'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

Solution? Upgrade to AMD!

 

Mailing list message:
Disable SMT/Hyperthreading in all Intel BIOSes
"SMT is fundamentally broken"
August 23, 2018
https://marc.info/?l=openbsd-tech&m=153504937925732&w=2

 

Qubes OS also disabled SMT/HT by default:

https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-043-2018.txt

 

Foreshadow, SGX & the Failure of Trusted Execution
September 8, 2018
https://www.darkreading.com/cloud/foreshadow-sgx-and-the-failure-of-trusted-execution/a/d-id/1332733

 

Given that trusted execution was going to be used primarily to implement DRM, I am not sad about this.

 

New SpecuCheck release:

Link: https://github.com/ionescu007/SpecuCheck/releases/tag/v1.1.0

Latest release with SSBD and L1TF support.

Link: https://twitter.com/aionescu/status/1045831647730401280

Link: https://twitter.com/aionescu/status/1045831916983803905

 

I ran this latest SpecuCheck, but I don't know if what I got is meaningful:

 

yeah I don't know if my results are good, bad or somewhere in between.

 

I compared mine to yours, and there are differences. But, what it means: I haven't a clue! But, I am not too concerned.

 

Here is mine as it is currently:

 

It is not so user-friendly, for sure. All that I know is that green is good (whether answer is Yes or No) and red is bad.

Your SpecuCheck output shows that the system is missing several components (model-specific register (MSR)) from the microcode. The output is more technical as opposed to user-friendly, but you could always copy and paste certain parts, such as "SPEC_CTRL MSR (048h)". But even in that case, Intel documentation is sometimes lacking with the more current details.

Your output seems to show all of the appropriate microcode related updates. Although it's missing the "SPEC_CTRL MSR (048h)" support similar to mine.

 

A nice that SpecuCheck is still alive, with their last release in January I thought development was dead.
There have been 2 microcode updates with sidechannel migitations so far, 1 after the original Spectre and one for SSBD and L1TF. It looks like WildByDesign and wat0114 only have the first microcode update, and Tarnak has both. Without the second, you don't have SSBD mitigations, but it looks like for L1TF there is still some OS migitation("With KVA Shadow and Invalid PTE Bit".) I don't know however if that is effective without the microcode update.
The other red No's:
-Unnecessary due lack of CPU vulnerability: the latest Intel CPU's are not vulnerable to these, so they dont need the mitigations.(Afaik they're only not vulnerable to these specific attacks, the design is still the same with all kinds of insecure speed features like the speculative execution and hyperthreading, so I wouldn't buy a new CPU because of this until they make major architectural changes.
-Branch Prediction Migitations Optimized and Import Adress Table Optimizations: not sure about these ones, sounds similar to the PCID and INVPCID features of newer CPU's which allow for better performance. (Those 2 features are the ones InSpectre looks for.)
-SPEC_CTRL_MSR (048h): I don't know what this is. I have the second microcode update for SSBD/L1TF but this is also a No for me.

 

@WildByDesign ,@BoerenkoolMetWorst

Thank you both for your replies. This is all too technical for me, but I hope to understand, eventually. BTW, I am still running build 1703, which is coming to end of service on October 9, 2018. - https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet

 

Spectre and Meltdown Hardware Protection Added to Intel's 9th Gen CPUs
October 8, 2018
https://www.bleepingcomputer.com/ne...ware-protection-added-to-intels-9th-gen-cpus/

 

SpecuCheck v1.1.1 Released (October 16, 2018)
Download

 

MIT researchers say memory splitting breakthrough could prevent another Meltdown or Spectre
October 17, 2018
https://techcrunch.com/2018/10/17/m...uld-prevent-another-meltdown-or-spectre-flaw/

 

Windows 10 19H1 will reduce the impact of Spectre Mitigation to “noise level”
October 19, 2018
https://mspoweruser.com/windows-10-19h1-will-reduce-the-impact-of-spectre-mitigation-to-noise-level/

 

The Intel Microcode Boot Loader Protects Older CPUs From Spectre
November 12, 2018
https://www.bleepingcomputer.com/ne...boot-loader-protects-older-cpus-from-spectre/

 

Great! I hope an option will be available in a next version to put the bootloader on the HDD so it doesn't require always booting from USB.

 

Spectre, Meltdown researchers unveil 7 more speculative execution attacks

https://arstechnica.com/gadgets/201...-unveil-7-more-speculative-execution-attacks/

 

More Spectre/Meltdown-Like Attacks

https://www.schneier.com/blog/archives/2018/11/more_spectremel.html

 

Researchers discover SplitSpectre, a new Spectre-like CPU attack

https://www.zdnet.com/article/researchers-discover-splitspectre-a-new-spectre-like-cpu-attack/

 

New side-channel leak: Boffins bash operating system page caches until they spill secrets

https://www.theregister.co.uk/2019/01/05/boffins_beat_page_cache/

 

Linux Kernel Spectre Protection Changes to Boost App Performance

https://www.bleepingcomputer.com/ne...-protection-changes-to-boost-app-performance/

 

'This collaboration is absolutely critical going forward'... One positive thing about Meltdown CPU hole? At least it put aside tech rivalries...

https://www.theregister.co.uk/2019/02/15/vulnerability_experts_blab/