'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

wat0114 · Mar 18, 2018

With the strict site isolation flag enabled, along with an ad and script blocking extension, there's little need for concern about a javascript-based cpu side channel attack anyway.

HempOil · Mar 19, 2018

wat0114 said: ↑

With the strict site isolation flag enabled, along with an ad and script blocking extension, there's little need for concern about a javascript-based cpu side channel attack anyway.
Click to expand...

I have done all of those things. However, ChromeZero does a number of interesting mitigations that I'm not sure are completely redundant with the ones you mention. Here is a great article describing what ChromeZero does.

BoerenkoolMetWorst · Mar 19, 2018

Is there an explanation on how Strict Site Isolation is supposed to migitate Spectre? Spectre allows to read memory of other processes, so while putting each website in it's own process is a great security feature overall, it seems useless against Spectre.

wat0114 · Mar 19, 2018

HempOil said: ↑

I have done all of those things. However, ChromeZero does a number of interesting mitigations that I'm not sure are completely redundant with the ones you mention. Here is a great article describing what ChromeZero does.
Click to expand...

Agreed Chrome Zero might help, but in its current state it seems too buggy.

BoerenkoolMetWorst said: ↑

Is there an explanation on how Strict Site Isolation is supposed to migitate Spectre? Spectre allows to read memory of other processes, so while putting each website in it's own process is a great security feature overall, it seems useless against Spectre.
Click to expand...

Yes:

https://www.chromium.org/Home/chromium-security/site-isolation

paulderdash · Mar 20, 2018

WildByDesign said: ↑

Yes, this is correct. You can either do FeatureSettingsOverride '1' and FeatureSettingsOverrideMask to '1' or FeatureSettingsOverride '1' and FeatureSettingsOverrideMask to '3' and both seem to achieve the same effect of having Spectre mitigation disabled while still keeping the Meltdown mitigation enabled. Whereas FeatureSettingsOverride '3' and FeatureSettingsOverrideMask to '3' would disable both mitigations.

InSpectre set mine to FeatureSettingsOverride '1' and FeatureSettingsOverrideMask to '3'. It's as if I've bought a brand new computer, performance wise.
Click to expand...

Just got a new BIOS update (to 1.36.1.36) for my Haswell ThinkPad, which I presume is the revision to the 'botched' earlier update (to 1.35.1.35, 27 Dec 2017) to address Meltdown and Spectre.

Maybe not though, as I notice my settings are still set to FeatureSettingsOverride '1' and FeatureSettingsOverrideMask to '3' as I had left them (unless the BIOS update does not reset them).

Will leave as is, because I'd rather not reintroduce the performance issues I experienced previously.

guest · Mar 20, 2018

Microsoft Releases New Meltdown and Spectre Patches for Surface Pro
March 2018 firmware update brings new mitigations
March 20, 2018
http://news.softpedia.com/news/micr...-spectre-patches-for-surface-pro-520308.shtml

Only the Surface Pro and the Surface Pro with LTE Advanced are getting this new firmware update, and as it happens every time, it’s shipped via Windows Update for all devices.

According to Microsoft itself, the new release comes with firmware version Surface – Firmware – 233.2110.770.0, which includes fixes for potential security vulnerabilities, such as mitigations for the Meltdown and Spectre vulnerabilities disclosed in early January.

These new fixes integrate additional patches against the Spectre Variant 2 security flaw [...]
Of particular note is that Microsoft is still not aware of any exploits targeting the Meltdown and Spectre flaws.
Click to expand...

WildByDesign · Mar 20, 2018

paulderdash said: ↑

Maybe not though, as I notice my settings are still set to FeatureSettingsOverride '1' and FeatureSettingsOverrideMask to '3' as I had left them (unless the BIOS update does not reset them).

Will leave as is, because I'd rather not reintroduce the performance issues I experienced previously.
Click to expand...

