Exploit σε Intel CPU διορθώνεται με αρνητικές συνέπειες

[antonis]

έχω κλειστά τα updates σε 7αρια δεν φοβου τίποτα

[stavros]

Εδώ τα benchmarks της Intel αναλυτικότερα.

 

https://newsroom.intel.com/editorials/intel-security-issue-update-initial-performance-data-results-client-systems/

[asder]

http://www.guru3d.com/news-story/intel-shares-security-fix-benchmarks-for-desktop.html

[stavros]

An Update on AMD Processor Security (1/11/2018)

 

https://www.amd.com/en/corporate/speculative-execution

 

Google Project Zero (GPZ) Variant 1 (Bounds Check Bypass or Spectre) is applicable to AMD processors.

• We believe this threat can be contained with an operating system (OS) patch and we have been working with OS providers to address this issue.  

GPZ Variant 2 (Branch Target Injection or Spectre) is applicable to AMD processors.

• While we believe that AMD’s processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat.  We have defined additional steps through a combination of processor microcode updates and OS patches that we will make available to AMD customers and partners to further mitigate the threat.

GPZ Variant 3 (Rogue Data Cache Load or Meltdown) is not applicable to AMD processors.

• We believe AMD processors are not susceptible due to our use of privilege level protections within paging architecture and no mitigation is required.

 

[stavros]

9. Is my device protected after I’ve applied the Windows security updates Microsoft released on January 3, 2018?

To get all available protections for your device(s) against the three vulnerabilities described in this advisory, you must install the security updates for Windows and apply microcode updates provided by your hardware OEM.

If your OEM does not provide a microcode update, or if you are unable to apply it, the Windows security updates released on January 3, 2018 alone address:

• CVE-2017-5753 - Bounds check bypass (Variant 1, Spectre)
• CVE-2017-5754 - Rogue data cache load (Variant 3, Meltdown)

 

To address CVE-2017-5715 - Branch target injection (Variant 2, Spectre), you must apply a microcode update in conjunction with the Windows security update. Any questions regarding microcode updates must be directed to your OEM. Systems without updated microcode remain vulnerable to information disclosure as described in FAQ 9 (8): What is the scope of the vulnerabilities?

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002

Άρα, το microcode update για ασφαλές pc απαιτείται μόνο για το Variant 2, Spectre ?

[billpeppas]

Αν βγεί για κάθε CPU το microcode το βάζεις εύκολα ( inject ) στο BIOS οποιασδήποτε μητρικής αρκετά εύκολα.

[stavros]

Το θέμα μου είναι (haswell) πως μέχρι στιγμής βγάζουν σιγά σιγά μόνο για τα CPU του εμπορίου, για τα παλιά ακόμα τίποτα.

[billpeppas]

Έχει ακόμα ζουμί η υπόθεση και επειδή είναι δύσκολα θέματα στην επίλυση θα πάρει χρόνο να βγάλουνε τελικά patches/microcodes για όλα τα CPU.

[X4K4]

εγω θελω να δω αιμα!!!!!

γιατι τα μπλε ξινανε τα @@@@ τοσο καιρο

[asder]

οταν λες "τα μπλε" εννοείς τα στρουμφακια;;

 

 

[asder]

Ω ρε θα σερνομαστε τώρα με τον Ε1 στα 1.4