Intel ‘Downfall’: Severe flaw in billions of CPUs leaks passwords and much more

CAD4466HK

CAD4466HK

2[H]4U
Joined
Jul 24, 2008
Messages
2,840
“This vulnerability, identified as CVE-2022-40982, enables a user to access and steal data from other users who share the same computer. For instance, a malicious app obtained from an app store could use the Downfall attack to steal sensitive information like passwords, encryption keys, and private data such as banking details, personal emails, and messages. Similarly, in cloud computing environments, a malicious customer could exploit the Downfall vulnerability to steal data and credentials from other customers who share the same cloud computer.”
Click to expand...

Intel is already providing microcode updates to plug the security hole. “Intel recommends that users of affected Intel Processors update to the latest version firmware provided by the system manufacturer that addresses these issues,” the company says.


This can lead to a loss of performance of up to 50 percent under certain circumstances, however, as Moghimi warns. Intel comments on the side effects of the microcode updates here. There’s an opt-out mechanism available to avoid applying the patch.
Click to expand...

Both consumer and server processors from Intel show the gap. For consumers, all PCs or laptops with Intel Core processors of the 6th “Skylake” generation up to and including the 11th-gen “Tiger Lake” chips contain the vulnerability. This means that the vulnerability has existed since at least 2015, when Skylake was released.
Click to expand...

Intel’s newer 12th-gen and 13th-gen Core processors are not affected.




The downfall vulnerability now discovered is reminiscent of the legendary Meltdown and Spectre vulnerabilities from 2018.
Click to expand...
Stolen from PCWorld
https://www.pcworld.com/article/202...ns-of-intel-cpus-how-to-protect-yourself.html
TL;DR
I wouldn't worry too much about this as long as you are not sharing your PC with the Taliban or Red October.
 
Wow, that much performance hit, this is when I wish we had consumer protection laws that would force intel to cough up new CPUs not affected to replace those that are for those who are impacted by 50% performance hit, because you are not longer getting the product you paid for.
Makes you wonder how much intel knows about these side channel attacks and just shoved em under the rug to try and keep their performance crown....

But, in reality , to be exploited by this, and get actual useful data from it...seems very very difficult. I mean, a malicious actor could just buy some instances across multiple regions and providers and run their tools to exploit this sending out the data collected and see what they get...
 
I'd like to see firmware give options in the BIOS about whether to enable or disable certain mitigations, as opposed to the only option being to remain on an older firmware. Even better would be the ability to exclude mitigations from certain tasks, such as gaming.

Hate to say it, but I think that Intel is just fine with this status quo. Most people don't pay much attention to these things, and the effect is that your computer basically gets slower over time - sort of a form of planned obsolencense so people aren't keeping their 2500k for 10 years anymore, etc. It makes benchmarks for their new CPUs look that much better when the older CPUs are gimped by mitigations.
 
MrGuvernment said:
Wow, that much performance hit, this is when I wish we had consumer protection laws that would force intel to cough up new CPUs not affected to replace those that are for those who are impacted by 50% performance hit, because you are not longer getting the product you paid for.
Makes you wonder how much intel knows about these side channel attacks and just shoved em under the rug to try and keep their performance crown....

But, in reality , to be exploited by this, and get actual useful data from it...seems very very difficult. I mean, a malicious actor could just buy some instances across multiple regions and providers and run their tools to exploit this sending out the data collected and see what they get...
Click to expand...

The government pays both Intel and AMD to put backdoors in for the government lol
 
I mean yeah 6-11'th Gen.
It's not surprising, requires local access, and for compromised software to be installed.

Realistically yeah telephone scammers, we all know the ones, would be able to exploit this, and the people they target are likely to be using older machines falling into that category.

The information they could get there is somewhat limited, and local security settings on the machine can further mitigate it so... Not terribly bad all in all.
 
Well this isn't some gov paid back door. This is yet an other example of Intel using iffy speculation to gain performance. Gather Data Sampling (AVX512 gather instructions are essentially guilty of doing the same thing Intels speculation engine did... it doesn't check permissions) is an Intel only thing... and it has always been a red flag if you understand how it works. lol0
When Intel says this doesn't effect their current gen... that is nice, the only reason its true is because they couldn't get AVX512 squeezed in this gen. They are still selling Tiger lake which is effected it isn't EOL yet. Also a lot of companies running year old server chips that are effected.

