back to article Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign

A fundamental design flaw in Intel's processor chips has forced a significant redesign of the Linux and Windows kernels to defang the chip-level security bug. Programmers are scrambling to overhaul the open-source Linux kernel's virtual memory system. Meanwhile, Microsoft is expected to publicly introduce the necessary changes …

Silver badge

Re: Hmmm...

Looks like the bug doesn't affect the J11 on my PDP 11/23 so I guess I'm OK.

4
0
Silver badge

Re: Hmmm...

It seems to be an architectural bug from what I'm seeing - probably related to the need for speed being the highest priority for marketing while security takes a back seat. We never worried about "security" in the old days of processor design, we were far more worried about incorrect access causing a crash and that took priority - with the result that modern security issues were mostly nonexistent.

1
1

Re: Intel Inside...

PC Specialist stopped being my go to around 3 years ago unfortunately, as the choices were becoming too restrictive. If I knew of a company as good as they once were, I'd throw business at them any day of the week!

2
0
Roo
Silver badge
Windows

Re: Hmmm...

"We never worried about "security" in the old days of processor design"

How old is old ? MMUs have been around a long time now.

"We never worried about "security" in the old days of processor design, we were far more worried about incorrect access causing a crash and that took priority - with the result that modern security issues were mostly nonexistent."

Seems to depend on where you worked - some vendors never embraced KISS. The protection features of the DEC Alpha were far easier to understand, use, test and verify than the equiv plumbing on the much older i386 for example.

4
0

Re: Intel Inside...

Good timing indeed. I've got plans to replace several aging PC/servers and AMD just leapfrogged to the top of the list (or should I say that Intel just step on their shoelaces and stumbled to the bottom).

4
0
Bronze badge
Unhappy

Re: Hmmm...

No, you don't get a new CPU, you get a software workaround.

There is no time like the present for China to become a world player in CPU design.

Around the turn of the millennium I was able to read and write SCO Unix kernel variables (specifically uptime) as root using a simple shell script. Utilities such as 'ps' likewise ran in user space and needed to read process tables from kernel memory.

1
2
Bronze badge
Windows

Re: Hmmm...

Anomalous Cowboy wrote: "But Windows has far more in depth performance diagnostic features off the shelf than Linux does?"

No, but the Windows performance monitor is more user-friendly.

5
0

Re: Hmmm...

If it helps, Minix, Mach, Hurd, Exec, and Fuchsia (okay, Zircon) won't suffer the 'slowness feature'. Less-than A aitch-ref equals https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_debate greater-than I'll wait for you to catch up less-than oblique a greater than.

0
4

Re: Hmmm...

If they do a bodge job for win7 o/s then many won't install the patch, if you have a good security suite installed then how can this be an issue?

0
0
Anonymous Coward

Re: Hmmm...

“you'll note that AMD submitted a Linux patch to ensure their CPUs weren't caught up in this, will MS do the same?”

We’ll find out, I guess - the two paths MS can take being “do we release patches that only impact performance on Intel” or “are we working together so closely with Intel that the competition authorities should be involved”?

3
0
Silver badge

Re: Hmmm...

Only for the parameters.

Once past that, the kernel could use a single page table entry to map to whatever user memory was needed.

For the intel processors.... this bug just about kills any microkernel which was already slow, now becomes 20% slower.

Microsofts hybrid microkernel is going to have fits with this.

1
0

Re: Hmmm...

Maybe MS getting on board with arm processors was foresight based on insider knowledge....

0
0
Silver badge

Re: Hmmm... @Primus Secundus Tertius

Depending on the CPU, it did have to save registers.

In other cases, the kernels did save registers as it could not determine BEFORE handling the interrupt, which task was going to be next.

The registers that took the longest was the FPU registers.

1
0
Silver badge

Re: Hmmm... @AC

That causes the instructions to stall - filling the pipeline with unusable instructions and no data.

1
0
Silver badge

Re: Hmmm...

Not really. "key parts of the" kernel are interrupt service functions... and they need to be able to address the entire memory.

Real mode sucks.

What is really needed is better architecture.

One set of registers for each interrupt, kernel, supervisor, user

at a MINIMUM. Then add separate cache for each level - though not necessarily all being the same size.

1
0
Silver badge

Re: Hmmm...

No - the hybrid kernel of Windows will have a much LARGER overhead.

1
0
Silver badge

Re: Hmmm...

I believe the added overhead in context switching will nail all the microkernels...

1
0
Silver badge

Re: Hmmm...

No, that was just Linux eating MS lunch again - and demonstrating perfectly usable desktops on the Pi and Arduino.

2
1
Silver badge

Re: Hmmm...

Yes, but the amount of stuff going on for almost no good reason whatsoever on a Windows PC is astonishing. Now massive overhead on top of those misbehaving apps... Worrying!

1
0
Silver badge

Re: Hmmm... @AC Might not even leak data

Rolling our massive changes for something as esoteric as that seems unlikely?

0
0
Silver badge

Re: Hmmm...

Fuc

0
0
Silver badge

Oh....

....crap.

23
0
Silver badge

KAISER?

I predict a riot...

23
0
Silver badge

Re: KAISER?

I predict a roll. Would you like poppy-seeds on that, sir?

Not sure if translates well outside of US delicatessens.

10
2
Silver badge
Flame

Crap indeed

Here I was, all happy with my i7 6700 that has served me well for the past two years, and now I learn that I'm basically going to have to replace the hardware if I want to stay secure and have good performance. What a nuisance.

Another round of Windows reinstall, with another fracking call to Redmond to justify that I am indeed the owner of this shit. I hate the idea already.

Ah, the day games are made for Linux first . . .

40
12
Gold badge
Unhappy

Re: KAISER?.. I predict a riot...

And are we sure this will be a complete solution?

