows 10 had an unintended consequence for some older AMD CPUs, making them unbootable. Microsoft stopped issuing the update to affected AMD systems, but already affected users either had to use System Restore or reinstall their OS.
The issue was technically officially fixed on January 19 and Windows patches with the fix were manually downloadable on Microsoft Update Catalog, but manually updating is only recommended if you have an urgent need and know your current Windows build. For everyone else, Microsoft has just made the fix live on Windows Update with Windows 10 Build 16299.214. Like all patches delivered through Windows Update, users will get them automatically or by clicking “Check for updates” in Windows Update.

Users should note that this update only applies to older AMD CPUs. Ryzen and Threadripper-based systems weren’t gated from receiving the original patch. Also, this patch has no relation to the recently announced optional Windows patch that disables Spectre Variant 2 fixes for Intel CPUs. If you’re on an AMD system, then you should be glad that you’re, at least, not stuck with a randomly rebooting system.

 

[goldstone77]

We already know that Spectre will require hardware fixes, because google project zero clearly stated it from the beginning it's a hardware flaw built into X86.

Spectre is NOT a flaw into x86. There are x86 CPUs aren't affected by Spectre; on the other hand there are ARM, IBM, and Sun processors that are affected by Spectre.

You are correct not all of them are affected! ~99% of modern CPU's in the last ~20 years have this flaw built into it by design via Branch Chain Prediction.

 

[Isaiah4110]

It doesn't matter how the stock performed latter, neither how it will perform tomorrow. What matter is what happened the day that the stock dropped down: "plaintiff and other class members have suffered significant losses and damages". It seems evident that they can show on Court how much money they lost.

They suffered a loss of less than 1%. But if that is significant in your opinion you are allowed to have it, but I and Tom's Hardware disagree with you. The real problem is that the entire case is based on AMD making contradictory statements, which is absolutely false, and I've already proved this to be a money grab scheme in attempt to recover from damages outside the scope of the time frame in question. This makes the case laughable as Tom's Hardware has already mentioned in an article!

Bottom line: If you had $1,000,000 invested in AMD stock, the "hit" AMD stocks took as a result of "misleading statements" could have caused you to lose approximately $10,000 if you sold at the lowest point during after-hours trading that day.

...

I don't see how someone could easily prove in a lawsuit that they sustained "Substantial losses"... never mind the fact that you would have to also prove that when AMD made the "near zero risk" statement that they already knew they DID have the vulnerability.

 

[juanrga]

It doesn't matter how the stock performed latter, neither how it will perform tomorrow. What matter is what happened the day that the stock dropped down: "plaintiff and other class members have suffered significant losses and damages". It seems evident that they can show on Court how much money they lost.

They suffered a loss of less than 1%. But if that is significant in your opinion you are allowed to have it, but I and Tom's Hardware disagree with you. The real problem is that the entire case is based on AMD making contradictory statements

I am quoting the lawsuit. The affected people is the one that claim that they have "suffered significant losses and damages".

The case is not based in AMD making contradictory statements but on AMD hidding key information. Toms hardware also confirms AMD changed the public position:

The change in position is part of why the Rosen and Pomerantz law firms are now targeting AMD. These lawsuits aren’t aimed at justice for consumers, though; they’re after AMD for failing to disclose to investors its knowledge of the vulnerabilities, which led to a claimed drop in stock value.

And that article is old. Then AMD only faced two lawsuits. Now there are five or six, and there are also accusations of security fraud now.

 

[goldstone77]

Spoiler

It doesn't matter how the stock performed latter, neither how it will perform tomorrow. What matter is what happened the day that the stock dropped down: "plaintiff and other class members have suffered significant losses and damages". It seems evident that they can show on Court how much money they lost.

They suffered a loss of less than 1%. But if that is significant in your opinion you are allowed to have it, but I and Tom's Hardware disagree with you. The real problem is that the entire case is based on AMD making contradictory statements

I am quoting the lawsuit. The affected people is the one that claim that they have "suffered significant losses and damages".

The case is not based in AMD making contradictory statements but on AMD hidding key information. Toms hardware also confirms AMD changed the public position:

The change in position is part of why the Rosen and Pomerantz law firms are now targeting AMD. These lawsuits aren’t aimed at justice for consumers, though; they’re after AMD for failing to disclose to investors its knowledge of the vulnerabilities, which led to a claimed drop in stock value.

And that article is old. Then AMD only faced two lawsuits. Now there are five or six, and there are also accusations of security fraud now.

Anyone can file a lawsuit for a number of different circumstances. I showed you the weakness of their accusations in many previous comments. I still have yet to see where AMD is liable in any of these cases.

