PC Ekspert Forum
Stranica 8 od 10 « Prva 4567 8 910
Show 40 post(s) from this thread on one page

PC Ekspert Forum (https://forum.pcekspert.com/index.php)
-   Intel (https://forum.pcekspert.com/forumdisplay.php?f=8)
-   -   Rasprava i komentari o "Spectre" i "Meltdown" pošastima (https://forum.pcekspert.com/showthread.php?t=290321)

The Exiled 11.04.2018. 12:05
AMD Releases Spectre v2 Microcode Updates for CPUs Going Back to 2011
Citiraj:
AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. The KB4093112 update included in the April 2018 Patch Tuesday contains additional Spectre v2 mitigations, not included with the original January 2018 Patch Tuesday release, which AMD deems necessary to completely mitigate Spectre v2. The company is still preparing patches for the RyzenFall, MasterKey, Fallout, and Chimera vulnerabilities that came to light last month, considered less dangerous and easier to fix than the Meltdown and Spectre flaws.
Izvor: BleepingComputer

Citiraj:
Autor popo1 (Post 3180679)
ako skinem sa microsoftove stranice zadnju verziju Windowsa 10, da li su u njima ove zakrpe protiv spectre i meltdown bug-a ? I da li su sa tim zakrpama slabije performanje računala.
Zasad te zakrpe još uvijek nisu integrirane (možda jednog dana budu:)), ali Windows Update tijekom i nakon instalacije pokupi sve bitno.

Performanse mogu, a i ne moraju biti iste - nažalost ovisi kakve si sreće.

popo1 18.04.2018. 11:41
Ok, hvala na odgovoru.

The Exiled 03.05.2018. 20:34
Spectre Watch: More Spectre-class CPU Vulnerabilities to be Announced Soon?
Citiraj:
Heise.de has published an exclusive report stating that they got wind of a new series of Spectre-class vulnerabilities that are currently being investigated by the greater security community, and that these vulnerabilities are going to be announced in the coming days. Meanwhile, seemingly in response to the Heise article, Intel has just published their own statement on the matter, which they’re calling “Addressing Questions Regarding Additional Security Issues.” Sources point to 8 individual CVE-assigned Spectre-class attacks, which for the moment they’re calling Spectre-NG. According to the site, Intel is working on two waves of patches, with the first wave currently set to be released in May, and Heise is further speculating that information on the first wave will be released just ahead of May’s Patch Tuesday. Meanwhile information on a second flaw could be released “any day now.”
Izvor: AnandTech

The Exiled 22.05.2018. 08:38
Google and Microsoft Reveal New Spectre Attack
Citiraj:
Security researchers from Google and Microsoft have found two new variants of the Spectre attack that affects processors made by AMD, ARM, IBM, and Intel. Rumors about this new flaw leaked online at the start of the month in a German magazine, but actual details were published today. Impressively, AMD has already released a 5 page whitepaper on the vulnerability, as well as a post on their security updates page outlining that they will be providing updates back to the Bulldozer series of processors. Even more remarkable, is AMD stats that these updates are already in the hands of Microsoft, who is completing final testing and validation and will be released over the standard update process.

The bugs - referred to in the past weeks as SpectreNG - are related to the previous Meltdown and Spectre bugs discovered last year and announced at the start of 2018. Both Google and Microsoft researchers discovered the bug independently. The bugs work similarly to the Meltdown and Spectre bugs, a reason why they were classified as "variant 3a" and "variant 4" instead of separate vulnerabilities altogether.
  • Variant 1: bounds check bypass (CVE-2017-5753) aka Spectre v1
  • Variant 2: branch target injection (CVE-2017-5715) aka Spectre v2
  • Variant 3: rogue data cache load (CVE-2017-5754) aka Meltdown
  • Variant 3a: rogue system register read (CVE-2018-3640)
  • Variant 4: speculative store bypass (CVE-2018-3639)
Izvor: BleepingComputer

pci_e3x 14.08.2018. 21:13
'ajmo izbacit dovoljno patcheva za (namjerne?) sigurnosne rupe u nasim proizvodima. Tako da kada izbacimo nove generacije CPU-a, izgledat ce da su puno brzi od starih.