The whole it must be local.... isn't the hindrance many believe for some of those big servers. Plenty of corps running virtual machines. This is also a potential attack vector on cloud systems. I don't think this one is bad as specter and meltdown where for Intel... from what I understand attacks based on downfall would need a good amount of time to sift data. That makes things like servers spinning up for a few days a lot harder to target.

At some point people will have to just accept that if you buy Intel... most likely some speculation engine, or memory fragment algorithm like this one will get exploited and the fix will halve performance.

Yet another major performance hit that AMD avoided.
Like specter and meltdown its interesting that researchers just happened to find a AMD thing at the same time... and again what they found is a lot less of a worry. Inception on Ryzen 3 and 4 at best can leak a few bytes a real world attack based on it is almost impossible.... but anyway the fix shouldn't really effect performance either.
 
Last edited:
Lakados said:
I mean yeah 6-11'th Gen.
It's not surprising, requires local access, and for compromised software to be installed.

Realistically yeah telephone scammers, we all know the ones, would be able to exploit this, and the people they target are likely to be using older machines falling into that category.

The information they could get there is somewhat limited, and local security settings on the machine can further mitigate it so... Not terribly bad all in all.
Click to expand...
The desktop Skylake-era of processors and older, which are all vulnerable, won't be patched this time around since they are all EOL as of Q4 2022.
At least the leaks from said exploits would be in the B/s, but this would most likely be most important to mitigate in datacenters and VM hosting environments where said exploits could run for months on end and get quite an amount of usable data after a time.

ChadD said:
The whole it must be local.... isn't the hindrance many believe for some of those big servers. Plenty of corps running virtual machines. This is also a potential attack vector on cloud systems. I don't think this one is bad as specter and meltdown where for Intel... from what I understand attacks based on downfall would need a good amount of time to sift data. That makes things like servers spinning up for a few days a lot harder to target.

At some point people will have to just accept that if you buy Intel... most likely some speculation engine, or memory fragment algorithm like this one will get exploited and the fix will halve performance.
Click to expand...
Exactly, this. ^
 
Gideon said:
Hope that 50% hit in performance is on some pretty obscure workloads.
Click to expand...
Looks like Handbrake and Blender on the client side...maybe.


Performance on Client​

Heavily optimized applications that rely on vectorization and gather instructions to achieve the highest performance may see an impact with the GDS mitigation update. These are applications like graphical libraries, binaries, and video editing software that might use gather instructions. Our analysis has identified some specialized cases where client applications may see a performance impact. For example, certain digital art application add-ons have shown some performance impact. However, most client applications are not expected to be noticeably impacted because gather instructions are not typically used in the hot path.




Performance on Server​

Though most applications will not see any performance impact from the GDS mitigation, heavily optimized applications that rely heavily on vectorization to achieve the highest performance possible may see performance drops that will range from modest to significant. The applications with the highest performance impacts will be those where gather instructions are part of the hot path (for example, Large-scale Atomic/Molecular Massively Parallel Simulator (LAMMPS), GROningen Machine for Chemical Simulations (GROMACS), and Nanoscale Molecular Dynamics (NAMD)). These gather instructions might be introduced by the developer manually or might be generated by the compiler. In this second scenario, the specific compiler and the flags passed to the compiler may have a significant role in the overall performance impact. In general, applications using flags for performance optimization and for vectorization might see larger performance impact if the binary generated by the compiler includes gather instructions in the hot path.

https://www.intel.com/content/www/u...rces/gds-mitigation-performance-analysis.html
 
enables a user to access and steal data from other users who share the same computer. For instance, a malicious app obtained from an app store could use the Downfall attack to steal sensitive information like passwords, encryption keys, and private data such as banking details, personal emails, and messages. Similarly, in cloud computing environments, a malicious customer could exploit the Downfall vulnerability to steal data and credentials from other customers who share the same cloud computer.”
Click to expand...
So pretty much if someone else doesn't use my laptop, I don't let someone remote access, or DL certain software, I'm pretty much OK......
So, is this a BIOS update or what, because I also don't want to risk MSI disabling my 2nd m.2 bay I add for my laptop?
 
