Spectre & Meltdown Vulnerable Devices

[Blitz4]

What % of devices (operational and not) are vulnerable to these exploits?

Is it so bad that it's better to ask what devices aren't vulnerable?

 

I read that Intel is working on next-gen cpu's that will stop the vulnerabilities, but that doesn't fix existing devices.

[Crunchy Dragon]

If everybody installed the security patch, then 0% of all computers would be exploitable.

 

I don't think any of us know what the numbers are, but I'd guess it would be a pretty low percentage.

[Blitz4]

Doesn't the patch slow down your cpu up to 50%?

[Electronics Wizardy]

Just now, Crunchy Dragon said:

If everybody installed the security patch, then 0% of all computers would be exploitable.

 

I don't think any of us know what the numbers are, but I'd guess it would be a pretty low percentage.

Not really 0%. There is a lot of stuff that can't be fixed easily and lots of new vunrelabilitys out there.

 

3 minutes ago, Blitz4 said:

What % of devices (operational and not) are vulnerable to these exploits?

What types of devies? Basically all new computers are vunrelable to some amount.

[Electronics Wizardy]

Just now, Blitz4 said:

Doesn't the patch slow down your cpu up to 50%?

really depends on what your doing, but normally no, normally less than a percent or two.

[straight_stewie]

It should be the case that all new hardware is not vulnerable to Spectre and Meltdown. As a result, new hardware will experience no performance loss.

Older hardware, which can be vulnerable, is fixed by modifying the kernel to perform better page isolation. This is where the performance hit comes from, and the severity of the performance hit is entirely dependent on what, and how many, OS calls the software is making.

As an interesting bit of trivia, the NSA and the IEEE warned about this taxonomy of attacks at least as early as 1995. The warnings came out of a report that was part of an NSA product evaluation so, presumably, off the shelf processors were known to be susceptible to these attacks that early and no one did anything about it for more than 20 years.

 

Spoiler

The paper is titled "The Intel 80x86 processor architecture: pitfalls for secure systems", and is available here:

https://ieeexplore.ieee.org/document/398934

 

[bloodthirster]

2 hours ago, Blitz4 said:

Doesn't the patch slow down your cpu up to 50%?

Pretty sure those were early meltdown numbers.  Not sure if it's better now.  Generally with Spectre the perf hit isn't as large. 

[Arika]

3 hours ago, Blitz4 said:

Doesn't the patch slow down your cpu up to 50%?

only in very specific workloads that regular consumers don't do, so you will notice no slowdown or very very little.