L1 Terminal Fault - The Latest Speculative Execution Side Channel Attack
"While Meltdown breaks the user space to kernel space protection, L1TF allows to attack any physical memory address in the system and the attack works across all protection domains. It allows an attack of SGX and also works from inside virtual machines because the speculation bypasses the extended page table (EPT) protection mechanism. "
https://www.phoronix.com/scan.php?pa...Terminal-Fault



A Lot Of Spectre Changes Land In The Linux 4.19 Git Tree, Possible Performance Impact
https://www.phoronix.com/scan.php?pa...86-PTI-Spectre


Prije nego netko hate-a Windows, vec su izbacili patch:
https://support.microsoft.com/en-ae/...date-kb4343909

I Logo + Web je online, bez toga nije prava sigurnosna prijetnja:
https://foreshadowattack.eu/

:beer:

The Exiled 27.08.2018. 23:00
Windows 10 KB4100347 Intel CPU Update Causing Boot Issues & Pushed to AMD Users
Citiraj:
On August 21st, Microsoft released an update to the May KB4100347 security update for Windows 10 and Windows Server 2016, which contain Intel CPU microcode updates to mitigate Spectre vulnerabilities. After installing this latest version, Windows users are reporting that they are unable to properly boot Windows 10 or are having performance issues. To further complicate the issue, this Intel CPU update is also being pushed to users of AMD processors. While it appears that AMD users are not suffering the same issues as those using Intel processors, it does appear that Microsoft made a mistake by pushing out the update to these users and those who are using unsupported Intel processors.
Izvor: BleepingComputer

Smartic 27.08.2018. 23:12
Meni od updatea prije 2 tjedna nadalje monitor bude u wake-up loopu po cca. 10 minuta kod svakog boota. Pojavi se slika na 0.2-3s pa crno 2-3s i tako konstantno dok se ne 'nađe'. Ne znam je li sigurno do toga, ali monitor radi normalno na jednom drugom kompu i na laptopu.

Mislite da bi updateanje BIOS-a riješilo to? Vidim da su u međuvremenu 3 zakrpe izašle za mikrokod(za moju ploču)...

The Exiled 27.08.2018. 23:22
Jesi možda probal da li je takva situacija i kad spojiš monitor na iGPU izlaz na ploči? GTX 1080 možeš privremeno maknuti za to vrijeme. Čisto da i to eliminiraš.

Kaj se BIOS-a tiče, možeš probati novu verziju, ali obzirom da s ovim zakrpama fušaju na sve strane, bogtepitaj da li bude imalo kakvog učinka.

pci_e3x 30.08.2018. 16:53
The Performance Cost Of Spectre / Meltdown / Foreshadow Mitigations On Linux 4.19

https://www.phoronix.com/scan.php?pa...igations&num=1

The Exiled 05.11.2018. 12:26
Intel CPUs fall to new hyperthreading exploit that pilfers crypto keys
Citiraj:
PortSmash, as the new attack is being called, exploits a largely overlooked side-channel in Intel’s hyperthreading technology. Utilizing this attack, researchers were able to steal the private decryption key from an OpenSSL thread running in the same core as their exploit. While the researchers have only tested this vulnerability against Intel Skylake and KabyLake processors, they also expect it to work on AMD Ryzen processors. The only way to mitigate this attack is to disable SMT/Hyper-threading on a computer, which OpenBSD has already done by default since this summer when another timing attack was released called TLBleed. Intel has already removed hyper-threading from their new 9th generation gaming CPUs in order to offer hardware protection from Meltdown v3 and the L1 Terminal Fault vulnerabilities.
Izvor: ArsTechnica i BleepingComputer