The Mad Atheist said:
So pretty much if someone else doesn't use my laptop, I don't let someone remote access, or DL certain software, I'm pretty much OK......
So, is this a BIOS update or what, because I also don't want to risk MSI disabling my 2nd m.2 bay I add for my laptop?
Click to expand...

Microcode is either volatilely loaded by OS or BIOS update (meaning doesn't actually change the microcode on the CPU, just switches over to the newer 'sideloaded' microcode update @ runtime) - so you're gonna get it either or both via BIOS and Windows Update
 
Just like Specter and Meltdown. Downfall is a timing attack that doesn't make sense for phone scammers and other consumer user pests to bother with.... us little end users don't have to worry too much about these. There are easier to exploit windows vulnerabilities they would use. Of course most of them don't even bother with such things... if you get someone to install a remote desktop program of their own accord you hardly need to exploit anything.

Its the server world that is going to get hit hard by this. Anything that uses AVX is going to get hit hard, and anything that really crunches anything is going to get hit to varying degrees. Funny enough it will be newer software that is built to thread and for mass parallelization that will be most effected. This in a lot of ways boils down to yet another Intel security cheat for performance... more algorithms not checking security bits. It seems the Intel chip designers had a pretty laze fair take on permissions. (which is even more proof that the issues with the speculation engine where not some oversight they understood what they where skipping) I feel for all the computer depts at corps that got hit by S&M... who choose to stick with Intel again. Intel has been getting hit hard by AMD in the server markets. This is going to make it even worse... and if early rumors on Zen5 are to be trusted, the next decade for Intel is going to really suck. They better get those next gen fabs up and running at peek performance on schedule this time.
 
ChadD said:
Just like Specter and Meltdown. Downfall is a timing attack that doesn't make sense for phone scammers and other consumer user pests to bother with.... us little end users don't have to worry too much about these. There are easier to exploit windows vulnerabilities they would use. Of course most of them don't even bother with such things... if you get someone to install a remote desktop program of their own accord you hardly need to exploit anything.

Its the server world that is going to get hit hard by this. Anything that uses AVX is going to get hit hard, and anything that really crunches anything is going to get hit to varying degrees. Funny enough it will be newer software that is built to thread and for mass parallelization that will be most effected. This in a lot of ways boils down to yet another Intel security cheat for performance... more algorithms not checking security bits. It seems the Intel chip designers had a pretty laze fair take on permissions. (which is even more proof that the issues with the speculation engine where not some oversight they understood what they where skipping) I feel for all the computer depts at corps that got hit by S&M... who choose to stick with Intel again. Intel has been getting hit hard by AMD in the server markets. This is going to make it even worse... and if early rumors on Zen5 are to be trusted, the next decade for Intel is going to really suck. They better get those next gen fabs up and running at peek performance on schedule this time.
Click to expand...
Intel is dead. /s
 
  • Like
Reactions: ChadD
like this
DooKey said:
Intel is dead. /s
Click to expand...
No, not dead. They are probably going to loose another 10% of their server market over the next 2 years. Which isn't great. :)
Its not just AMD nibbling their market share either... IBMs saw almost a 20% bump in power system sales last year. IBM is actually doing a good job executing as well.
 
GotNoRice said:
I'd like to see firmware give options in the BIOS about whether to enable or disable certain mitigations
Click to expand...
I know this isn't a particularly great solution, but Linux accepts start-up directives like 'disable mitigations'.
 
michalrz said:
I know this isn't a particularly great solution, but Linux accepts start-up directives like 'disable mitigations'.
Click to expand...
That's a good approach, but it would still require someone to rely on software mitigations and not update their bios firmware. I don't think that you can disable a mitigation in software once it's mitigated at the bios level.
 
ChadD said:
No, not dead. They are probably going to loose another 10% of their server market over the next 2 years. Which isn't great. :)
Its not just AMD nibbling their market share either... IBMs saw almost a 20% bump in power system sales last year. IBM is actually doing a good job executing as well.
Click to expand...
I was wondering about how their Power10 CPUs were doing and apparently they have something like double the IPC of both current Intel and AMD x86-64 offerings, along with 8-way SMT.
For CPU-based workloads IBM's Power ISA is still the champion.
 
