Intel 'Downfall': Severe flaw in billions of CPUs leaks passwords and much more

They should name them after their investors and board members.

Sounds like Bond movies.

can't wait for "shellshock", "wildfire" and "collapse".

"whew* my horrible bubble sort implementation is safe from performance impacts

I just skimmed through the article and it seems like this vulnerability is only really meaningful on multi-user systems. It allows one user to access memory dedicated to other users, letting them read stuff they shouldn't. I would expect that most consumer gaming computers are single-user machines, or only have user accounts for trusted family members and whatnot, so if this mitigation causes too much of a performance hit I expect it won't be a big risk to turn it off for those particular computers.

It’s not they aren’t impacted only you “don’t see the impact” as noticeably.

As a programmer: compile times

This does sound like planned obsolescence to me...

Oop CPU sales are down! Leak one of our critical flaws to force people to upgrade!

Just feels like Prism all over again.

Anti virus companies has also been caught making viruses.

A lot of shady shit happens when there is money and power to be had.

I was going to say, AMD had a flaw of similar severity. And they won't have a fix for a few months for most affected CPUs, and that fix will likely incur a loss in performance.

Basically it sounds like both of these flaws are due to the security chip. I can't help but feel like these flaws are by design. /tinfoil

Downfall was disclosed to Intel a year ago but was on embargo until this week. Can't help but suspect that Intel waited for AMD to be impacted by a similar event to reveal downfall

From what I’m reading, Inception is a pretty minor vulnerability, especially compared to downfall.

So they created a massive vulnerability by misimplementing speculative execution which promised a, what, 10% speed gain tops and now that it was discovered you have to patch it and lose 50%? Genius.

50% 💀

Good supplier for an offline supercluster 😄 I'll let my grant manager know.

Dont the older chips suffer from a greater performance drop from spectre and meltdown vulnerabilities?

This inspires confidence with my 2010 ass toshiba sattelite with an i5 and 8gb DDR3. I need to look and see if mine is too old lol.

Well, maybe you can pirate Cortana and whatever other bloatware to catch up.

Recall billions of processors?

I hate Intel as much as the next person, but I don't want them to disappear overnight generating a unimaginably large processor shortage.

ELI5, or ELIAFYCSS (Explain like I'm a first year CS student): modern x86 CPUs have lots of optimized instructions for specific functionality. One of these is "vector instructions", where the instruction is optimized for running the same function (e.g. matrix multiply add) on lots of data (e.g. 32 rows or 512 rows). These instructions were slowly added over time, so there are multiple "sets" of vector instructions like MMX, AVX, AVX-2, AVX-512, AMX...

While the names all sound different, the way how all these vector instructions work is similar: they store internal state in hidden registers that the programmer cannot access. So to the user (application programmer or compiler designer) it looks like a simple function that does what you need without having to micromanage registers. Neat, right?

Well, problem is somewhere along the lines someone found a bug: when using instructions from the AVX-2/AVX-512 sets, if you combine it with an incorrect ordering of branch instructions (aka JX, basically the if/else of assembly) you get to see what's inside these hidden registers, including from different programs. Oops. So Charlie's "Up, Up, Down, Down, Left, Right, Left, Right, B, B, A, A" using AVX/JX allows him to see what Alice's "encrypt this zip file with this password" program is doing. Uh oh.

So, that sounds bad. But lets take a step back: how bad would this affect existing consumer devices (e.g. Non-Xeon, non-Epyc CPUs)?

Well good news: AVX-512 is not available on most Intel/AMD consumer CPUs until recently (13th gen/zen 4, and zen 4 isn't affected). So 1) your CPU most likely doesn't support it and 2) even if your CPU supports it most pre-compiled programs won't use it because the program would crash on everyone else's computer that doesn't have AVX-512. AVX-512 is a non-issue unless you're running Finite Element Analysis programs (LS-DYNA) for fun.

AVX-2 has a similar problem: while released in 2013, some low end CPUs (e.g. Intel Atom) didn't have them for a long time (this year I think?). So most compiled programs wouldn't compile with AVX-2 enabled. This means whatever game you are running now, you probably won't see a performance drop after patching since your computer/program was never using the optimized vector instructions in the first place.

So, the affect on consumer devices is minimal. But what do you need to do to ensure that your PC is secure?