The Exiled 05.03.2019. 20:54
Spoiler Alert: New Security Vulnerability Found Affecting Intel CPUs:kafa:
Citiraj:
Dubbed Spoiler, the newfound security vulnerability was discovered by the Worcester Polytechnic Institute in partnership with the University of Lübeck, and affects all Intel CPUs since the introduction of their Core architecture. The researchers also examined ARM and AMD processor cores, but found they did not exhibit similar behavior. This vulnerability too affects Intel's speculative execution design, and according to the researchers, works independent of OS, virtual machine, or sandboxed environments. As the researchers explain, Intel's speculative execution of certain memory workloads requires the full physical address bits for the information in memory to be known, which could allow for the full address to be available in user space - allowing for privilege escalation and other microarchitectural attacks. According to the researchers, a software solution to this problem is impossible, which means this is yet another silicon-level bug that needs to be addressed in future processor designs.

The issue is separate from the Spectre vulnerabilities, and is not addressed by existing mitigations. It can be exploited from user space without elevated privileges. Spoiler describes a technique for discerning the relationship between virtual and physical memory by measuring the timing of speculative load and store operations, and looking for discrepancies that reveal memory layout. Modern processors manage reading and writing to RAM using a memory order buffer to keep track of operations. The buffer is used to perform store instructions – copying data from a CPU register to main memory – in the order they are laid out in executable code, and perform load operations – copying data from main memory to a register – out-of-order, speculatively. It allows the processor to run ahead and speculatively fetch information from RAM into the registers, provided there are no dependency problems, such as a load relying on an earlier store that hasn't yet completed.

Spoiler will make existing Rowhammer (1 - 2) and cache attacks easier, and make JavaScript-enabled attacks more feasible – instead of taking weeks, Rowhammer could take just seconds. Moghimi said the paper describes a JavaScript-based cache prime+probe technique that can be triggered with a click to leak private data and cryptographic keys not protected from cache timing attacks.
Izvor: The Register i TechPowerUp

The Exiled 29.03.2019. 19:53
Researchers Exploit Undocumented Intel VISA Debug Controller To Intercept System Data:fiju:
Citiraj:
First identified by Maxim Goryachy and Mark Ermolov, this latest vulnerability leverages the VISA logic signal analyzer that is incorporated into the Platform Controller Hub (PCH) found on Intel-based motherboards and in Intel processors. According to the researchers, it is capable of “monitoring the state of internal lines and buses in real time.” The VISA exploit was detailed to the public at a Black Hat Asia 2019 session entitled Intel VISA: Through the Rabbit Hole. According to the researchers, the amount of data flowing through VISA (and the Management Engine) not only provides a wealth of data to researchers, but could also be exploited by nefarious parties. Crucially, accessing VISA can be done without the need to perform hardware modifications on a system. The PCH can handle communications between the processor and external components like the display and peripherals (webcams, keyboards, mice, etc.). VISA can capture these signals, which means that any unauthorized access to a machine – perpetrated through malware, for example – could give an attacker access to a wealth of information if they can decipher the flow of information.
Izvor: HotHardware

The Exiled 14.05.2019. 21:36
New RIDL and Fallout Attacks Impact All Modern Intel CPUs
Citiraj:
Multiple security researchers have released details about a new class of speculative attacks against all modern Intel processors. The attacks are different from and more dangerous than Meltdown, Spectre and their variations because they can leak data from CPU buffers, which is not necessarily present in caches. Two attacks dubbed RIDL and Fallout exploit a set of four vulnerabilities collectively known as Microarchitectural Data Sampling (MDS) vulnerabilities - a name given by Intel. The flaws affect Intel CPUs released since 2008, the researchers say. Both RIDL and Fallout can be used in real-life scenarios where an adversary can point the victim to a webpage with malicious JavaScript to steal sensitive information on the system, like passwords and cryptographic keys.