5
0

Re: Crap indeed

My uneducated guess is that the brute force protection code is being implemented. This code should give Intel some time to arrive at a more sophisticated microcode solution where the overhead is perhaps one or two dozen microcode instructions. With a microcode fix, the patch can be removed, or made specific to certain models of CPU.

I like to be optimistic, not pessimistic. A low overhead fix will be developed AQAP. (As quickly as possible)

6
1

Re: Crap indeed

They say it is not possible to fix with microcode. Either be insecure, have huge slowdown, or buy an AMD CPU.

20
0
Silver badge

Re: Crap indeed

I'm quite happy to live with the security flaw on my home computers, so I hope this update is elective.

Did Mac OSX get mentioned in the article? I don't read that carefully.

3
6

Re: Crap indeed

I was thinking the same, but then I remembered that Linux also has to deal with this shit because it's on the CPU die itself.

10
1

Re: Crap indeed

"I'm quite happy to live with the security flaw on my home computers, so I hope this update is elective."

I was under the impression that MS is forcing updates whether you like it or not !!

9
0
Anonymous Coward

Re: Crap indeed

I'd be on Linux for gaming already if Star Citizen had a linux client.. Yes the game is miles from done but damn its' fun.

1
1

Re: Crap indeed

If the problem is memory fetching that does not check permissions before fetching ops or data that's under the level microcode works at and can't be fixed.

5
0

Re: Crap indeed

> I like to be optimistic, not pessimistic

You must be new here.

15
0

Re: Crap indeed

How many miles could you go in the next 4 years

0
0
Facepalm

Re: Crap indeed

A problem seems to be that the data is feed into the data pipeline (and L1 cache?) via speculative execution. To simplify the problem... if you have some code like:

if(false) {

x=some data that shouldn't work

} else {

do something slow

}

y=some data that shouldn't work

The x= gets the data loaded into the cache while the slow code is slow enough to make sure it gets there. Then the y= pulls data that is in the cache (and whatever makes up the other 64 bytes in its cache line) and that might not be checked against the permission bits in the virtual memory tables. I can't think of any situations where the x86 does speculative writes that would hit memory so this should be limited to reading data. The trick might work to slow down memory sharing on multi-core systems. x86 I/O sometimes is read based so that reading a memory location could resets a counter or buffer and that would be a problem limited to some i/o device. If someone can come up with a way to have the speculative data being read and then written back through the cache, the security game is over.

1
1

Re: Crap indeed

Isn't the Mach kernel in MacOS a microkernel? If so, wouldn't that mean that this wouldn't be an issue?

0
1
Silver badge

Re: Crap indeed

Unfortunately, this is below the microcode level.

1
0
Silver badge

Re: Crap indeed

Nope.

The problem appears to be context switching problems due to pipeline optimization.

The presented solutions will impact microkernels more than monolithic kernels as they have to do more context switching.

2
0
Silver badge

Re: Crap indeed

nope its hybrid kernel same as windows.

https://en.wikipedia.org/wiki/MacOS

1
0
GBE

I finally switch from AMD to Intel, and this is what happens.

It's my fault. For decades I bought AMD processors instead of Intel. The last time around, I finally broke down and bought Intel...

63
1
Silver badge

Re: I finally switch from AMD to Intel, and this is what happens.

I find buying AMD like not buying Windows - some else always makes the savings.

3
19
Anonymous Coward

Re: I finally switch from AMD to Intel, and this is what happens.

I considered AMD, having recently bought a Xeon for a personal server. I wonder where we stand legally now? IANAL but surely the chips we have, once patched, will no longer be performing as advertised?

39
1
Anonymous Coward

Re: I finally switch from AMD to Intel, and this is what happens.

Just change the battery.

17
4
Silver badge

Re: I finally switch from AMD to Intel, and this is what happens.

"IANAL but surely the chips we have, once patched, will no longer be performing as advertised?"

I was thinking something similar. The Lenovo laptop I bought less than 18 months ago is still in warranty so is it reasonable to ask for a refund/replacement?

24
0
Silver badge
Trollface

Re: I finally switch from AMD to Intel, and this is what happens.

I'm typing this from a PC with an AMD CPU and running Ubuntu. Aren't I feeling smug right now.

Given how many people are affected, I can't see Intel replacing the hardware for free. This is worse than the infamous Intel floating point math bug.

I'm now waiting for people to re-run loads of benchmarks after the patches come out to see how much performance was lost.

51
3

Re: I finally switch from AMD to Intel, and this is what happens.

2017 was truly AMD's year. First they introduced several interesting CPUs (if you are into multi-core designs), followed by some decent GPUs, and now this.

I switched from AMD when Intel introduced Core 2 Duo. This year I think i will switch back to AMD. Finally some competition (again)!

46
1
Bronze badge

Re: I finally switch from AMD to Intel, and this is what happens.

Intel's CEO Just Sold a Lot of Stock

https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot-of-stock.aspx

(Via Jackie Stokes)

63
0
Bronze badge

Re: I finally switch from AMD to Intel, and this is what happens.

Indeed. I've already been leaning toward avoiding Intel processors in future hardware purchases. This pretty much decides it, as I now wish I'd gotten off the fence a few years ago.

21
0

"I wonder where we stand legally now?"

If you are a UK based consumer (not business) you have up to 6 years to make a claim against the business that sold you the CPU (not Intel) because of the wonderful Consumer Rights Act. If the manufacturer admits the fault, then all the relevant criteria have been met. A 30% performance loss would be considered unreasonable without compensation.

The "First 6 months" and "since months or more" paragraphs on the Which website explain it best here https://www.which.co.uk/consumer-rights/regulation/consumer-rights-act

30
0

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Forums

Biting the hand that feeds IT © 1998–2018