Securities fraud, also known as stock fraud and investment fraud, is a deceptive practice in the stock or commodities markets that induces investors to make purchase or sale decisions on the basis of false information, frequently resulting in losses, in violation of securities laws.

As I've repeated a couple dozen times now, they never claimed invulnerability, so the securities fraud is a money grab scam as well.

Also, look what another editor had so say from another article I posted above:
AMD Is Served: Class Action Lawsuit Launched Over Spectre Vulnerabilities
by Raevenlord Thursday, January 18th 2018 14:17

This editor would just like to invite all readers to think this through with him - "Near Zero Risk of Exploitation Does Not Equal Zero Risk", which automatically means that AMD's processors were susceptible to both Spectre variants. At no point in time, in these statements that are being brought to the stage, did AMD say their processors weren't vulnerable.

AMD, naturally, has already responded to these lawsuit announcements, saying that these allegations are "without merit" and that it intends "to vigorously defend against these baseless claims." You can read both law firms' statements via the source links.
Sources: Tom's Hardware, Rosen Legal Case 1269, Pomerantz Law Firm

The case is not based in AMD making contradictory statements but on AMD hidding key information. Toms hardware also confirms AMD changed the public position:

The basis of all of these lawsuits pertain to information listed on the AMD Security Updates page, and are frivolous in nature! Every statement AMD made still stands in their entirety, and unchanged on their security pages as testament and time line of proof exactly what they said. None of those statement make any of the other statements amount to "false information" that would be make it Securities Fraud. Which as I said before would have to imply that there is some contradiction in what they have stated.
https://www.amd.com/en/corporate/speculative-execution

 

[goldstone77]

Intel Releases Fixed Spectre Patch For Skylake CPUs
by Leon Chan February 8, 2018 at 6:15 AM
http://www.tomshardware.com/news/intel-fixed-spectre-patch-skylake,36477.html

Intel announced that it has released to its hardware partners a fixed version of its previously bugged Spectre-mitigating patch for Skylake CPUs.

After about two weeks since its last update on the issue, Intel would like us all to know that it hasn’t forgotten about fixing the faulty BIOS updates that were distributed en masse to patch the Spectre Variant 2 vulnerability in its CPUs. If this sounds sarcastic, it’s because it’s hard not to be after reading Intel’s latest progress update on its efforts. Yes, briefly mentioned in there is the statement that Intel has released a fixed microcode update to system OEMs for Skylake CPUs, but the other 65% is just to teach us all the importance of patching our systems because “as many as 85 percent of all targeted attacks can be prevented with – among other things – regular system updates.” That statement would be more relevant if the updates didn’t cause said systems to randomly reboot.
Sarcasm aside, at least Intel has made progress on the issue. The company’s last update said that progress had been made on root-causing the issue on Haswell platforms, but evidently that hasn’t bore fruit yet. Not only has Spectre 2 not yet been patched for a huge number of users, but a possibly equally huge number of users are currently stuck with the effects of Intel’s previous, bugged patch. Earlier, we reported that examples of Meltdown and Spectre exploits have already been spotted on the net, so what was once consolation in there being no evidence of Spectre-based exploits might be disappearing.

Intel’s microcode updates are given to system OEMs that distribute them to users in the form of system BIOS updates. Intel previously said that it had made available an interim patch without the Spectre Variant 2-related elements that was the cause of the random-reboots. We haven’t seen any system OEM release a BIOS update based on it, however. To help those with systems affected by the random-reboot issue in the meantime, Microsoft released a Windows-based kill-switch that is capable of nullifying Intel’s bugged patch.

 

[juanrga]

First optimizations of the patches are appearing. An user measured SSD performance under the last iteration of patches

https://www.reddit.com/r/hardware/comments/7w4as1/7700k_960_evo_250gb_meltdownspectre_20_ssd_write/

 

[8350rocks]

It's been around for a while now, so I can see why he would be "frustrated."

He is frustrated because Intel has done nothing but put out PR statements to deflect damage.

Not only that, their "patch" requires the user to opt-in manually. Additionally, it is a bunch of fluff that does what Linux is already doing, and is very poorly optimized code (I believe the specific remark was: "Did an intern spend a coffee break on this?").

So, Linux will now treat all Intel products as unsecure moving forward.

 

[juanrga]

So, Linux will now treat all Intel products as unsecure moving forward.

Linux treats all products (AMD, ARM, IBM, Intel,...) as unsecure, but the security patches are optional on linux for both AMD and Intel hardware. For instance adding the flags "noibrs noibpb nopti" to the boot line disables both Meltdown and Spectre patches for Intel hardware.