BIOS update does not change those registry keys once they are set manually. You can leave as is or experiment later on by deleting those registry keys. Or better yet, use the InSpectre tool since it is a GUI, run as Admin, and you can enable/disable as you like in a much easier way compared to editing registry. Ensure you reboot after making a change to the key.

Please let me know your experience as well because I am curious as to how much of a performance hit you get on your Haswell.

paulderdash · Mar 20, 2018

WildByDesign said: ↑

BIOS update does not change those registry keys once they are set manually. You can leave as is or experiment later on by deleting those registry keys. Or better yet, use the InSpectre tool since it is a GUI, run as Admin, and you can enable/disable as you like in a much easier way compared to editing registry. Ensure you reboot after making a change to the key.

Please let me know your experience as well because I am curious as to how much of a performance hit you get on your Haswell.
Click to expand...

Thanks WBD. Will let you know when / if I give it a go (with InSpectre).

Keatah · Mar 20, 2018

klarm said: ↑

we got * by intel and I will never forgive them for this.
I would just liked that this happened 15 years ago. It would be a very different tune than.
I hope they get distroyed in courts but In this day of age...
Click to expand...

Never happen, their stock is at an all-time high. And the common man outside of IT knows nothing of this dust up. Nor would he care.

Minimalist · Mar 22, 2018

Google is distributing more Meltdown and Spectre Patches for Chrome OS devices

Google announced that mitigations for devices with Intel processors that are affected by the Spectre and Meltdown vulnerabilities will be available for latest stable channel update for Google’s Chrome OS operating system.
Click to expand...

http://securityaffairs.co/wordpress/70561/hacking/chrome-os-meltdown-spectre.html

bo elam · Mar 23, 2018

I have been following up the link below, to see when the BIOS update for my Dell W10 would get posted. I opened the link today and saw it was first posted about 3 weeks ago, and there was an update to it about 10 days later. This kind of updates scare me a bit but I went ahead and did it. It was fast, so fast there was no time for sweating or nothing. All looks good afterward. System feels well, no new Events log errors or Warnings which I think I read here some users got after updating the Bios. That would a bothered me a lot if I got something new.

Others users with Dell computers can check this link for the update for their computers.
http://www.dell.com/support/article...cve-2017-5754-impact-on-dell-products?lang=en

Bo

reasonablePrivacy · Mar 23, 2018

Phoronix benchmarked Windows alongside Gnu/Linux distributions Ubuntu and Clear Linux to see what impact on performance do mitigations have. These benchmarks were database benchmarks or other utility-tools benchamarks.
A Look At The Relative Spectre/Meltdown Mitigation Costs On Windows vs. Linux

WildByDesign · Mar 23, 2018

KVA Shadow: Mitigating Meltdown on Windows
Link: https://blogs.technet.microsoft.com/srd/2018/03/23/kva-shadow-mitigating-meltdown-on-windows/

On January 3rd, 2018, Microsoft released an advisory and security updates that relate to a new class of discovered hardware vulnerabilities, termed speculative execution side channels, that affect the design methodology and implementation decisions behind many modern microprocessors. This post dives into the technical details of Kernel Virtual Address (KVA) Shadow which is the Windows kernel mitigation for one specific speculative execution side channel: the rogue data cache load vulnerability (CVE-2017-5754, also known as “Meltdown” or “Variant 3”). KVA Shadow is one of the mitigations that is in scope for Microsoft's recently announced Speculative Execution Side Channelbounty program.
Click to expand...

Great blog post and highly technical in detail.

