Foreshadow, yet another Intel vulnerability

[D13H4RD]

All these names...

[DrMacintosh]

Is this AMDs strategy? Achieve better single core performance than Intel by measure of Intel needing microcode patches that reduce performance?  

[Ashleyyyy]

11 minutes ago, DrMacintosh said:

Is this AMDs strategy? Achieve better single core performance than Intel by measure of Intel needing microcode patches that reduce performance?  

 

 

on a serious note, that might become an issue for intel though, if this keeps going on... 

[DrMacintosh]

1 minute ago, firelighter487 said:

 

 

on a serious note, that might become an issue for intel though, if this keeps going on... 

Intel Core processors slowly gimped over time as new security holes are found over the months  

[Ashleyyyy]

Just now, Arika S said:

so far there is no indication that there will be performance loss to patch this

interesting... i guess that's good news for people with newer systems then. 

[Peter S]

Vulnerabilities are really a trending topic for all time. Foreshadow is the third significant flaw to affect the company’s chips this year. I hope that the patch they released will really mitigates or stops the problem for attackers could exploit this vulnerability to obtain sensitive information.

[Questargon]

There is an overview of all additional vulnerabilities in processors since Spectre & Meltdown at the end of this article here. The count is: 16 found so far.

(Sorry, german language, but the table is "international"):
https://heise.de/-4137209

 

Ninja-Edit: Found two videos explaining the "Foreshadow" from Red Hat:

 

 

Edited August 15, 2018 by Questargon
Added videos

[GoldenLag]

3 hours ago, DrMacintosh said:

Intel Core processors slowly gimped over time as new security holes are found over the months  

AMDs new strategy. Poke holes in the competition stability or security untill they win

[Froody129]

Would've thought if it affects Skylake and up it would be called Skyfall

 

Y'all need to be careful of black hats

[WereCat]

13 hours ago, GoldenLag said:

Except Ryzen never fall. 

It can if Linus tries to handle it and drop it.

[Tcrumpen]

12 hours ago, Bananasplit_00 said:

Skylake and up? Then I don't care too much. 4th gen for the win!

3rd Gen FTW

[Tcrumpen]

32 minutes ago, Froody129 said:

Would've thought if it affects Skylake and up it would be called Skyfall

 

Y'all need to be careful of black hats

Copyright issues

[Brooksie359]

16 hours ago, bcredeur97 said:

inb4 we go back to pentium 4 era of performance just from security patches

Time to go back to Turing machines. 

[PlayStation 2]

laughs in bulldozer and ryzen

[Gikero]

 

17 hours ago, bcredeur97 said:

inb4 we go back to pentium 4 era of performance just from security patches

I made this joke to a friend a few weeks ago! It is starting to look like everything Intel has done to increase speed basically relates to these vulnerabilities.

[pinksnowmanshandle]

womp womp

 

[asus killer]

who cares, well all be using AMD cpu's in no time (i'm already) 

 

more seriously isn't it natural for this news to feature more Intel then AMD considering that almost everyone had a Intel CPU's up to 1 year ago?

[Falconevo]

16 hours ago, firelighter487 said:

Xeon X5650 here  

 

https://ark.intel.com/products/47922/Intel-Xeon-Processor-X5650-12M-Cache-2_66-GHz-6_40-GTs-Intel-QPI

It affects you also, it affects all their CPU's and you are on Westmere.  Bare in mind that this primarily affects cloud service providers with shared virtualised hosts.  For public cloud service providers this is a massive shit storm of work to sort out.

 

CVE-2018-3646 

Affected list.