Three different ideas off the top of my head:

1. BIOS update. The CPU has a some low level firmware code called microcode which is included in the BIOS. The new patched version adds additional checks to ensure no data is leaked.
2. Update the microcode package in Linux. The microcode can also be loaded from the OS. If you have an up-to-date version of Intel-microcode here this would achieve the same as (1)
3. Re-compile everything without AVX-2/AVX-512. If you're running something like Gentoo, you can simply tell GCC to not use AVX-2/AVX-512 regardless of whether your CPU supports it. As mentioned earlier the performance loss is probably going to be fine unless you're doing some serious math (FEA/AI/etc) on your machine.

You can't just search for your processor in a database I mean fuck that would take them at least an a couple hours of their precious time to set up and they have only had a year. How do you fix it?

This page tells you how to get your CPUID: https://www.intel.com/content/www/us/en/support/articles/000006831/processors/processor-utilities-and-programs.html

Then search for the CPUID here: https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html

Are you using Windows or macOS? If so you don’t have to do anything. You can just wait and a new update will be available to you soon.

I just found this on the page where they list effected models:

"Note The latest software can be obtained through operating system or VMM vendors"

It'll probably just be something that happens through ordinary OS updates tbh (though I understand you'd rather know one way or another.)

Guess it’s time for another FPS hit…

Is it August already? Man, time flies.

My poor aging computer :(

I would say you'll be fine. Most games don't compile with avx-2 anyways since it'll crash if you run it on something that doesn't have them (which is a lot of CPUs) and AVX-512 is straight up only available on Xeons, Epyc and zen 4. Nobody is going to use that for consumer software.

The only game I can think of using AVX is a Skyrim mod for realistic physics, where the author provided binaries for AVX-2/AVX-512. So it won't affect most compiled applications much since you need to compile with it first (which almost nobody does).

Shared use of servers is probably the main issue

It appears that users in this case include agents such as software. A bit confusing for the general public.

For instance, a malicious app obtained from an app store could use the Downfall attack to steal sensitive information like passwords, encryption keys, and private data such as banking details, personal emails, and messages.

—Official website

It can theoretically even be exploited via a browser:

[Q] What about web browsers?

[A] In theory, remotely exploiting this vulnerability from the web browser is possible. In practice, demonstrating successful attacks via web browsers requires additional research and engineering efforts.

—FAQ at the official website

I think it also means software running can access other software's memory which is probably bad but personally I'm not keen for that performance hit on my desktop

I can't comment on the general trend, but this specific one seems a bit too circumstantial to be of use for a serious spying effort. You'd have to have the spyware running parallel to the apps usong passwords you want to steal in a specific way.

The risk exists, which is bad enough for stochastic reasons (eventually, someone will get lucky and manage to grab something sensitive, and since the potential damage from that is incalculable, the impact axis alone drives this into firm "you need to get that fix out asap), but probably irrelevant in terms of consistency, which would be what you'd need to actually monitor anyone.

If you manage to grab enough info to crack some financial access data, you can steal money. If you can take over some legit online account or obtain some email-password combo, you can sell it. But if you want to monitor what people are doing in otherwise private systems, you need some way to either check on demand or log their actions and periodically send them to your server.

It would be far more reliable to have injection backdoors to allow you access by virtue of forcing a credential check to come up valid than to hope for the lucky grab of credentials the user might change at an arbitrary moment in time.

Check out the documentary Zero Days (2016) if you haven’t already. That’s not really a tinfoil hat take these days IMO.

On the plus side now we can steal the info from the criminal's computers. The cycle of internet life...

Isn't that convenient?

Oh don't worry, you'll hear about that vulnerability in two years.

cries in 11th gen laptop*

If it's anything like the industry that I work in, the CEO would have been informed of the short comings of the design numerous times and given a response along the lines of "does it make our CPUs faster and more powerful though?".

The CEO won't be pissed of at his chip designer, they'll be pissed because they've been caught out.

Given that the AMD vulnerability was called "Inception," maybe they just like using movie titles to name CPU vulnerabilities?

...All Ryzen and Epyc processors were found to have a very similar bug not too long ago, it's actually addressed in the article. You might want to read it...

Sure, buddy

No luck, it's a systemic issue (practice):

Update: Intel’s Downfall was closely followed by AMD’s Inception, a newfound security hole affecting all Ryzen and Epyc processors. The first independent testing of the mitigation microcode patches show that it can drastically lower performance in certain workloads. We’ve included details throughout this post.

I got a 10400F because AMD completely abandoned the budget segment at that time.