How are things with Meltdown And Spectre nowadays?

[Grx]

Hey, so I’ve been on a WAN Show binge for some time and I stumbled upon the one about Meltdown and Spectre. I got curious again about this and I tried googling if and how it’s been resolved, but all the posts I could find were right around that period where things were uncertain, so I thought to post here and ask you guys about it.

 

Have these vulnerabilities been fixed with just some updates or are they impossible to patch and we need new CPUs to get rid of them?

I’m mostly interested in how they affect Intel procesors and Windows 10, but I’m also interested in AMD, ARM & the other OS’

[Guest The Viking]

AMD: only one affects them, spectre. It's so hard to exploit spectre on AMD's side that you can consider them secure.

Intel: they patched some stuff, broke a lot of stuff, gave up on patching old stuff, will have to fix the flaw on architecture level, so 2019 or 2020 for them.

[Mira Yurizaki]

49 minutes ago, Grx said:

Have these vulnerabilities been fixed with just some updates or are they impossible to patch and we need new CPUs to get rid of them?

Hardware that's vulnerable to Meltdown and Spectre can be patched through software, but it reduces their performance. How much depends on what you're doing, but most accounts point that the patching, at least the latest and greatest, don't really impact performance as much as feared and it has very little impact on consumer use cases.

 

Otherwise, obviously a new architecture is needed to be not-vulnerable without a patch.

Quote

I’m mostly interested in how they affect Intel procesors and Windows 10, but I’m also interested in AMD, ARM & the other OS’

The impact on that particular combination is minimal, in that you're likely running a consumer based use case in this scenario. Even in a workstation use case the impact may not be appreciable. It's only server use cases where patching starts to show it's issues.

 

AMD is vulnerable to Spectre variants GPZ 1 and 2. ARM said that some architectures/processors were affected, but not all.

 

However, as a side note, take a first party's report of whether or not they're secure or not with a grain of salt. AMD first claimed that they were not vulnerable to variant GPZ 2 because nobody demonstrated it was vulnerable. But a while later they said that GPZ 2 is applicable to them. Any security vulnerability auditing must be done by a third party. If it is done by a first party, they better have a damned intricately detailed report and a method that anyone can use to verify their claims.

[App4that]

Fun fact, I gained 2 fps with the security update bios from ASUS, literaly the only change I found and that was in Far Cry 5.

 

Spectre and meltdown were just fear mongering, sign of the times. Fear sells. 

[Princess Luna]

It's old news already, you did your windows update... your gaming performance is the same if not better actually and life goes on.

[porina]

Meltdown: Intel only, patched via Windows Updates. If you're up to date on them, you're fine.

 

Spectre: Requires microcode update on both Intel and AMD. On Intel side, first version had stability problems, they updated it again and that seems to have done the trick. Look for March or newer bios for the good one (not sure of exact date of availability). Check mobo manufacturer for updated bios availability. Skylake and newer is generally ok, limited support before that, more towards higher end mobos of the time like some X99 or Z97. Alternatively I believe MS have a manual Windows Update that installs microcode in software, which might be the only option for older CPUs who will never get mobo bios. AMD have said they will provide AGESA update but I'm not aware of this being available yet.

 

Android: believe patches have been made available but not sure on exact timescale or deployment.