7 ms·

Why did CERT modify their vulnerability disclosure to remove the text: > Fully removing the vulnerability requires replacing vulnerable CPU hardware. Proof: h

Why did CERT modify their vulnerability disclosure to remove the text: > Fully removing the vulnerability requires replacing vulnerable CPU hardware. Proof: https://webcache.googleusercontent.com/search?q=cache:rzc6iQmgrIcJ:https://www.kb.cert.org/vuls/id/584653+&cd=4&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:rzc6iQ... This smells really bad to me, as if Intel pressured CERT into removing language that could have caused their market value to instantly vaporize as every consumer for the last 20 years joins a class action suit...

deleted 9y ago
[deleted]
weavejester 9y ago
It could just be that the statement is incorrect or misleading.
- tbodt 9y ago
  Yes. Spectre2 can be and is being patched with a microcode update that partially disables branch prediction.
  - wasx 9y ago
    What about meltdown?
    - anifal 9y ago
      Meltdown is mitigated by kernel page table isolation. See patch notes/ the attack paper
      - geezerjay 9y ago
        That says nothing about the need to fully replace defective hardware to avoid the hardware problem.
        rurban 9y ago
        That says nothing about the possibility to patch the missing page table isolation with a microcode update. They have enough spare registers for a seperate C3, they could workaround the TLB flush. Since the fdiv bug HW problems are not HW problems anymore.
  - chrisper 9y ago
    A microcode update which most users won't get... :/ https://news.ycombinator.com/item?id=16072604 https://news.ycombinator.com/item?id=16072604
free652 9y ago
AMD/ARM/Intel CPUs are affected.
- alexforster 9y ago
  ...by the much-harder-to-exploit timing attack that is easily mitigated by cropping timer resolution.
  - kbwt 9y ago
    That is not an effective mitigation.
cookiecaper 9y ago
People were mocking them for it on Twitter, and one of the researchers (Anders Fog [0]) called it "funny". It could just be that people were misled into believing that such hardware currently exists, and that CERT decided there would be less confusion to stick to currently-possible mitigation techniques. :) In any case, I doubt Intel would pressure anyone to remove the generic imperative "buy a new CPU". [0] https://twitter.com/anders_fogh/status/948904282568392704 https://twitter.com/anders_fogh/status/948904282568392704
sandworm101 9y ago
>> Fully removing the vulnerability requires replacing vulnerable CPU hardware. Imho intel would much rather them keep this language, which is why they removed it. There is no drop-in non-intel replacement for an intel CPU. Telling everyone that they need to replace CPUs is basically a mandate for them to by whatever replacement intel can cobble together. Having to replace all those chips would see intel's stock price skyrocket. The reality is that chips don't need to be replaced asap and customers have time to perhaps choose non-intel chips.
- adrianN 9y ago
  I suppose it would only make the stock price rocket if it wasn't decided in some class-action suit that Intel has to replace the CPUs for free.
- reacweb 9y ago
  "have time" ? I have a feeling of hurry because the vulnerabilities are so "easy" to exploit that attacks are probably already occurring.
- illumin8 9y ago
  That doesn't make any sense. Do you think when Takata had to recall all those defective airbags that were killing people their stock price jumped because they were able to sell replacement airbags? A product manufacturer with serious defects almost always ends up eating the costs of hardware repair or replacement.
jve 9y ago
I don't get these calls to a class action suit... If it was intentional, it could have a reason. But I just don't get this attitude when they are having a really bad day after someone discovered a new type of attacks on their chips.
- gozur88 9y ago
  You don't have to inflict intentional injury to be liable for something like this. Intel's customers aren't getting what they paid for, so it seems pretty reasonable for the company to compensate them. If you bought a car that was advertised as having 300 horsepower, and then the manufacturer realized it was unsafe unless they made a software change limiting the horsepower to 200, wouldn't you expect some compensation?
- pkd 9y ago
  Intel isn't having a bad day. The people who are stuck with chips that enable severe security exploits are having a bad day. Actually they are going to have a bad year till the design flaw is fixed in hardware. Or maybe even 5 years. Who knows. Intel is 100% liable to face a lawsuit over this. Consider if a major car brake manufacturer discovered that there was a design flaw in the brakes that prevented them from functioning in certain situations. It'd be facing multiple lawsuits by now whereas Intel is going with "our chips are the most secure ever" line.
  - kbart 9y ago
    The car analogy is very good one. Also an infamous Samsung Galaxy Note 7 comes to mind. I agree that such security hole such warrant for a replacement.
    - yoz-y 9y ago
      I don't believe the car analogy is good. And neither is the Note one. In both of those cases the products can cause serious harm without any third party implication. The brakes would just go of or the battery would explode during normal function. However, in the Intel case there has to be an attacker that actively exploits an issue in design. To me this would be like making a class action suit against all lock vendors because they can be bypassed with the right set of tools. The fact that this affects everyone (Intel more than others) and that it took 10 years to find grants them some excuse. Also the architecture is not secret as far as I know so anybody could have audited this. They most probably did do so and found nothing until now. Now, I do not like Intel communication around this and if it comes out that they knew this for years and decided to sit on it then it would be a different story. Class action lawsuits are useful when there is negligence, or bad intent but in this case what could it possibly solve?
bmvakili 9y ago
Try wayback machine instead of google webcache as latter isn't showing the original. Here's the vulnerability note stating to replace hardware on 01/04/2018 at about 1800 GMT: https://web.archive.org/web/20180104032628/https://www.kb.cert.org/vuls/id/584653 https://web.archive.org/web/20180104032628/https://www.kb.ce... Then here is the same page with the replace verbiage removed on 01/04/2018 at about 1900 GMT: https://web.archive.org/web/20180104180023/https://www.kb.cert.org/vuls/id/584653 https://web.archive.org/web/20180104180023/https://www.kb.ce...

