Intel Flaw Impact on VMS / NVRs Examined

The flaw requires a malicious program to be loaded and executed on a machine with an affected processor

Other than patches, is there anything we can do to help protect against this? Most of the servers we install are never interacted with so I am not sure what the level of risk is for us. Performance decrease is a major concern for me. While we typically allow for some wiggle room a potential for up to 20% decrease in performance is entirely unacceptable. 

So the real question is, on small systems is it even worth patching? This is way outside of my skill set so I am mostly in the dark here. 

Y2K Redux...

"Intel"  NSA back doors probably built in on purpose.

Maybe Oracles stock will go up?:

http://www.oracle.com/technetwork/systems/opensparc/index.html

Open Source 64 bit CPU

You sort of mixed both released issues together here.

Meltdown is the vulnerability that allows attackers to read arbitrary memory from a non privileged process including kernel memory.  This can allow escalated privileges and control of the system.  Interestingly, the patches for this cannot actually "fix" it, because there is no practical way to change the way modern existing CPUs work.  The reason for this is it exploits out of order instruction executions on the CPU.  The patches address this by removing the protected memory address mapping in user space so it makes the attack not practical anymore.  The side effect of that is the performance hit.

AWS, Azure etc were already patched before disclosure. Smaller clouds, maybe not so much because they were not in on the embargoed information.  If you are using a smaller cloud provider YOU NEED TO ASK if you are using one!

This vulnerability is especially bad for multi-tenant environments. When people ask why you don't want to share severs, this is why!  Both Xen and Docker may have Hypervisor escapes.  It hasn't been seen yet on VMware, but that is certainly no guarantee it's immune and I would not bet on that.

Spectre only affects the current process not kernel or other processes. Branch prediction and speculative execution algorithms are what Spectre attacks.  Is is mostly going to affect browsers by leaking data between tabs. Java can get outside the sandbox and read other tabs. Although this really isn't Java's fault, Peal and Python have the same problems because this is a CPU issue not a software issue.

The biggest deal though is leaking of addresses out of user space modules breaks Address space layout randomization (ASLR) which opens up a lot of other remote code execution vulnerabilities that previously had been impractical because of ASLR.  The other thing is session keys are vulnerable in the browser if the session is not ended and logged out.  This can make multi factor authentication ineffective if the session keys get stolen.  Remind users to ALWAYS log out of sessions, don't just close the tab.

The other bad news here is this has been embargoed for almost a year, so the chances a nation state has exploited this are not insignificant.  The paper also left open a number of other areas that future research needs to be done on that may lead to other exploits like these being found.

This looks like it goes all the way back to the Core Duo and Core 2 era based on the link referring to 2007 processors.  Is there a list of which processors are not affected?  I am hopeful the Xeon E5 series and up are exempted, as unlikely as it seems.

Ought to be interesting to watch how significantly the Passmark scores decline on Intel in the coming weeks.

The following Intel-based platforms are impacted by this issue. Intel may modify this list at a later time. Please check with your system vendor or equipment manufacturer for more information regarding updates for your system.

• Intel® Core™ i3 processor (45nm and 32nm)
• Intel® Core™ i5 processor (45nm and 32nm)
• Intel® Core™ i7 processor (45nm and 32nm)
• Intel® Core™ M processor family (45nm and 32nm)
• 2nd generation Intel® Core™ processors
• 3rd generation Intel® Core™ processors
• 4th generation Intel® Core™ processors
• 5th generation Intel® Core™ processors
• 6th generation Intel® Core™ processors
• 7th generation Intel® Core™ processors
• 8th generation Intel® Core™ processors
• Intel® Core™ X-series Processor Family for Intel® X99 platforms
• Intel® Core™ X-series Processor Family for Intel® X299 platforms
• Intel® Xeon® processor 3400 series
• Intel® Xeon® processor 3600 series
• Intel® Xeon® processor 5500 series
• Intel® Xeon® processor 5600 series
• Intel® Xeon® processor 6500 series
• Intel® Xeon® processor 7500 series
• Intel® Xeon® Processor E3 Family
• Intel® Xeon® Processor E3 v2 Family
• Intel® Xeon® Processor E3 v3 Family
• Intel® Xeon® Processor E3 v4 Family
• Intel® Xeon® Processor E3 v5 Family
• Intel® Xeon® Processor E3 v6 Family
• Intel® Xeon® Processor E5 Family
• Intel® Xeon® Processor E5 v2 Family
• Intel® Xeon® Processor E5 v3 Family
• Intel® Xeon® Processor E5 v4 Family
• Intel® Xeon® Processor E7 Family
• Intel® Xeon® Processor E7 v2 Family
• Intel® Xeon® Processor E7 v3 Family
• Intel® Xeon® Processor E7 v4 Family
• Intel® Xeon® Processor Scalable Family
• Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series
• Intel® Atom™ Processor C Series
• Intel® Atom™ Processor E Series
• Intel® Atom™ Processor A Series
• Intel® Atom™ Processor x3 Series
• Intel® Atom™ Processor Z Series
• Intel® Celeron® Processor J Series
• Intel® Celeron® Processor N Series
• Intel® Pentium® Processor J Series
• Intel® Pentium® Processor N Series

Anyone know if this affects the

i7-7700  (Kaby Lake - with native H.265)

and the...

i7-8700  (Coffee Lake (Kaby successor, from 4-core to 6-core) also with H.265.

I'm hoping not given how recent they came out. :-0

I have a more basic question about updates to VMS systems vs. operating system upgrades:  When we install a VMS server that was pre-configured by the manufacturer the assumption is that the OS provided has been tuned for optimum system performance.    Presumably OS components that could impact performance have been removed or disabled, and the overall system has been tested rigorously under the specific OS installed.  Automatic OS upgrades are often disabled as delivered.

In addition to the likelihood of system performance reduction following patching for these particular flaws should we be expecting specific instructions from manufacturers detailing exact patches to apply, or should we just allow the OS update tool to apply ALL available patches?

Obviously it is always important to have a clean backup of the system prior to patching, but some problems may not appear until specific conditions are met days or weeks later.

Interesting new disclosure: Intel Warned Chinese Companies of Chip Flaws Before U.S. Government:

Because the flaws can be leveraged to sneak sensitive data out of the cloud, information about them would be of great interest to any intelligence-gathering agency....

It is a “near certainty” Beijing was aware of the conversations between Intel and its Chinese tech partners, because authorities there routinely monitor all such communications