RIDL exploits three bugs in Intel CPUs to leak data from different internal CPU buffers (e.g. Line-Fill Buffers and Load Ports). The processor uses these buffers for loading or storing data in memory. Fallout exploits a fourth vulnerability in Intel CPUs to leak data from Store Buffers, which is used when a CPU pipeline needs to store any type of data. This attack works against the Kernel Address Space Layout Randomization (KASLR) protection against memory corruption bugs. Fallout also impacts all modern Intel processors, including those of the 9th generation, which include in-silicon mitigations for Meltdown.
Izvor: BleepingComputer, Wired i MDS Attacks

kopija 15.05.2019. 08:53
Prošla je godina dana a nebo se još nije srušilo. Neki junaci čak preporučaju disejblanje patcheva.
https://www.techrepublic.com/article...ns-of-malware/
Citiraj:
Researchers have gathered more than 130 samples of malware that try to exploit Meltdown and Spectre, although most appear to be proof-of-concept code.
https://twitter.com/avtestorg/status/959332840675708929
Citiraj:
Most samples are binaries (compiled for Windows, Linux and MacOS), but we also found the first working JavaScript PoC for Spectre.
Citiraj:
Yes, similar to existing attacks, attackers can only mount our attacks in practical settings once they have the ability to execute (unprivileged) code on the victim machine. We could convince ourselves this is still an obstacle, but we should first be prepared to disable JavaScript (and similar) in the browser, abandon cloud computing, etc.
Browseri nemaju elevated privileges, pa kako onda maliciozni JS upogoniti?
Izgleda da moraš biti PhD da napraviš exploit tih vulnerabilitija.
Apokalipsa odgođena do daljnjega?

The Exiled 15.05.2019. 10:30
Možda:D:), ali lako za izbjegavanje zakrpa na osobnim računalima kad ova malo veća ekipa automatski krpa mašine na kojima se vrte Interneti.:kafa:

kopija 15.05.2019. 11:25
Nice, Retpoline za 1809 verziju. Srećom sam još na Sandy Bridge-u :)

Tajl3r 15.05.2019. 13:17
A je velika je to sreca kad ti okine 10% perfomansi u igrama,zato i je moj 2500K umirovljen.


Sent from my Redmi Note 5 using Tapatalk

Mladenxy 15.05.2019. 13:23
Ima kakav link da dosadašnje zakrpe ili ove nove "okine 10% performansi u igrama"?

Netko je to valjda testirao...

mamutarka 15.05.2019. 13:37
jebate tolko puta su već okinuli 10% da je u minusu :D

šalim se, ja nisam nešto primjetio u ovih godinu i pol, a bome trebao sam, ili je to random, da te zadesi

kopija 15.05.2019. 13:42
Citiraj:
Autor Mladenxy (Post 3301524)
Ima kakav link da dosadašnje zakrpe ili ove nove "okine 10% performansi u igrama"?

Netko je to valjda testirao...
https://access.redhat.com/articles/3307751

Mladenxy 15.05.2019. 14:18
Citiraj:
Autor kopija (Post 3301542)
Mislio sam na neki grafikon ili video koji bi pokazao testove igara prije i poslije zakrpe, koji bi potvrdio gubitak od 10% u gamingu.

Gigi1 15.05.2019. 14:34
GTA V, Meltdown/Spectre protection enabled:



Frames Per Second (Higher is better) Min, Max, Avg

Pass 0, 12.466310, 87.951523, 67.537834

Pass 1, 35.587948, 102.294464, 77.057365

Pass 2, 45.975742, 123.643021, 79.567863

Pass 3, 44.063927, 114.885742, 86.587761

Pass 4, 22.912081, 130.247345, 77.674034



GTA V, Meltdown/Spectre protection disabled:



Frames Per Second (Higher is better) Min, Max, Avg

Pass 0, 18.301443, 94.711319, 76.394928

Pass 1, 49.353958, 135.707306, 87.262985

Pass 2, 49.573666, 136.217514, 88.964317

Pass 3, 55.602509, 132.006226, 101.361748

Pass 4, 25.132448, 149.900314, 85.941391



Ghost Recon Wildlands, Meltdown/Spectre protection enabled:



