Slashdot Mirror
NVIDIA GPUs Weren't Immune To Spectre Security Flaws Either (engadget.com)
Nvidia has became the latest chipmaker to release software patches for the Spectre microchip security threat, indicating that the chipset flaw was affecting graphic processors as well as CPUs. From a report: To that end, NVIDIA has detailed how its GPUs are affected by the speculative execution attacks and has started releasing updated drivers that tackle the issue. All its GeForce, Quadro, NVS, Tesla and GRID chips appear to be safe from Meltdown (aka variant 3 of the attacks), but are definitely susceptible to at least one version of Spectre (variant 1) and "potentially affected" by the other (variant 2). The new software mitigates the first Spectre flaw, but NVIDIA is promising future mitigations as well as eventual updates to address the second. Most of the updates are available now, although Tesla and GRID users will have to wait until late January.
The current generation of computers are going to be even slower than the last generation. Nice job all around!
If this is another thing that AMD got right while the competition got it wrong, they're really going to come out looking like the only responsible parties.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
NVIDIA GPUs do not do speculative execution. They do not have access to kernel memory. They are not susceptible to these flaws. These are patches in their drivers to account for CPU (not GPU) exploits. I.E. Intel and AMD flaws. I bet NVIDIA releases a clarification soon.
Wonder what impact this will have on cryptocurrency markets. Regardless of actual slowdown in mining, it is the perception that will probably matter...
Check your premises.
Oh noes! The bad guys will access my game textures!
#DeleteFacebook
NVIDIA’s core business is GPU computing. We believe our GPU hardware is immune to the reported security issue and are updating our GPU drivers to help mitigate the CPU security issue. As for our SoCs with ARM CPUs, we have analyzed them to determine which are affected and are preparing appropriate mitigations.
Holy shit this is bad reporting. Nowhere on the Nvidia page does it say that GPUs are actually affected by Spectre or Meltdown. It's in fact impossible since GPUs don't perform speculative execution. On top of that, GPUs don't run kernel code (so cannot leak it), don't run an OS, have a completely different architecture to begin with and so on.
So what's this announcement about? It's a driver update to mitigate Spectre/Meltdown which could potentially affect the driver's CPU code. This has also been confirmed by Nvidia many days ago.
Shameful reporting by Engadget, not that I'm surprised considering they barely qualify as "tech" reporting.
Even if the Nvidia chips are exposed, why would anyone attack a GPU that has no access to any personal information? GPU's store pixel data and other display data not personal data. I guess for myself I would be more concerned about Intel's and AMD's new chip combinations that at least implies a closer connection between the two. Not suggestion a current security threat, but certainly might be a potential target if a flaw were to exist.
These flaws having been introduced so widely and having existed for so long is a side effect of petal to the metal semiconductor advancement. I can only suspect other flaws will be found in time. If this forces an extra layer of thoughtfulness to a technology that stands as the centerpiece of modern civilization and represents (at least to me) the greatest technological realization of the modern scientific age (arguable) then things can only be that much better moving forward. Dye fabrication size is already introducing fantastic new engineering challenges. The more architectural hurdles that can be recognized the better.
I do wonder that if we eventually turn semiconductor design and other future computing technologies over to AI in what now seems likely a very near future, if at some point those tools may introduce features too subtle for us to notice or even understand in order to benefit themselves or itself alone, perhaps even ensuring their own protection. Without ever telling us, of course.
Brought to you by Carl's Junior.
GP is right. Some tech journalist made a flawed deduction and the resulting entirely false story spread virally, even to slashdot. According to their official statement, Nvidia is simply updating its GPU drivers to help mitigate the CPU security issue, a normal and expected move that will be followed by many software vendors since spectre (specifically CVE-2017-5753) actually represents a new class of security vulnerabilities - like "buffer over-read" but different.
In answer to your post, while GPUs do support branching, they don't engage in branch prediction, which makes them immune. In simple terms, superscalar CPUs process data in a "scalar" fashion, but use all kinds of tricks (like speculative execution) to perform more ops per cycle than would be possible for an equivalent scalar design (hence "super"). While superscalar designs fulfill strong market pressure for high per-thread performance, they comes at the cost of using a lot of silicon (and power). Also, one of these "superscalar tricks" just now has turned out too tricky for its own good.
In contrast, GPUs take a whole different approach in getting around the inherent bottleneck of a scalar design: they perform simple operations on a whole array worth of data at once, and can be seen as a cluster of hundreds of simplified scalar CPUs running in parallel (to give an example of "simplified": they commonly share instruction decoding logic to some extent). The advantage of this approach is that you can use silicon for actual computations that would otherwise be "wasted" on "superscalar tricks", which is why GPUs have such phenomenal computational throughput per unit of power consumption compared to CPUs. The disadvantage is that your workload needs to be optimized for this design, which isn't always possible, leave alone easy. They're great for graphic rendering, though. ;)
Anyhow, given the above, you can see that some would argue that going superscalar would defeat the whole point of a GPU living alongside a CPU in the same box...
Oh wow you're right, that's nasty (even if entirely coincidental).
These attacks seem to affect anything with speculative execution. If they affect Intel, ARM and AMD CPUs and NVidia GPUs it's not all that unlikely that they affect AMD GPUs too.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Variant One (Spectre, lamer version that no one should be afeared of.)
Bounds Check Bypass
Resolved by software / OS updates to be made available by system vendors and manufacturers. Negligible performance impact expected.
Variant Two (Spectre, legit version that can nizz your nozz.)
Branch Target Injection
Differences in AMD architecture mean there is a near zero risk of exploitation of this variant. Vulnerability to Variant 2 has not been demonstrated on AMD processors to date.
Variant Three (Meltdown, AMD is unaffected. Intel is affected for every damned thing lol. One ARM CPU - Cortex A57 - has been found to be affected by Meltdown / something so similar ARM threw it under the Meltdown umbrella / bus.)
Rogue Data Cache Load
Zero AMD vulnerability due to AMD architecture differences.
I don't mind it. I find the current moderation on creimer's post to be funny (-1, Interesting).
Is there some kind of law describing when shilling and trolling are indistinguishable?