GotNoRice said:
That's a good approach, but it would still require someone to rely on software mitigations and not update their bios firmware. I don't think that you can disable a mitigation in software once it's mitigated at the bios level.
Click to expand...
Hmm, didn't think od that.
One of the first messages dmesg pukes out after uncompressing initrd and loading the kernel is:
Code: 
 0.000000 BIOS-provided physical RAM map:
 0.000000 BIOS-e820: mem 0x0000000000000000-0x000000000009ffff usable
(...)
But some of the further messages do stuff like:
Code: 
0.000000 e820: update mem 0xb87c6018-0xb87e5857 usable ==> usable
I wonder if this implies masking BIOS-offered features/settings.
 
CAD4466HK said:
That's why I put it in red font, I would rather take the risk than lose 50% performance, just like Meltdown/Spectre.
Click to expand...
On Linux I put mitigations=off because nobody has used these cpu exploits as far as I'm aware. Has any virus used Meltdown/Spectre? It's really hard to exploit. Don't think that most systems are patched because this has traditionally been a very hard task. This is probably one of those things that need root privileges to do anything, much like most exploits. At which point does this not turn into a massive lawsuit against CPU manufacturers that quickly patch their mistakes but also hurt performance? Nearly every CPU has some sort of exploit that gets patched and hurts performance. Before someone says ARM is immune, no they are not.
 
DukenukemX said:
On Linux I put mitigations=off because nobody has used these cpu exploits as far as I'm aware. Has any virus used Meltdown/Spectre? It's really hard to exploit. Don't think that most systems are patched because this has traditionally been a very hard task. This is probably one of those things that need root privileges to do anything, much like most exploits. At which point does this not turn into a massive lawsuit against CPU manufacturers that quickly patch their mistakes but also hurt performance? Nearly every CPU has some sort of exploit that gets patched and hurts performance. Before someone says ARM is immune, no they are not.
Click to expand...
I'd probably be rocking mitigations=off as well, but some attacks are actually done by competent people who don't want you to detect their activity. So, I'm on the fence with this still.
My machine gives me enough performance as is, and I no longer mine anything.
But, some Distributed Computing competitions are cool as tits and I might try omitting mitigations for those.

Edith: When I was young, like in 2006, I'd usually compile my own kernel anyway. I no longer do to avoid fuckery, but the urge is there...
 
A bit of a tangent, but if you want your Ryzen to do power states switches faster, you can compile-in the appropriate schedulers that work in a higher resolution and in conjunction with the CPU's own features for this.
 
Red Falcon said:
I was wondering about how their Power10 CPUs were doing and apparently they have something like double the IPC of both current Intel and AMD x86-64 offerings, along with 8-way SMT.
For CPU-based workloads IBM's Power ISA is still the champion.
Click to expand...
IBM has a very good solution for a lot of specific industries. The have cemented their spot in the markets they are embedded such as finance and banking. Power is just better suited to those workloads... and it is also far more secure then x86. (and that view continues to be reinforced by things like this... Intel having serious security issues every couple years is really helping IBM) IBM is lean and mean these days... getting rid of their x86 server business almost a decade ago when they sold it to Lenovo was a smart move. It forced them to really focus the resources they have on the markets they where best suited for. Now they are working on actually very good AI hardware... and solutions specifically for the financial markets they serve like real time AI analysis of transactions looking for fraud. As well as probably all sorts of other real time tracking and data gathering we don't want to think about. lol I get the feeling IBM has been a bit put out by their servers so often being paired with Nvidia hardware. I don't think things like the Summit supercomputer using power and 27k Volta GPUs sat well with them. (after that they incorporated AI interference bits into Telum and started their AIU development) IBM isn't stupid they know they aren't going to jump into the market and roll out some IBM super AI GPU... their "Artificial intelligence unit" (their name lol) focuses on inference and implementing trained models for real world work. As much as Intel needs to worry about AMD eating server market share, if I was Intel (and Nvidia for that matter) I would be much more concerned about what a resurgent IBM is capable of. They have also been going after the mid range size customer market again the last couple years. A power server might still be a good bit more expensive up front... but IBM has had a real case the since P9 for an actual real performance per $ spent win. Even for mid size business as they want to implement AI models. If the option is racks of stupid expensive Nvidia hardware. A mid size IBM server with Telum and potentially a AIU unit or two... may well do more work with much lower power usage. With Intel constantly having security screw ups and Nvidia constantly wanting to charge 1980 IBM pricing.... IBMs upfront costs start to seem reasonable.