FPS:Average: 50.48 Min: 34.72 Max: 56.16

GPU peak temp: 74

CPU usage: Average: 46.0% Min: 36.7% Max: 59.5%

GPU usage: Average: 76.1% Min: 65.8% Max: 86.1%

RAM usage: Average: 2.8 GB Min: 2.7 GB Max: 2.9 GB



Ghost Recon Wildlands, Meltdown/Spectre protection disabled:



FPS: Average: 54.50 Min: 45.14 Max: 58.59

GPU peak temp: 74

CPU usage: Average: 42.7% Min: 32.3% Max: 52.3%

GPU usage: Average: 81.9% Min: 62.5% Max: 92.3%

RAM usage: Average: 2.7 GB Min: 2.6 GB Max: 2.8 GB



It may be worth noting the higher CPU and lower GPU usage in Ghost Recon Wildlands with Meltdown/Spectre patches enabled, which may indicate TLB flushing is eating CPU cycles and bottlenecking the GPU in this scenario.



TL;DR

Meltdown/Spectre protection patches hit the performance of open-world games particularly hard on pre-Haswell CPUs.






Win10 Unpatched Win10 Meltdown Patch Win10 Meltdown + Microcode Patch
The Witcher 3, Ultra, No HairWorks 139.8fps 128.3fps 126.6fps
Rise of the Tomb Raider, Very High, DX12 121.6fps 117.2fps 121.6fps
Far Cry Primal, Ultra 128.4fps 127.0fps 126.2fps
Crysis 3, Very High 129.3fps 129.2fps 126.8fps
Ashes of the Singularity, CPU Test 35.3fps 35.5fps 35.6fps
Assassin's Creed Unity, Ultra High 131.1fps 131.2fps 130.3fps

Mladenxy 15.05.2019. 15:48
Ovdje su testirali i razlike su bile u jednoj igri, sa drugim intelom čak ni ni u toj jednoj igri...par postotaka razlike.

https://youtu.be/LC1WuKdPVCQ

stef 15.05.2019. 16:23
Ima i razlike koji je OS.
Win 10 navodno bolje podnosi Spectre/Meltdown patcheve.

Gigi1 15.05.2019. 16:31
Citiraj:
Autor Mladenxy (Post 3301589)
Ovdje su testirali i razlike su bile u jednoj igri, sa drugim intelom čak ni ni u toj jednoj igri...par postotaka razlike.

https://youtu.be/LC1WuKdPVCQ
to ti je ova drugi dio rezultata sto sam stavio post ranije(Win10 Unpatched Win10 Meltdown Patch Win10 Meltdown + Microcode Patch), to je testirano 10.1.2018., ovo iznad gdje su osjetnije razilke je test iz 3.mj.2019. sa dodatnim zakrpama(1809 ver. win10)

kopija 15.05.2019. 18:06
Mislim da je Mladenxy pitao za utjecaj Retpoline patch-a.

The Exiled 16.05.2019. 12:18
Intel Tried to Bribe Dutch University to Suppress Knowledge of MDS Vulnerability
Citiraj:
Dutch publication Nieuwe Rotterdamsche Courant reports that Intel offered to pay the researchers a USD $40,000 "reward" to allegedly get them to downplay the severity of the vulnerability, and backed their offer with an additional $80,000. The team politely refused both offers.:goood:
Izvor: TechPowerUp

thunderbird 16.05.2019. 12:21
A i jesu se isprsili s ponudom :roller:

Gigi1 16.05.2019. 13:17
Trebali su im travuljagu umjeso para ponudit, bolje bi prosli :D

Mladenxy 16.05.2019. 13:21
Treba pričekati da netko relevantan napravi nove testove, po ovim prethodnim zakrpama nije se izgubilo praktički ništa za kućnog korisnika.

