Slashdot Mirror

← Back to Stories (view on slashdot.org)

AMD Releases Spectre v2 Microcode Updates for CPUs Going Back To 2011 (bleepingcomputer.com)

Posted by msmash on from the take-note dept.

Catalin Cimpanu, writing for BleepingComputer: AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. Microsoft has released KB4093112, an update that also includes special OS-level patches for AMD users in regards to the Spectre v2 vulnerability. Similar OS-level updates have been released for Linux users earlier this year. Yesterday's microcode patches announcement is AMD keeping a promise it made to users in January, after the discovery of the Meltdown and Spectre (v1 and v2) vulnerabilities.

54 comments

  1. Doing better than Intel by QuesarVII · · Score: 4, Insightful

    Sandy bridge Intel still hasn't been patched, and that's only a few years old.

    1. Re:Doing better than Intel by darkain · · Score: 1

      Exactly this. Intel basically only pushed patches for 2 years of CPUs. The only architectures "older" that have patches are ones that still have newer CPUs being built on top of them, like the Xeon-D line.

    2. Re:Doing better than Intel by Anonymous Coward · · Score: 1, Informative

      Stop lying. Almost everything newer than Core 2 Duo is already patched on Intel side.

      https://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf

    3. Re:Doing better than Intel by Anonymous Coward · · Score: 0

      same relase as bulldozer... 2011, thats more then a few years old
      preview release in 2009.

    4. Re:Doing better than Intel by Anonymous Coward · · Score: 0

      Could you provide a public link?

    5. Re:Doing better than Intel by drinkypoo · · Score: 4, Informative

      Stop lying. Almost everything newer than Core 2 Duo is already patched on Intel side.

      Not only is that not true, but Intel has announced that it never will be true.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    6. Re:Doing better than Intel by Anonymous Coward · · Score: 0

      Did you even look at the PDF? Also which part of 'almost' you didn't understand? If you look closely you'll see that it affects all of C2D stuff and a small fraction of one generation above it. Nowhere near the claimed "Sandy Bridge is not patched lol".

    7. Re:Doing better than Intel by Anonymous Coward · · Score: 0

      Except its not - because unless I read that article you linked wrong, they are saying that CPUs that are derived from the Core2Duo era CPUs are not included - which means the above posted statement that anything newer than that is patched (or would be patched) is true.

    8. Re:Doing better than Intel by Anonymous Coward · · Score: 0

      It's everything older than 2nd gen i7 that's not supported.

    9. Re:Doing better than Intel by drinkypoo · · Score: 1

      unless I read that article you linked wrong, they are saying that CPUs that are derived from the Core2Duo era CPUs are not included - which means the above posted statement that anything newer than that is patched (or would be patched) is true.

      Uh, no. If they're derived from c2d, then by definition they're newer than c2d. Basic logic and language skills? You fail them!

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    10. Re: Doing better than Intel by Anonymous Coward · · Score: 0

      Nope, sorry. No matter how many times you bring back Alvin and the Chipmunks, even if you make them rap...it will never be new.

  2. Damn you, AMD! by DontBeAMoran · · Score: 1

    What about my 486DX-40?

    --
    #DeleteFacebook
    1. Re: Damn you, AMD! by Anonymous Coward · · Score: 3, Funny

      486 doesn't have dynamic branch prediction.

    2. Re: Damn you, AMD! by Anonymous Coward · · Score: 0

      Unfortunately my still-kicking-ass-at-4ghz-on-air Trinity quad does.

    3. Re: Damn you, AMD! by Anonymous Coward · · Score: 0

      Eh, do you provide VM services or something like that where the vulnerability has any sense?

    4. Re:Damn you, AMD! by Anonymous Coward · · Score: 0

      i see you're trying to be funny, but this is a serious topic.

      amd and intel, both, have not done enough. the pc and motherboard makers have not done enough.

      fixes must be available for all processors, motherboards and computers sold in the last 15 years, at least. and those fixes need to be happening on a faster schedule. (that's anything amd64 or k8 or later, or pentium m/core or later.. plus anything older still produced or has been in the last seven years, at any level.. e.g. for hardened or embedded applications, etc).

      motherboard and pc makers must also cooperate by producing the necessary bios updates once microcode updates are available, regardless of their own warranty or support status of the product.

      so sorry, no. your dx

    5. Re:Damn you, AMD! by Killall+-9+Bash · · Score: 1

      Yes! Both equally guilty! Keep toeing that line!