 

[8350rocks]

Linux treats all products (AMD, ARM, IBM, Intel,...) as unsecure, but the security patches are optional on linux for both AMD and Intel hardware. For instance adding the flags "noibrs noibpb nopti" to the boot line disables both Meltdown and Spectre patches for Intel hardware.

You have to opt-in to Intel's patch to begin with...

 

[gamerk316]

https://gizmodo.com/researchers-find-new-ways-to-exploit-meltdown-and-spect-1823020029

So yeah, we're probably going to see something in the wild soon.

 

[logainofhades]

Guys enough with the mile long quotes. Either edit them or don't use the feature.

 

[gamerk316]

Two new Meltdown/Specter variants discovered:

https://www.theregister.co.uk/2018/02/14/meltdown_spectre_exploit_variants/

 

[Turb0Yoda]

*spacepalm*

(only the discord regulars will get that)

 

[goldstone77]

Intel Targeted By 32 Lawuits For Meltdown And Spectre Vulnerabilities, Alleged Insider Trading
by Paul Alcorn February 16, 2018 at 9:30 AM
http://www.tomshardware.com/news/intel-ceo-lawsuit-meltdown-spectre,36538.html

The Meltdown and Spectre vulnerabilities have left the world's computers exposed to perhaps the most pervasive security vulnerability of our time, but they have also left Intel and the other companies involved exposed to lawsuits.

Intel filed its annual report with the U.S. Securities and Exchange Commission today, and a section buried in the document explains that the company has come under fire from 30 consumer class action lawsuits and two securities class action lawsuits because of the vulnerabilities.

Intel explains that the 30 consumer class action plaintiffs "claim to have been harmed by Intel's actions and/or omissions in connection with the security vulnerabilities" and seek monetary damages and equitable relief.

The two securities class action plaintiffs are shareholders who "allege that Intel and certain officers violated securities laws by making statements about Intel's products and internal controls that were revealed to be false or misleading by the disclosure of the security vulnerabilities." These lawsuits likely center on the fact that Intel, and the rest of the industry, kept the vulnerabilities under a shroud of secrecy as they worked on patches. Intel also continued to release new products, such as Coffee Lake, that were vulnerable to Meltdown and Spectre without divulging that they were selling potentially compromised products, which has been a common complaint.

• 
  Given the procedural posture and the nature of these cases, including that the proceedings are in the early stages, that alleged damages have not been specified, that uncertainty exists as to the likelihood of a class or classes being certified or the ultimate size of any class or classes if certified, and that there are significant factual and legal issues to be resolved, we are unable to make a reasonable estimate of the potential loss or range of losses, if any, that might arise from these matters.

Intel believes the cases have no merit, of course, and says it intends to defend itself vigorously. The company also acknowledges there may be more lawsuits lodged against it and that it cannot predict the long-term financial impact to its business. This seems to foreshadow a change to the messaging--the company has repeatedly said that it does not expect any material impact to its businesses.

It seems that the legal action is also ensnaring Intel CEO Brian Krzanich. The document outlines two more legal actions:

• 
  In addition to these lawsuits, in January 2018, Joseph Tola, Joanne Bicknese, and Michael Kellogg each filed a shareholder derivative action in the Superior Court of the State of California in San Mateo County against certain members of our Board of Directors and certain officers. The complaints allege that the defendants breached their duties to Intel in connection with the disclosure of the security vulnerabilities and the failure to take action in relation to alleged insider trading. The complaints seek to recover damages from the defendants on behalf of Intel.

The statement does not specifically mention Krzanich, but we know he has come under fire for his trading activity before the disclosure, and a U.S. senator, among many others, has also called for an SEC investigation into his activities. Now it appears that certain board members are also under fire for inaction on investigating possible insider trading.

Unfortunately, the saga continues to unfold on the vulnerability front. Researchers recently uncovered new variants that are covered by the recent patches, but the discovery shows how easy it is to develop new variants based on the fundamental principles behind the current vulnerabilities. That means that new 'strains' may emerge soon that aren't mitigated by the current patches.

It's notable that these current lawsuits could see the company easily eclipsing its previous $475 million charge for the Pentium FDIV bug in 1994 and the $700 million charge for the Cougar Point chipset issues in 2011. Intel has also not disclosed which customers have instituted these legal actions, but any legal action from a Super Seven data center customer, such as Google, Microsoft, or Baidu, could spell tremendous trouble for the company.

Intel is also contending with the distributed nature of the lawsuits, which are taking place in several countries and jurisdictions. The company will undoubtedly be untangling the legal mess for years to come. AMD has also come under fire from two lawsuits that we are aware of, but it wouldn't be surprising to see the company issue a similar statement soon.

