7 ms·
An Update on AMD Processor Security
- Decabytes 9y ago>As always, AMD strongly encourages its customers to consistently undertake safe computing practices, examples of which include: not clicking on unrecognized hyperlinks, following strong password protocols, using secure networks, and accepting regular software updates. Ummm none of these things will stop this attack.
- foxylad 9y agoExcept they just said this attack is virtually impossible (certainly hasn't been demonstrated) on AMD. So I interpret this as general advice.
- noncoml 9y agoIs the JS PoC for Spectre not applicable to AMD then?
- molyss 9y agoI think Spectre and the JS PoC are actually the ones applicable to any modern processors (including AMDs, ARMs and probably most other chip vendors). Looks like the mitigations for these will be directly included in the browser. EDIT : I don't even think we know of a way to fix Spectre in the kernel...
- cryptonector 9y agohttps://lkml.org/lkml/2018/1/3/780 https://lkml.org/lkml/2018/1/3/780
- deleted 9y ago[deleted]
- ibotty 9y agoNo, that's only for variant two. Spectre is also variant one.
- jpatokal 9y agoThere are 3 attacks, two of which AMD claims to be immune/virtually immune to, and one which they do admit to being applicable.
- coryfklein 9y agoThese are all ways of preventing malicious code from running on your system. If you're not running code that abuses the new attack vectors, then you are effectively stopping the attack.
- proactivesvcs 9y agoI note they didn't state anything along the lines of "Negligible performance impact. In line with other hardware manufacturers such as Intel, our security fixes rarely cause severe performance loss."
- ComputerGuru 9y agoWhy would they? The performance loss being discussed on HN and affecting AWS and others is primarily for the 3rd variant, not the first (which your quote was with regards to).
- proactivesvcs 9y agoIntel tacitly threw them and ARM under the bus, IMO, when Intel named them specifically and unnecessarily. It seems AMD do not wish to return the favour.
- kbwt 9y ago> Resolved by software / OS updates to be made available by system vendors and manufacturers. Not unless you update every piece of code running on your machine to insert an lfence following every branch on attacker-controlled data.
- all_blue_chucks 9y agoCare to explain? How is an OS update insufficient?
- fooker 9y agoFences in the code significantly slows down execution. While you can not avoid them altogether (modern processors are not sequentially consistent), the less you can use, faster your concurrent code is. This update makes the kernel insert fences into places where it wouldn't have been necessary before, leading to potentially severe slowdowns.
- sandworm101 9y agoStill happy that i went with ryzen for my recent machine. I was sick of intel behavior then, only more so now.
- theandrewbailey 9y agoI'm not sure what behavior with regards to this bug that you're referring to. From what I heard, Intel is freaking out and trying to fix things. Did I miss something?
- lsiq 9y agoUnrelated to the exploit, am pretty sure he's referring to the questionable anti-competitive practices Intel has engaged in the past decade. Notably, the exclusivity-kickback agreements they arranged with several PC manufacturers. https://www.nytimes.com/2017/09/06/business/intel-eu-antitrust-fine.html https://www.nytimes.com/2017/09/06/business/intel-eu-antitru... As well as making their compiler choose the slowest execution path possible once it identifies it's running on an AMD/non-Intel CPU. http://www.agner.org/optimize/blog/read.php?i=49#49 http://www.agner.org/optimize/blog/read.php?i=49#49
- sandworm101 9y agoThat, the drm stuff, the spying, and the lack of innovation. Amd's more-cores approach really appealed to me.
- ComputerGuru 9y agoCompletely off-topic now, but I've had such a bad experience with the motherboard selection. So many bugs in even the most popular motherboard (X399 Taichi) that have necessitated countless updates, and the bug reports are still coming in. At least with Intel, I could grab a server-class motherboard and guarantee rock-solid feature implementation - with the selection of AMD motherboards available we have even separate yet contradictory settings exposed in the BIOS setup. Pathetic.
- 9y ago
- mrmondo 9y ago> Resolved by software / OS It's not resolved by, it's mitigated by. Furthermore, it wasn't mitigated by AMD (or Intel or ARM), it was mitigated by OS / Software vendors that had to spend the time to make workarounds for the hardware's design flaw. It would have been nice to see a nod to such developers for taking the time to help with the problem.
- cryptonector 9y agoThis could be an extinction level event for less popular OSes. Intel, and to a lesser extent AMD, may end up causing enormous damage for which they'll pay nothing much.
- jnwatson 9y agoThat's an excellent point. I used to work porting a commercial embedded real-time OS. I just reviewed the description of the recent mitigations in Linux. It is easily 6 man-months of work if not double, and the level of expertise necessary to implement this right is pretty high. For a small OS shop, that's a pretty high price.
- rlpb 9y ago> ...it was mitigated by OS / Software vendors that had to spend the time to make workarounds for the hardware's design flaw Free Software projects don't necessarily work like this. It's possible for CPU manufacturers to have taken the lead in the work in Linux, for example. Even just helping (which they have clearly done) is more of a nod than just a nod.
- zeep 9y agoComputer security, what a nightmare. If governments backdoors were illegal to implement, that would help a little...
- anfilt 9y agoThis response is better than the corporate speak Intel put out regarding these vulnerabilities. Still light on details, but at least not the same kind of corporate drivel. AMD does not even mention Intel or ARM. While Intel did. Why is that? AMD mentions it's an issue with speculative execution used in modern processor architectures. Clean and simple, and to the point. Here's Intel's response compare: https://newsroom.intel.com/news/intel-responds-to-security-research-findings/ https://newsroom.intel.com/news/intel-responds-to-security-r...
- ngrilly 9y agoWhat are the "architecture differences" that make AMD CPUs immune to the 3rd variant (Rogue Data Cache Load, aka Meltdown)?
- ngrilly 9y agoI found this explanation in a Linux kernel commit: AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault. Source: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=694d99d40972f12e59a3696effee8a376b79d7c8 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/...