Rasprava i komentari o "Spectre" i "Meltdown" pošastima

[The Exiled]

SgxSpectre Attack Can Extract Data from Intel SGX Enclaves

Intel Software Guard eXtensions (SGX) is a feature of modern Intel processors that allow an application to create so-called enclaves. This enclave is a hardware-isolated section of the CPU's processing memory where applications can run operations that deal with extremely sensitive details, such as encryption keys, passwords, user data, and more. According to researchers, SgxSpectre works because of specific code patterns in software libraries that allow developers to add SGX support to their apps. Vulnerable SGX development kits include the Intel SGX SDK, Rust-SGX, and Graphene-SGX. Intel's recent Spectre patches don't necessarily help, as an attacker can work around these fixes. Intel says an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16. App developers will need to integrate this new SDK version into their SGX-capable apps and issue an update to users. Apps that implement Google's Retpoline anti-Spectre coding techniques are safe, researchers say.

[Gigi1]

shitshow se i dalje nastavlja, ali bitno da se pisalo da je "bug nepostojeci"

[Tajl3r]

https://newsroom.intel.com/wp-conten...e-guidance.pdf

[Manuel Calavera]

Frend ima neke pizdarije sa win, povuklo mu update za spectre kaže, pa je sad ubacivao neke starije microcodove tj. modao je biose

[The Exiled]

Intel Publishes Spectre & Meltdown Hardware Plans: Fixed Gear Later This Year

Intel is announcing that they have developed hardware fixes for both the Meltdown and Spectre v2 vulnerabilities, which in turn will be implemented into future processors. Both the next version of Intel’s Xeon server/HEDT platform – Cascade Lake – as well as new 8th gen Core processors set to ship in the second half of this year will include the mitigations. Meanwhile for updating Intel’s consumer chips, this is a bit more nebulous. While Intel hasn’t shared the complete text of their announcement with us ahead of press time, their specific wording is that the changes will be included in 8th gen Core processors “expected to ship in the second half of 2018.” Intel hasn’t said what processor family these are (e.g. Cannon Lake?), or for that matter whether these are even going to be traditional consumer chips or just the Core HEDT releases of Cascade Lake.

As for the hardware changes themselves, it’s important to note that Intel’s changes only mitigate Meltdown (what Intel calls “variant 3”) and Spectre variant 2. In both cases the company has mitigated the vulnerabilities through a new partitioning system that improves both process and privilege-level separation, going with a “protective walls” analogy. Unfortunately these hardware changes won’t mitigate Spectre variant 1. And admittedly, I haven’t been expecting Intel (or anyone else) to figure that one out in 2018. The best mitigations for Spectre v1 will remain developer-focused software techniques such as retpoline.

Izvor: AnandTech

[geronimo_2]

it continues...

http://news.softpedia.com/news/after...s-520433.shtml

[The Exiled]

Začarani krug, a zakrpe i dalje rade više štete nego koristi.

[geronimo_2]

http://www.zdnet.com/article/intel-w...n-these-chips/

"it is impractical..."
dirty SOBs

edit: microcode update guidance
https://newsroom.intel.com/wp-conten...e-guidance.pdf

[kopija]

Autor geronimo_2

http://www.zdnet.com/article/intel-w...n-these-chips/

"it is impractical..."
dirty SOBs

Čisto sumnjam da bi proizvođači matičnih starih deset godina izbacili nove biose čak i kada bi Intel izdao microcode update.

[popo1]

Ako netko zna,
ako skinem sa microsoftove stranice zadnju verziju Windowsa 10, da li su u njima ove zakrpe protiv spectre i meltdown bug-a ?
I da li su sa tim zakrpama slabije performanje računala.
Inače, imam i5 kaby lake.
Zahvaljujem

[The Exiled]

AMD Releases Spectre v2 Microcode Updates for CPUs Going Back to 2011

AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. The KB4093112 update included in the April 2018 Patch Tuesday contains additional Spectre v2 mitigations, not included with the original January 2018 Patch Tuesday release, which AMD deems necessary to completely mitigate Spectre v2. The company is still preparing patches for the RyzenFall, MasterKey, Fallout, and Chimera vulnerabilities that came to light last month, considered less dangerous and easier to fix than the Meltdown and Spectre flaws.

Izvor: BleepingComputer

Autor popo1

ako skinem sa microsoftove stranice zadnju verziju Windowsa 10, da li su u njima ove zakrpe protiv spectre i meltdown bug-a ? I da li su sa tim zakrpama slabije performanje računala.

Zasad te zakrpe još uvijek nisu integrirane (možda jednog dana budu), ali Windows Update tijekom i nakon instalacije pokupi sve bitno.

Performanse mogu, a i ne moraju biti iste - nažalost ovisi kakve si sreće.