I think a key take away is that the seriousness of these security threats are hardware based, and will require designs changes to the way predictive branch chain works. Intel owns the lion's share of the market, and will also own the lion's share of lawsuits. There is an evolution of these security vulnerabilities to create new methods of exploiting predictive branch chain. Many of us using older versions of Intel processors have the least amount of mitigation with no micro code updates to protect against Spectre, which can be exploited through a java based attack. Keep that in mind!

 

[gamerk316]

I'm going to ask a purely theoretical question: Would you purchase a Spectre-proof CPU if it comes at the cost of, say, 30% performance loss in HARDWARE to do so?

Because honestly, the more I look at the branch prediction problems, the more I'm convinced we're about to see a 20-30% hit in hardware performance.

 

[goldstone77]

I'm going to ask a purely theoretical question: Would you purchase a Spectre-proof CPU if it comes at the cost of, say, 30% performance loss in HARDWARE to do so?

Because honestly, the more I look at the branch prediction problems, the more I'm convinced we're about to see a 20-30% hit in hardware performance.

I think there are many who would take a 20-30% hit to performance for security. All governments and businesses would just because of national security and liability. Ordinary people might take the risk. I would rather be 100% secure!

 

[YoAndy]

I'm going to ask a purely theoretical question: Would you purchase a Spectre-proof CPU if it comes at the cost of, say, 30% performance loss in HARDWARE to do so?

Because honestly, the more I look at the branch prediction problems, the more I'm convinced we're about to see a 20-30% hit in hardware performance.

I think there are many who would take a 20-30% hit to performance for security. All governments and businesses would just because of national security and liability. Ordinary people might take the risk. I would rather be 100% secure!

In a gaming PC, it doesn't really matter.

 

[goldstone77]

I'm going to ask a purely theoretical question: Would you purchase a Spectre-proof CPU if it comes at the cost of, say, 30% performance loss in HARDWARE to do so?

Because honestly, the more I look at the branch prediction problems, the more I'm convinced we're about to see a 20-30% hit in hardware performance.

I think there are many who would take a 20-30% hit to performance for security. All governments and businesses would just because of national security and liability. Ordinary people might take the risk. I would rather be 100% secure!

In a gaming PC, it doesn't really matter.

99% of the population uses their computer for more than just gaming. And of those that only game on their PC, 0.01% of PC users?, what % of those not gaming online through steam, GOG, or some other online source. You are looking at possible hacking of accounts and being sold, which happens now without the widespread knowledge of these new vulnerabilities. Their are numerous ramifications and everyone is vulnerable, so I wouldn't try and down play these vulnerabilities to favor a very limited niche % of users.

 

[-Fran-]

I'm going to ask a purely theoretical question: Would you purchase a Spectre-proof CPU if it comes at the cost of, say, 30% performance loss in HARDWARE to do so?

Because honestly, the more I look at the branch prediction problems, the more I'm convinced we're about to see a 20-30% hit in hardware performance.

I think there are many who would take a 20-30% hit to performance for security. All governments and businesses would just because of national security and liability. Ordinary people might take the risk. I would rather be 100% secure!

In a gaming PC, it doesn't really matter.

99% of the population uses their computer for more than just gaming. And of those that only game on their PC, 0.01% of PC users?, what % of those not gaming online through steam, GOG, or some other online source. You are looking at possible hacking of accounts and being sold, which happens now without the widespread knowledge of these new vulnerabilities. Their are numerous ramifications and everyone is vulnerable, so I wouldn't try and down play these vulnerabilities to favor a very limited niche % of users.

Statistically and pedantically speaking, it should be 0%. You can talk about how you care little about your credentials in game portals such as Steam, Origin and other providers, or in-game login credentials, but that is a different topic, I guess.

I was also thinking... I remember the first news brought to light were about Intel's problems (Meltdown?), but then after that, Intel spilled the beans on the other vulnerabilities (Spectre?); does that mean they acted irresponsible and managed to put the burden on all code writers out there that were already pushed for time? I can't remember the exact information being leaked originally, but I don't recall the leaked information was the whole study published later on.

Cheers!

 

[YoAndy]

Meltdown-Spectre flaws: We've found new attack variants, say researchers
Intel and AMD may need to revisit their microcode fixes for Meltdown and Spectre.
http://www.zdnet.com/article/meltdown-spectre-flaws-weve-found-new-attack-variants-say-researchers/

 

[gamerk316]

I'm not surprised. The possible exposure to these types of attacks could be huge.

 

[YoAndy]

That's why I'm not updating anything till all these mess settle down.