https://www.reuters.com/technology/...hip-new-cloud-service-lower-costs-2023-07-11/
 
DukenukemX said:
On Linux I put mitigations=off because nobody has used these cpu exploits as far as I'm aware. Has any virus used Meltdown/Spectre? It's really hard to exploit. Don't think that most systems are patched because this has traditionally been a very hard task. This is probably one of those things that need root privileges to do anything, much like most exploits. At which point does this not turn into a massive lawsuit against CPU manufacturers that quickly patch their mistakes but also hurt performance? Nearly every CPU has some sort of exploit that gets patched and hurts performance. Before someone says ARM is immune, no they are not.
Click to expand...
And these exploits would more likely be used in datacenters, servers farms, cloud hosts. I could fire up a new instance on any provider and let my malicious workload run and see what it collects sort of thing, so it is more shared hosting that needs to consider the mitigations for this vs end users
 
michalrz said:
I'd probably be rocking mitigations=off as well, but some attacks are actually done by competent people who don't want you to detect their activity. So, I'm on the fence with this still.
My machine gives me enough performance as is, and I no longer mine anything.
But, some Distributed Computing competitions are cool as tits and I might try omitting mitigations for those.

Edith: When I was young, like in 2006, I'd usually compile my own kernel anyway. I no longer do to avoid fuckery, but the urge is there...
Click to expand...
If this was a computer used in a work place then the mitigations stay on. I wouldn't want to be the guy that lost the companies data and costed them millions. For a home computer it's not something I'd keep on. If someone found a way to use Spectre/Meltdown then it'll be a on a server with Sony's name on it. Even then I wouldn't be surprised if they need root privileges.
 
Initial Benchmarks of the Intel Downfall Mitigation Performance Impact

Phoronix has published benchmarks of the vulnerability's mitigation, demonstrating the effects of "Downfall"

The Xeon Platinum 8380 was observed in various instances, with the old "390" and the new "3a5" microcodes...as predicted, the processor saw a performance decline in all scenarios...in OpenVKL, the performance drop was recorded at 6%, while in OSPRay 1.2, it reached 34%...AI workloads oversaw a vast drop, with applications such as Neural Magic DeepSparse 1.5, which was expected given that the HPC workloads were predicted to drop

The more consumer-focused Intel Core i7-1165G7 CPU couldn't prevent the mitigation from affecting its performance, as the processors took massive hits...the performance penalties were similar to those of the other processors tested, varying from 19-39% in OSPRay 2.12, while it showed an almost 11% reduction in OpenVLK 1.3.1...the "Downfall" vulnerability compromised multiple processors, even impacting the mainstream ones, such as the Alder Lake CPUs...

https://www.phoronix.com/review/intel-downfall-benchmarks
 
DukenukemX said:
If this was a computer used in a work place then the mitigations stay on. I wouldn't want to be the guy that lost the companies data and costed them millions. For a home computer it's not something I'd keep on. If someone found a way to use Spectre/Meltdown then it'll be a on a server with Sony's name on it. Even then I wouldn't be surprised if they need root privileges.
Click to expand...
Your not wrong, few of us are worth the time investment.

The through line though with of All of Intels vulnerabilities S&M and Downfall have been Intels issues with permissions. They all work because they only need to be on the system.... Intels Speculation engine, and now their multi thread memory gather and sample algorithm all share the same flaw. Which is they don't bother with a permission bit. Both algorithms do the work and THEN check on multiple bits of data at once (instead of the proper but slower method of checking first on each bit of data) it is easy to see how that would make a CPU faster... gather up 500 small chunks of data, see they are related THEN check security. instead of 500 smaller checks.