EDIT:

Conclusion
Mitigating hardware vulnerabilities in software is an extremely challenging proposition, whether you are an operating system vendor, driver writer, or an application vendor. In the case of rogue data cache load and KVA shadow, the Windows kernel is able to provide a transparent and strong mitigation for drivers and applications, albeit at the cost of additional operating system complexity, and especially on older hardware, at some potential performance cost depending on the characteristics of a given workload. The breadth of changes required to implement KVA shadowing was substantial, and KVA shadow support easily represents one of the most intricate, complex, and wide-ranging security updates that Microsoft has ever shipped. Microsoft is committed to protecting our customers, and we will continue to work with our industry partners in order to address speculative execution side channel vulnerabilities.
Click to expand...

ronjor · Mar 28, 2018

Intel shrugs off ‘new’ side-channel attacks on branch prediction units and SGX

By Simon Sharwood, APAC Editor 28 Mar 2018
Been there, mitigated that, got the class actions, says Chipzilla
Click to expand...

porrkanon · Mar 30, 2018

new bios for my asus z170i pro gaming finally arrived. not installed it yet. can i expect any trouble you think?

BoerenkoolMetWorst · Apr 3, 2018

Intel Microcode Revision Guidance, updated April 2 2018:
hxxps://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf
Spoilers: Microcode development for a lot of older CPU's has stopped.

XIII · Apr 4, 2018

BoerenkoolMetWorst said: ↑

Spoilers: Microcode development for a lot of older CPU's has stopped.
Click to expand...

Indeed; no fix for my E8400 after all...

guest · Apr 4, 2018

Intel Reveals Some CPU Models Will Never Receive Microcode Updates
April 4, 2018
https://www.bleepingcomputer.com/ne...-models-will-never-receive-microcode-updates/

Intel released an update to the Meltdown and Spectre mitigation guide, revealing that it stopped working on mitigations for some processor series.
Intel has constantly updated the document in the past weeks with new information about processor series and the microcode firmware version number that includes patches for the Meltdown and Spectre flaws.

List of CPU models that won't receive microcode updates
An update published on Monday includes for the first time a "Stopped" production status. Intel says that processors with a "Stopped" status will not receive microcode updates.

The reasons basically vary from "redesigning the CPU micro-architecture is impossible or not worth the effort" to "it's an old CPU" and "customers said they don't need it."
Reviewing the document, we see that the following Intel processor products received a "Stopped" status marker: [...]
Click to expand...

guest · Apr 11, 2018

Microsoft, AMD Release New Microcode Updates Against Spectre Vulnerability
Windows users getting new Spectre patches
April 11, 2018
http://news.softpedia.com/news/micr...es-against-spectre-vulnerability-520625.shtml

AMD says that while Linux users received such updates earlier this year, Windows users needed additional protection against Spectre Variant 2, despite the company admitting that “it is very difficult to exploit” this particular vulnerability on its own processors.

Windows 10 users can get the new patch as part of this month’s cumulative update labeled as KB4093112 in Windows Update and also available separately on the Microsoft Update Catalog website. Only systems that are running the Windows 10 Fall Creators Update (version 1709) are getting the new Spectre patch, while Windows Server 2016 machines should receive them soon after final validation and testing.
Up-to-date Windows users fully protected
AMD says its customers are already protected against Spectre Variant 1 thanks to operating system updates that were released by Microsoft earlier this year, while the Meltdown vulnerability does not impact its processors because of the used design.

In addition to the updates that Microsoft released for Spectre Variant 2, AMD is offering microcode updates that can be installed by updating the BIOS.
Click to expand...

guest · Apr 11, 2018

InSpectre Release #8 v0.0.6675.8 (April 11, 2018)
Website
What's New:

Release #8 — Now shows whether an Intel microcode patch is (ever) available for Spectre.
Intel has finished designing microcode update patches for its processors. On April 2nd, 2018, they announced that processors that have not yet been patches will never be patched. Their full statement is available in this PDF document: https://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf
In that document, Intel specifies which of their many processors do have patches and which of their more recent processors will never receive updated firmware. Now that the industry has this information, this 8th release of InSpectre incorporates that list of CPUIDs and displays whether microcode firmware updates exist for the system's Intel CPU.

Click to expand...

guest · Apr 12, 2018

mood said: ↑

InSpectre Release #8 v0.0.6675.8 (April 11, 2018)
Website
Click to expand...