deleted 9y ago

[deleted]

weavejester 9y ago

It could just be that the statement is incorrect or misleading.

tbodt 9y ago
Yes. Spectre2 can be and is being patched with a microcode update that partially disables branch prediction.
- wasx 9y ago
  What about meltdown?
  - anifal 9y ago
    Meltdown is mitigated by kernel page table isolation. See patch notes/ the attack paper
    - geezerjay 9y ago
      That says nothing about the need to fully replace defective hardware to avoid the hardware problem.
      - rurban 9y ago
        That says nothing about the possibility to patch the missing page table isolation with a microcode update. They have enough spare registers for a seperate C3, they could workaround the TLB flush. Since the fdiv bug HW problems are not HW problems anymore.
- chrisper 9y ago
  A microcode update which most users won't get... :/ https://news.ycombinator.com/item?id=16072604 https://news.ycombinator.com/item?id=16072604

free652 9y ago

AMD/ARM/Intel CPUs are affected.

alexforster 9y ago
...by the much-harder-to-exploit timing attack that is easily mitigated by cropping timer resolution.
- kbwt 9y ago
  That is not an effective mitigation.

cookiecaper 9y ago

People were mocking them for it on Twitter, and one of the researchers (Anders Fog [0]) called it "funny". It could just be that people were misled into believing that such hardware currently exists, and that CERT decided there would be less confusion to stick to currently-possible mitigation techniques. :) In any case, I doubt Intel would pressure anyone to remove the generic imperative "buy a new CPU". [0] https://twitter.com/anders_fogh/status/948904282568392704 https://twitter.com/anders_fogh/status/948904282568392704

sandworm101 9y ago

>> Fully removing the vulnerability requires replacing vulnerable CPU hardware. Imho intel would much rather them keep this language, which is why they removed it. There is no drop-in non-intel replacement for an intel CPU. Telling everyone that they need to replace CPUs is basically a mandate for them to by whatever replacement intel can cobble together. Having to replace all those chips would see intel's stock price skyrocket. The reality is that chips don't need to be replaced asap and customers have time to perhaps choose non-intel chips.

adrianN 9y ago
I suppose it would only make the stock price rocket if it wasn't decided in some class-action suit that Intel has to replace the CPUs for free.
reacweb 9y ago
"have time" ? I have a feeling of hurry because the vulnerabilities are so "easy" to exploit that attacks are probably already occurring.
illumin8 9y ago
That doesn't make any sense. Do you think when Takata had to recall all those defective airbags that were killing people their stock price jumped because they were able to sell replacement airbags? A product manufacturer with serious defects almost always ends up eating the costs of hardware repair or replacement.

jve 9y ago

I don't get these calls to a class action suit... If it was intentional, it could have a reason. But I just don't get this attitude when they are having a really bad day after someone discovered a new type of attacks on their chips.

gozur88 9y ago
You don't have to inflict intentional injury to be liable for something like this. Intel's customers aren't getting what they paid for, so it seems pretty reasonable for the company to compensate them. If you bought a car that was advertised as having 300 horsepower, and then the manufacturer realized it was unsafe unless they made a software change limiting the horsepower to 200, wouldn't you expect some compensation?
pkd 9y ago
Intel isn't having a bad day. The people who are stuck with chips that enable severe security exploits are having a bad day. Actually they are going to have a bad year till the design flaw is fixed in hardware. Or maybe even 5 years. Who knows. Intel is 100% liable to face a lawsuit over this. Consider if a major car brake manufacturer discovered that there was a design flaw in the brakes that prevented them from functioning in certain situations. It'd be facing multiple lawsuits by now whereas Intel is going with "our chips are the most secure ever" line.
- kbart 9y ago
  The car analogy is very good one. Also an infamous Samsung Galaxy Note 7 comes to mind. I agree that such security hole such warrant for a replacement.
  - yoz-y 9y ago
    I don't believe the car analogy is good. And neither is the Note one. In both of those cases the products can cause serious harm without any third party implication. The brakes would just go of or the battery would explode during normal function. However, in the Intel case there has to be an attacker that actively exploits an issue in design. To me this would be like making a class action suit against all lock vendors because they can be bypassed with the right set of tools. The fact that this affects everyone (Intel more than others) and that it took 10 years to find grants them some excuse. Also the architecture is not secret as far as I know so anybody could have audited this. They most probably did do so and found nothing until now. Now, I do not like Intel communication around this and if it comes out that they knew this for years and decided to sit on it then it would be a different story. Class action lawsuits are useful when there is negligence, or bad intent but in this case what could it possibly solve?

bmvakili 9y ago

Try wayback machine instead of google webcache as latter isn't showing the original. Here's the vulnerability note stating to replace hardware on 01/04/2018 at about 1800 GMT: https://web.archive.org/web/20180104032628/https://www.kb.cert.org/vuls/id/584653 https://web.archive.org/web/20180104032628/https://www.kb.ce... Then here is the same page with the replace verbiage removed on 01/04/2018 at about 1900 GMT: https://web.archive.org/web/20180104180023/https://www.kb.cert.org/vuls/id/584653 https://web.archive.org/web/20180104180023/https://www.kb.ce...