Osobno nisam ništa osjetio a windowsi se krpaju redovno kao i biosi na zadnje verzije.

https://www.youtube.com/watch?v=_qZksorJAuY

Amd_Shill 16.05.2019. 14:40
Intel i plave kuverte?
Ne mogu vjerovat.

The Exiled 16.05.2019. 15:14
Citiraj:
Autor Mladenxy (Post 3301896)
Treba pričekati da netko relevantan napravi nove testove, po ovim prethodnim zakrpama nije se izgubilo praktički ništa za kućnog korisnika. Osobno nisam ništa osjetio a windowsi se krpaju redovno kao i biosi na zadnje verzije.
Noviji hardver još i relativno dobro podnosi sve te zakrpane peripetije, ali nažalost Sandy, Ivy, Haswell i Broadwell znaju pokleknuti, a još uvijek se koriste.

Gigi1 16.05.2019. 15:20
Ali i na novijima su razlike vece nakon 1809 ak sam dobro skuzio piskaranja po netu jer su dodatne zakrpe tad metnuli

Kroz koji tjedan ce se znat sto je s ovim zadnjim failom, kako te zakrpe utjecu na perf.

Mladenxy 16.05.2019. 17:59
Kažu ovdje

https://www.pcgamesn.com/intel/zombi...on-performance

Intel’s benchmarks suggest only a marginal decrease in within some tasks while Zombieload mitigations are in place.
Within the company’s in-house testing, a Core i9 9900K with HyperThreading enabled drops 3% performance in WebXPRT 3 testing. At best, it gained 1% within SPECint_rate_base 2017 (1 copy) testing.

Problem je ovo gašenje HT-a dok ne izdaju mikrokodove.

thunderbird 16.05.2019. 18:29
Je, a intelovim in-houe testiranjima je baš za vjerovati kao objektivnima i neovisnima :roller:

The Exiled 16.05.2019. 21:19
Kak god se okrene daleko je ovo od zajebancije koje će se "riješiti" hrpom zakrpa, koje pak same po sebi nisu nikakvo rješenje - pogotovo, ako se gubi dobar dio funkcionalnosti.
Citiraj:
The full mitigation, which includes disabling hyper-threading, prevents information leakage across threads and when transitioning between kernel and user space, which is associated with the MDS vulnerabilities for both local and remote (web) attacks. Testing conducted by Apple in May 2019 showed as much as a 40 percent reduction in performance with tests that include multithreaded workloads and public benchmarks. Performance tests are conducted using specific Mac computers. Actual results will vary based on model, configuration, usage, and other factors.
Izvor: Apple

Mladenxy 16.05.2019. 22:39
Za taj dio me zaboli :D Nek mi ne diraju igre :D

Gigi1 16.05.2019. 22:57
intel in house benchmark hahaha, pa pokusali su potplatiti ekipu da se ne prosiri vijest, sto onda tek vele svojima koji su im na legalnoj platnoj listi...

The Exiled 18.05.2019. 18:17
The Performance Impact of MDS / Zombieload: The overall cost of Spectre/Meltdown/L1TF/MDS
Citiraj:
The Intel systems all saw about 16% lower performance out-of-the-box now with these default mitigations and obviously even lower if disabling Hyper Threading for maximum security. The two AMD systems tested saw a 3% performance hit with the default mitigations. While there are minor differences between the systems to consider, the mitigation impact is enough to draw the Core i7 8700K much closer to the Ryzen 7 2700X and the Core i9 7980XE to the Threadripper 2990WX.
Izvor: Phoronix

Mladenxy 21.05.2019. 17:44
Evo nekaj testova sa isključenim HT-om.

https://www.youtube.com/watch?time_c...&v=a8yXqsfXWcM


Sva vremena su GMT +2. Sada je 06:15.
Stranica 8 od 10 « Prva 4567 8 910
Show 40 post(s) from this thread on one page

Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
© 1999-2024 PC Ekspert - Sva prava pridržana ISSN 1334-2940
Ad Management by RedTyger