Intel Code Name	FMS	Intel Brand Names
Nehalem-EP	0x106a5	Intel Xeon 35xx Series; Intel Xeon 55xx Series
Lynnfield	0x106e5	Intel Xeon 34xx Lynnfield Series
Clarkdale	0x20652	Intel i3/i5 Clarkdale Series; Intel Xeon 34xx Clarkdale Series
Arrandale	0x20655	Intel Core i7-620LE Processor
Sandy Bridge DT	0x206a7	Intel Xeon E3-1100 Series; Intel Xeon E3-1200 Series; Intel i7-2655-LE Series;  Intel i3-2100 Series
Westmere EP	0x206c2	Intel Xeon 56xx Series; Intel Xeon 36xx Series
Sandy Bridge EP	0x206d7	Intel Pentium 1400 Series; Intel Xeon E5-1400 Series; Intel Xeon E5-1600 Series; Intel Xeon E5-2400 Series; Intel Xeon E5-2600 Series; Intel Xeon E5-4600 Series
Nehalem EX	0x206e6	Intel Xeon 65xx Series; Intel Xeon 75xx Series
Westmere EX	0x206f2	Intel Xeon E7-8800 Series; Intel Xeon E7-4800 Series; Intel Xeon E7-2800 Series
Ivy Bridge DT	0x306a9	Intel i3-3200 Series; Intel i7-3500-LE/UE, Intel i7-3600-QE, Intel Xeon E3-1200-v2 Series; Intel Xeon E3-1100-C-v2 Series; Intel Pentium B925C
Haswell DT	0x306c3	Intel Xeon E3-1200-v3 Series
Ivy Bridge EP	0x306e4	Intel Xeon E5-4600-v2 Series; Intel Xeon E5-2400-v2 Series; Intel Xeon E5-2600-v2 Series; Intel Xeon E5-1400-v2 Series; Intel Xeon E5-2600-v2 Series
Ivy Bridge EX	0x306e7	Intel Xeon E7-8800/4800/2800-v2 Series
Haswell EP	0x306f2	Intel Xeon E5-2400-v3 Series; Intel Xeon E5-1400-v3 Series; Intel Xeon E5-1600-v3 Series; Intel Xeon E5-2600-v3 Series; Intel Xeon E5-4600-v3 Series
Haswell EX	0x306f4	Intel Xeon E7-8800/4800-v3 Series
Broadwell H	0x40671	Intel Core i7-5700EQ; Intel Xeon E3-1200-v4 Series
Avoton	0x406d8	Intel Atom C2300 Series; Intel Atom C2500 Series; Intel Atom C2700 Series
Broadwell EP/EX	0x406f1	Intel Xeon E7-8800/4800-v4 Series; Intel Xeon E5-4600-v4 Series; Intel Xeon E5-2600-v4 Series; Intel Xeon E5-1600-v4 Series
Skylake SP	0x50654	Intel Xeon Platinum 8100 (Skylake-SP) Series; Intel Xeon Gold 6100/5100 (Skylake-SP) Series Intel Xeon Silver 4100, Bronze 3100 (Skylake-SP) Series
Broadwell DE	0x50662	Intel Xeon D-1500 Series
Broadwell DE	0x50663	Intel Xeon D-1500 Series
Broadwell DE	0x50664	Intel Xeon D-1500 Series
Broadwell NS	0x50665	Intel Xeon D-1500 Series
Skylake H/S	0x506e3	Intel Xeon E3-1500-v5 Series; Intel Xeon E3-1200-v5 Series
Kaby Lake H/S/X	0x906e9	Intel Xeon E3-1200-v6

[pas008]

I'm sure we will see more of this 

finding it everywhere if you look for it

No one really hasnt been targeted

[AnonymousGuy]

This whole thing just reads like it's now become a PhD thesis circle jerk of finding unexploitable vulnerabilities.

 

I found a flaw too...I just need admin access, a mouse, keyboard, and sitting in front of your computer and I can steal all your data!

[mark_cameron]

23 hours ago, mark_cameron said:

When is the Casino Royale vulnerability going to be found?

 

Or maybe View to a Kill?

 

Or Thunderball ?

 

[dfsdfgfkjsefoiqzemnd]

4 hours ago, Falconevo said:

It affects you also, it affects all their CPU's and you are on Westmere.