      --
      "Prediction: within 10 years, Windows will be a Linux distribution." Me, 7-6-2016
    6. Re: Damn you, AMD! by AC-x · · Score: 1

      To be fair having javascript be able to dump your kernel memory is a bit of a bummer even if you aren't running a cloud hosting service...

  3. not sure what to do lads by Anonymous Coward · · Score: -1

    im crowning rn
    but the handicapped stall is occupied and the mens room is stank anyway
    but full on turtle head
    nay, tortoise head
    not sure if i can make it home or if id bother coming back after

  4. Not feeling the love... by IApeFatCashews · · Score: -1, Informative

    My FX-8300 (eight-core) from 2011 is getting a patch but not my Phenom II 840 (quad-core) from 2010. Both are still going strong after all these years.

    1. Re:Not feeling the love... by KiloByte · · Score: 1

      but not my Phenom II 840 (quad-core) from 2010. Both are still going strong after all these years.

      This is the last non-backdoored x86 CPU available, so that's especially painful. I'm using a 6-way Phenom II myself, and it's adequate for pretty much all tasks I do: none of pieces of software I maintain is big enough, and despite me doing tons of mentoring, stuff that gets sponsored is no LibreOffice or llvm-toolchain.

      But then, for secure tasks I can use Allwinner A64 in a Pinebook -- turns out a murderous repressive communist country produces trustworthy hardware while the "land of the free" that sports that 4th Amendment does not.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    2. Re:Not feeling the love... by Anonymous Coward · · Score: 0

      Every x86 CPU since 386SL is backdoored with SMM, on AMD side too.

    3. Re:Not feeling the love... by behrooz0az · · Score: 1

      Please elaborate.

      --
      Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
    4. Re:Not feeling the love... by Anonymous Coward · · Score: 1

      It's a special processor mode that runs above everything else, including the OS and a hypervisor (if present). It's been shown to be insecure even on UEFI-based systems allowing persistent rootkits. It's also possible to use an exploit to elevate from ring-0 to SMM therefore owning the entire computer..

      https://www.blackhat.com/docs/us-15/materials/us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation-wp.pdf

      But there's a lot more examples if you just searhc for it online. Including Wikileaks materials of NSA exploits for it.

    5. Re:Not feeling the love... by TeknoHog · · Score: 1

      but not my Phenom II 840 (quad-core) from 2010. Both are still going strong after all these years.

      This is the last non-backdoored x86 CPU available, so that's especially painful.

      Which backdoor do you mean? PSP (the equivalent to Intel Management Engine) is not found on the Bulldozer family, which was being developed and sold until Ryzen came out (and it's probably still available). On the mobile and low-power market, they were quicker to change into a new architecture (Bobcat to Jaguar) so PSP appeared there around 2013.

      --
      Escher was the first MC and Giger invented the HR department.
    6. Re:Not feeling the love... by FrankSchwab · · Score: 1

      I'm also running a Phenom II in my main house machine. Works fine with the things I do with it - browsing, CD ripping, etc - but I use a much more modern processor in my work machine...

      I was going to build a new machine this winter, but the price of GPUs kinda discouraged me from that endeavour.

      --
      And the worms ate into his brain.
    7. Re:Not feeling the love... by drinkypoo · · Score: 2

      But then, for secure tasks I can use Allwinner A64 in a Pinebook -- turns out a murderous repressive communist country produces trustworthy hardware while the "land of the free" that sports that 4th Amendment does not.

      How many binary blobs do you have to run to get full functionality out of your Allwinner-based system? How much do you trust those blobs? Last I checked, kernel mainlining of the A64 had stalled, do you know better?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    8. Re:Not feeling the love... by KiloByte · · Score: 1

      Works perfectly on Pine64, for Pinebook I use anarsoul's tree; mainlining of that is waiting for dp work that was sluggish but recently gained pace. You also need patched u-boot, but patched ATF is in Debian (and lookie who's packaging that part :) ).

