Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

[Atari2600]

Now, will Intel get dirty and start throwing brown envelopes around to stop qualifiers being put in to acknowledge AMD CPUs don't need the crippling code?

 

[crazylocha]

Thank you all for the link to Phoronix.

Get me up to date numbers please,
Linux based gaming is what? 0.5%- 2% of total gaming?

Accessing a PubG game requires what? A server? Odds are an Intel server?

So the 15-40% hit on real Linux servers was shown by that testing. Ok thanks, my point stands.

For the other 97% (?? Currently correct, unsure) using Windows for gaming, we still don't know how bad the implementation is on the O/S side. Could be minor, could be similar to mostly older Intel/Linux numbers. MS track record isn't good on things like this at first. Give everyone 6 months to a year and will most likely be negligible. What is the backlash going to look like during that time? To my original post, AMD is going to gain how much market share? Server and consumer side.

 

[PhonakV30]

How about impact on Game Server like BF1 , PUBG , Overwatch , etc...?

 

[Jimzz]

You do know that Intel's current market cap is about 22x that of AMD, right????

Thats because bulldozer was garbage. The new design competes well, and that was before this bug came out.

These reminds me of the P4 days when intel slipped so they had to bribe, cheat, and steal to keep AMD down. Wonder if they will go the same route again? And if AMD can produce enough chips when this hits the fans. Maybe even help IBM and their P9 also.

 

[PingSpike]

https://www.phoronix.com/scan.php?page=news_item&px=x86-PTI-Initial-Gaming-Tests

gaming isn't affected

Well, linux gaming using openGL and Vulkan on a Vega 64 across a handful of titles isn't anyway. But its a promising sign I suppose.

There won't be Windows benchmarks until Microsoft rolls out its patch to the insider builds I wouldn't think?

 

[Stuka87]

Hopefully AMD's request to have their CPU's excluded from the patches goes through. Now I am wondering if I should buy a Ryzen now before shortages happen.

 

[jpiniero]

There won't be Windows benchmarks until Microsoft rolls out its patch to the insider builds I wouldn't think?

The issue seems serious enough that MS will likely put out an emergency patch, perhaps as soon as tomorrow.

 

[Asterox]

Hopefully AMD's request to have their CPU's excluded from the patches goes through. Now I am wondering if I should buy a Ryzen now before shortages happen.

There will be no shortages, Ryzen CPU yields are 85%+Globalfoundies has enough production capacity.If necessary Samsung is ready, they can start produce Ryzen CPU with no problems.

Intel CEO, who will be guilty for Intel CPU sales falling harder then rock from 10 000 meters?

 

[snstr]

Hmm... just heard some *rumours* (allegedly from #gentoo-de ) that the kernel 4.14.11 would not have all the patches yet and in consequence the performance penalty could not be measured yet.

 

[jpiniero]

Well, it looks like the MSM found out about the flaw... Pre-market Intel is down 2.73% and AMD up over 6%.

 

[Atari2600]

There will be no shortages, Ryzen CPU yields are 85%+Globalfoundies has enough production capacity.

Ha, it won't be the Core line that will be crippled by this, it'll be Xeon.

AMD may just need almost every Ryzen die for EYPC packages. With the margins of the two products, there is no real discussion as to which gets priority.

 

[Shmee]

This is crazy scary. Would this effect a Haswell E as well?

 

[jpiniero]

This is crazy scary. Would this effect a Haswell E as well?

Could go as far back as the Pentium II.

 

[crazylocha]

10 years worth of Intel cpu's

 

[Stuka87]

Ha, it won't be the Core line that will be crippled by this, it'll be Xeon.

AMD may just need almost every Ryzen die for EYPC packages. With the margins of the two products, there is no real discussion as to which gets priority.

Core CPU's are just as effected as Xeons.

 

[jihe]

Well my main work pc is on SL9400. Hopefully that's not affected! LOL

 

[Accord99]

Hmm... just heard some *rumours* (allegedly from #gentoo-de ) that the kernel 4.14.11 would not have all the patches yet and in consequence the performance penalty could not be measured yet.

Phoronix's test uses the 4.15 kernel.

 

[greatnoob]

Should I update my 2015 build of Windows 10 now before Windows Update forces this patch on my devices?

 

[Stuka87]

Should I update my 2015 build of Windows 10 now before Windows Update forces this patch on my devices?

Are you saying you have not done any security updates ever?

 

[greatnoob]

Are you saying you have not done any security updates ever?

That's correct. I use open source software mostly (apart from iTunes, Steam and some of the stock Windows apps) and just keep my browser updated as my "security updates".

 

[urvile]

Sounds like another collaboration between Intel and the NSA.

I kid, I kid.

 

[BigDaveX]

Could go as far back as the Pentium II.

According to some reports, the flaw has something to do with Intel's AMD64 implementation, so the likely oldest product that could be affected is P4 Prescott.

You know, I remember people saying how broken and half-assed the Prescott's AMD64 support was, but I didn't realise they'd screwed the pooch that badly! Even a decade-and-a-half later, Prescott is the gift that keeps on giving.

 

[Malogeek]

That's correct. I use open source software mostly (apart from iTunes, Steam and some of the stock Windows apps) and just keep my browser updated as my "security updates".

So your security precautions are to not apply security updates. That makes sense.

 

[thepaleobiker]

Well, it looks like the MSM found out about the flaw... Pre-market Intel is down 2.73% and AMD up over 6%.

Yep. Indeed.
Links--> (as of 8:30 AM CT 3rd Jan 2018)

https://www.cnbc.com/2018/01/03/amd-shares-surge-on-report-of-an-intel-chip-security-flaw.html

https://www.bloomberg.com/news/arti...ter-rival-intel-said-to-reveal-processor-flaw

https://www.investors.com/news/tech...-dinged-by-chip-flaw-as-rival-amd-gets-boost/

Regards,
Vish

 

[William Gaatjes]

I am watching the 34C3 video and how this attack can happen to retreive the physical memory address, and it seems this is all possible because of enhancements of the browser standards such as sharedArrayBuffer and accurate timing measurements.
Would a first temporary solution not be to detect this kind of time stamping code in the browser and add small variations in it to mimick accurate but in reality flawed time measurements ?
Then the exploit would use these faulty results to get a wrong address.
That would make it more difficult for the exploit to then use the rowhammer variant.