New InSpectre release reveals if microcode updates are available
April 12, 2018
https://www.ghacks.net/2018/04/12/new-inspectre-release-reveals-if-microcode-updates-are-available/

Gibson Research released several InSpectre updates that improved the application's functionality. Release 7 listed information about the CPUID, and yesterday's new release, Release 8, shows to you whether a microcode update is available or not.

Intel revealed recently that it won't publish microcode updates for processors that the company has not patched already. The company published a PDF document entitled "Microcode revision guidance" which reveals processors with and without microcode updates.

Gibson's program uses the list to highlight whether microcode updates are available for the device's CPU.
Closing Words
InSpectre offers one of the easiest ways to find out if a Windows system is fully patched against Spectre or Meltdown vulnerability attacks. The new version shows whether Intel released an microcode update for the process which should make things easier as well.
Click to expand...

Krusty · Apr 12, 2018

Does anyone have any suggestions where I can download the Microcode Update for my old Acer? It is not available on the Acer site and they haven't supported it since it ran out of warranty.

WildByDesign · Apr 12, 2018

@Krusty The fixed microcode is available (https://downloadcenter.intel.com/download/27591/Linux-Processor-Microcode-Data-File), however you may need to wait until Microsoft pushes an update for your specific CPU. Other methods like VMWare Microcode Update Driver for Windows seem to be not very reliable with recent versions of Windows, unfortunately.

Are you running Legacy BIOS or UEFI? There may be some BIOS hacking tutorials out there but that can be sketchy and dangerous.

Krusty · Apr 12, 2018

WildByDesign said: ↑

@Krusty The fixed microcode is available (https://downloadcenter.intel.com/download/27591/Linux-Processor-Microcode-Data-File), however you may need to wait until Microsoft pushes an update for your specific CPU. Other methods like VMWare Microcode Update Driver for Windows seem to be not very reliable with recent versions of Windows, unfortunately.

Are you running Legacy BIOS or UEFI? There may be some BIOS hacking tutorials out there but that can be sketchy and dangerous.
Click to expand...

Thanks but that looks to be for Linux. My machines are Win10 x64.

The Acer has a Legacy BIOS and I have an old Lenovo that gets the same result from InSpectre. That machine is UEFI.

Tinstaafl · Apr 13, 2018

Microsoft is pushing out the microcode update to the latest version of Windows 10 through Windows update.

https://support.microsoft.com/en-us/help/4090007/intel-microcode-updates

http://news.softpedia.com/news/micr...es-against-spectre-vulnerability-520625.shtml

This article explains the two routes for distributing a microcode update: 1. system firmware; 2. operating system. https://arstechnica.com/gadgets/201...t-shipping-the-intel-spectre-microcode-fixes/

Log in or Sign up

'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

wat0114 Registered Member

HempOil Registered Member

BoerenkoolMetWorst Registered Member

wat0114 Registered Member

paulderdash Registered Member

guest Guest

WildByDesign Registered Member

paulderdash Registered Member

Keatah Registered Member

Minimalist Registered Member

bo elam Registered Member

reasonablePrivacy Registered Member

WildByDesign Registered Member

ronjor Global Moderator

porrkanon Registered Member

BoerenkoolMetWorst Registered Member

XIII Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Krusty Registered Member

Attached Files:

InSpectre.PNG

WildByDesign Registered Member

Krusty Registered Member

Tinstaafl Registered Member

Log in or Sign up

'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

wat0114 Registered Member

HempOil Registered Member

BoerenkoolMetWorst Registered Member

wat0114 Registered Member

paulderdash Registered Member

guest Guest

WildByDesign Registered Member

paulderdash Registered Member

Keatah Registered Member

Minimalist Registered Member

bo elam Registered Member

reasonablePrivacy Registered Member

WildByDesign Registered Member

ronjor Global Moderator

porrkanon Registered Member

BoerenkoolMetWorst Registered Member

XIII Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Krusty Registered Member

Attached Files:

InSpectre.PNG

WildByDesign Registered Member

Krusty Registered Member

Tinstaafl Registered Member

Useful Searches