Massive CPU Security Flaws Revealed

I would probably wait for CPUs with meltdown/spectre mitigations to be released before buying, yeah.

Also,
220px-Baltar_Season_3

Intel is really really having a bad week

https://www.amd.com/en/corporate/speculative-execution

Cool. Under that nomenclature (Project Zero), variant 3 is what’s described elsewhere as Meltdown. Variants 1 and 2 are Spectre.

I’ve seen mentions that SSD access is the biggest impact, but can’t seem to nail down whether it’s part of the Meltdown fix, or if it will affect AMD as well. Anyone know more?

syscalls (user <—> kernel transitions) are generally what’s getting more expensive for meltdown mitigations, so it make sense that IO operations would be hit hard. I don’t, however, have specific data to offer, just a sanity check.

Spectre mitigations (most of them) are an entirely different ballgame and involve obfuscations of the branch predictors. Consider, for example, retpolines as proposed in the LLVM patches here: ⚙ D41723 Introduce the "retpoline" x86 mitigation technique for variant #2 of the speculative execution vulnerabilities disclosed today, specifically identified by CVE-2017-5715, "Branch Target Injection", and is one of the two halves to Spectre...

Another restart sometime between 4PM and midnight tonight, again with no indication it performed updates. . . kinda thinking I’m hit by whatever Haswell reboot bug Intel was warning about earlier.

Fuck.

Good Bloomberg story on what happened behind the scenes

https://www.bloomberg.com/news/articles/2018-01-08/-it-can-t-be-true-inside-the-semiconductor-industry-s-meltdown

Asus BIOS update is out.

That really clarifies things for the less technical among us. Thanks.

I am baffled about how they expect to distribute these changes to home users and small businesses without dedicated IT support. There’s no push system for BIOS updates, is there? It seems like they are counting on people to follow the tech news and react appropriately. Almost nobody will.

They don’t. Vast numbers of people are never going to update.

I have a Z68 mobo, which isn’t on the list, so guess I’m ok there.

Or they’re just not supporting that board any more.

I suppose you are right, but there are still a ton of sandy bridge machines out there. Processors haven’t gotten all that much faster in the last seven years.

Sandy Bridge is definitely vulnerable. I’m not sure Intel has even released a microcode update for it though.

I never got the Windows Creator update installed, it gets stuck every time at 81% (system reboots, screen goes to black, restart, update restarts, hits 81%, restart the computer, Windows reverts.) Since I have Windows Home - which doesn’t allow any administrative tools such as group policy and the like - I cannot stop it from updating. Previous to this bug I just kept rescheduling it - but now I can’t and I have to go through this reboot/revert process multiple times per day. I’m trying yet another ‘fix’ provided by microsoft tech support, but so far, no luck.

Funny (not funny) thing is I was going to get a new PC, but between got hit with a massive number of home repair bills. Anyhoo, never again will I ever get a “Home” edition.

I got my Asus Z170-A upgraded, but damn if asus’ website isn’t all full of crap that is worthless. So many different pages, with bios, versions, where you can download them, but then the instructions to actually flash it assume you know WTF how to get into their flash utility

Only 2 more computers to go and 3 phones. Sigh

I’d imagine finding any manufacturer still supporting anything before, like, a Z170 pretty unlikely. Certainly Gigabyte isn’t planning to update my Z77 bios.

So…what do we do then? Nothing?

https://i.imgur.com/Ghg1x7C.gif