This particular vulnerability according to Intel's own advisory page affects :

 

6th generation Intel® Core™ processors
7th generation Intel® Core™ processors
8th generation Intel® Core™ processors
Intel® Xeon® Processor E3 v5 Family
Intel® Xeon® Processor E3 v6 Family

 

But that's just the Foreshadow/L1TF vulnerability.  Looking at the list of Intel CPUs that are affected by speculative execution vulnerabilities in general, you may want to refrain from buying anything more modern than a Pentium 4

 

 

Intel® Core™ i3 processor (45nm and 32nm)

Intel® Core™ i5 processor (45nm and 32nm)
Intel® Core™ i7 processor (45nm and 32nm)
Intel® Core™ M processor family (45nm and 32nm)
2nd generation Intel® Core™ processors
3rd generation Intel® Core™ processors
4th generation Intel® Core™ processors
5th generation Intel® Core™ processors
6th generation Intel® Core™ processors
7th generation Intel® Core™ processors
8th generation Intel® Core™ processors
Intel® Core™ X-series Processor Family for Intel® X99 platforms
Intel® Core™ X-series Processor Family for Intel® X299 platforms
Intel® Xeon® processor 3400 series
Intel® Xeon® processor 3600 series
Intel® Xeon® processor 5500 series
Intel® Xeon® processor 5600 series
Intel® Xeon® processor 6500 series
Intel® Xeon® processor 7500 series
Intel® Xeon® Processor E3 Family
Intel® Xeon® Processor E3 v2 Family
Intel® Xeon® Processor E3 v3 Family
Intel® Xeon® Processor E3 v4 Family
Intel® Xeon® Processor E3 v5 Family
Intel® Xeon® Processor E3 v6 Family
Intel® Xeon® Processor E5 Family
Intel® Xeon® Processor E5 v2 Family
Intel® Xeon® Processor E5 v3 Family
Intel® Xeon® Processor E5 v4 Family
Intel® Xeon® Processor E7 Family
Intel® Xeon® Processor E7 v2 Family
Intel® Xeon® Processor E7 v3 Family
Intel® Xeon® Processor E7 v4 Family
Intel® Xeon® Processor Scalable Family
Intel® Xeon® Processor D (1500, 2100)

Source : https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html

[Guest]

On 8/15/2018 at 12:04 PM, DaPhuc said:

How many performance will it impact? 

About 10 performances it will impact 

[Drak3]

Here's what's needed to exploit the next Intel vulnerability:

• A machine running Ryzen 69 and Backtrack 7
• 10GBps network connection
• A working disc of Pong
• A1 Abrams tank, circa 1998
• Fall guy
• A whole lot of duct tape

[Stefan Payne]

On 14.8.2018 at 9:29 PM, Br3tt96 said:

Ryzenfall is kinda cool. As far as names go. lol

Yeah, though that one is really bullshit and looks like either a Marketing Stunt or stock manipulation as some of the actors involved were IIRC convicted of something like that in the past or at least stood trial.

 

And be honest:
How usefull is a "vulnerability" for that you need Admin rights?! And a Firmware that is specific for the machine it has to run on. Not very...

If you already have admin rights, you have better things to do than to flash a BIOS/Firmware of a device, you would usually install a rootkit or something like that. But flashing a BIOS? Naa, too much hassle, if you're already in...

 

Its like you want to rob a bank. And to rob the bank and what to do when you're already in the vault. You probably have better things to do - like actually rob the bank - than to install some stuff you could use for something, don't you?

 

23 hours ago, Maria Phene said:

Vulnerabilities are really a trending topic for all time. Foreshadow is the third significant flaw to affect the company’s chips this year. I hope that the patch they released will really mitigates or stops the problem for attackers could exploit this vulnerability to obtain sensitive information.

It is and according to the one who found Spectre/Meltdown its a shadow on the horizon for almost 5 years...

Because he wrote a patch, Intel was very interested in it and because of that, he looked further into the things and the Result was that he found Spectre/Meltdown. Yeah...

 

So with that in mind, its entirely possible that Intel at least had a hunch that those things might be possible and the fix would be rather simple, if you design a CPU from the ground up: Implement access checks inside the CPU. Wich they didn't because they didn't do a new CPU....

 

 

 

The worst thing:
It hits Intel at exactly the right time...

Its when AMD just came out with a pretty competitive product and there is an actual choice between Intel and AMD. And it tarnishes the Reputation that many people gave both companys (like Intel is more stable, wich is some shit from the 90s and wasn't really true then)...