This is why its an massive issue for many companies using Intel servers. If say Sony as the example has remote offices that are all running VM sessions on the company servers.... you only need to get your malware on one of those remote VM running systems. No doubt S&M have been used in attacks. They just don't tend to get publicly reported. S&M are the type of attacks that don't even get noticed.
 
polonyc2 said:
Initial Benchmarks of the Intel Downfall Mitigation Performance Impact

Phoronix has published benchmarks of the vulnerability's mitigation, demonstrating the effects of "Downfall"

The Xeon Platinum 8380 was observed in various instances, with the old "390" and the new "3a5" microcodes...as predicted, the processor saw a performance decline in all scenarios...in OpenVKL, the performance drop was recorded at 6%, while in OSPRay 1.2, it reached 34%...AI workloads oversaw a vast drop, with applications such as Neural Magic DeepSparse 1.5, which was expected given that the HPC workloads were predicted to drop

The more consumer-focused Intel Core i7-1165G7 CPU couldn't prevent the mitigation from affecting its performance, as the processors took massive hits...the performance penalties were similar to those of the other processors tested, varying from 19-39% in OSPRay 2.12, while it showed an almost 11% reduction in OpenVLK 1.3.1...the "Downfall" vulnerability compromised multiple processors, even impacting the mainstream ones, such as the Alder Lake CPUs...

https://www.phoronix.com/review/intel-downfall-benchmarks
Click to expand...
If feel for consumers running windows.
Its easy enough with Linux to boot with gather_data_sampling=off. Windows users probably won't have much choice.

I am not running Intel... I just run with AMD mitigations on cause they really don't effect performance enough to worry about. If I was running Intel hardware, I would just run a current kernel with mitigations disabled... and a hardened kernel with mitigations on. Its easy enough to reboot to the secure kernel when needed.
 
It seems that an AMD exploit called Inception has been discovered as well by a team of researchers at ETH Zurich.

In this groundbreaking research shared with Hackread.com, ETH Zurich’s team, led by Professor Razavi, delved into vulnerabilities in CPUs manufactured by AMD. By capitalizing on the CPUs’ inclination to treat erroneous instructions as familiar, the researchers managed to implant an idea into the CPU’s memory during its predictive processes.


Consequently, the protective security features designed to validate the accuracy of predictions were bypassed, enabling the researchers to access sensitive data, including hashed root passwords.

https://www.hackread.com/novel-inception-attack-exposes-data-cpus/

PDF:
https://www.usenix.org/conference/usenixsecurity23/presentation/trujillo
 
CAD4466HK said:
It seems that an AMD exploit called Inception has been discovered as well by a team of researchers at ETH Zurich.

In this groundbreaking research shared with Hackread.com, ETH Zurich’s team, led by Professor Razavi, delved into vulnerabilities in CPUs manufactured by AMD. By capitalizing on the CPUs’ inclination to treat erroneous instructions as familiar, the researchers managed to implant an idea into the CPU’s memory during its predictive processes.


Consequently, the protective security features designed to validate the accuracy of predictions were bypassed, enabling the researchers to access sensitive data, including hashed root passwords.

https://www.hackread.com/novel-inception-attack-exposes-data-cpus/

PDF:
https://www.usenix.org/conference/usenixsecurity23/presentation/trujillo
Click to expand...
Its interesting how every time a major Intel vulnerability is made public... some research (at a university with Intel servers) finds a minor AMD vulnerability that gets talked up and given a scary name as well. :)

https://www.phoronix.com/news/AMD-INCEPTION

AMD has already pushed an AGESA fix upstream. Micheal at phoronix says he'll bench when MFGs push the new fixed AGESA. Performance impact is expected to be minimal.

For what its worth from what I have read this vulnerability is only ever capable of leaking a very small bit of data at a time... max theoretical data leak speed would be 39 bytes a second. (with actual real world cache usage making it low single digits in reality) Then an attacker would have to look for patterns in that. As I understand it a real world hack based on this would probably have to be looking at months of data. I suspect to leak a password these researchers probably had to force a reboot state or something 1,000s of times to gather enough data to scrape. This uses some sort of transient execution attack it is interesting research... but real world attacks on this one seem even more unlikely (impractical) then a downfall hack. To me it looks like Zen 3 and 4 where still doing proper security checks so I suspect the fix is as simple as a cache flush and AMD is probably correct that performance will essentially be unaffected.
 
ChadD said:
Its interesting how every time a major Intel vulnerability is made public... some research (at a university with Intel servers) finds a minor AMD vulnerability that gets talked up and given a scary name as well. :)
Click to expand...
You are spot on mate!
 
You must log in or register to reply here.
Back
Top