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    9. Re: Not feeling the love... by Brockmire · · Score: 1

      I didn't read that, but backdoored isn't the same as exploitability. So, you sound more like a tinfoiler than researcher.

    10. Re:Not feeling the love... by Anonymous Coward · · Score: 0

      WARNING!!! CREIMER IS BACK!!

      Despite the fat virgin's claims of being on YouTube, the shit moth is alive and well on Slashdot!

      MOD DOWN!!!!

    11. Re:Not feeling the love... by drinkypoo · · Score: 1

      Well, I have a Pine A64+, but I certainly don't trust it, and I won't until it's a) mainlined and b) functions completely without closed blobs. It's a cool little piece of kit, and it's fun to play with, but it's just a toy. I've had it do a few different minor tasks, and it actually seems like pretty good hardware.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    12. Re:Not feeling the love... by Anonymous Coward · · Score: 0

      Considering how often you accused other people of being creimer (last week it was datavirture), no one believes you. Buy a clue and get a fucking life.

    13. Re:Not feeling the love... by Anonymous Coward · · Score: 0

      Every AC is the same you, sugar tits?

  5. My gaming laptop thanks you by WillAffleckUW · · Score: 1

    Now to apply it to my desktops

    --
    -- Tigger warning: This post may contain tiggers! --
  6. But still not good enough by Anonymous Coward · · Score: 0

    The 2011 AMD CPUs were the first with PSP, IOW, backdoors built right in.

    intel backdoored their CPUs back in 2009, so they need to patch well before that, too.

  7. virtually impossible to exploit on Zen by edxwelch · · Score: 2

    It's worth noting AMD has said that Spectre 2 is virtually impossible to exploit on the Zen architecture. Even AMD engineers were unable to create a working exploit for it. Of coarse, they still have to release a patch for it to be on the safe side.

  8. MODDOWN! ; creimer karma whoring sock puppet post! by Anonymous Coward · · Score: -1

    MODDOWN! ; creimer karma whoring sock puppet post!

    CREIMER' SUBMISSIONS UPDATE:
    Note also that creimer is trying to regain karma by getting his submissions published as articles on /. so make sure to go to:
    https://slashdot.org/~__aaclcg...
    https://slashdot.org/~IDrinkFa...
    https://slashdot.org/~_sharp'r...
    https://slashdot.org/~crreimer
    https://slashdot.org/~cdreimer
    https://slashdot.org/~criss69
    https://slashdot.org/~Anonymou...
    https://slashdot.org/~FatCashe...
    https://slashdot.org/~ILoveFat...
    https://slashdot.org/~IHateFat...
    https://slashdot.org/~IAteFatC...
    https://slashdot.org/~ITapeFat...
    https://slashdot.org/~IApeFatC...
    https://slashdot.org/~IPrayFat...
    https://slashdot.org/~FatCashe...
    and mod down his submissions as well. The great thing is that you don't even need mod points to mod down a submission, just click on the "minus" icon!

    Yes, believe it or not, creimer owns all the above sock puppet accounts. It is a mystery why Slashdot management tolerates it!

    creimer wrote:

    I don't bother with mod points. I'm doing something much more sinister. It took ten story submissions ? I'll have to double check the number ? to move cdreimer's karma from neutral to excellent without ever being exposed to the capricious mods. Mmmmmwwwwahahahahahahaha!

    https://slashdot.org/comments....

    Danger, Will Robinson, Danger! Creimy is posting more than 2 posts a day. Hurry! mod down otherwise /. will go to hell again!

    Note: you can mod down even if already at -1 to lower karma and to prevent lost /. users to accidentally mod up.

    creimer wrote:

    All you need to do is find a website with a permissive TOS, say, Slashdot, create a Python script to scrape your own comments, sprinkle Amazon affiliate links in various posts, and then re-post past links whenever possible. Won't be long before you start making "coffee money" each month.

    https://slashdot.org/comments....

    C.D. Reimer is a renowned Slashdot collaborator, as he puts it himself; "Because of the quality of my posts and my article submissions, I'm a highly rated commentator and moderator."

    But does anybody ever wondered what "C.D." stands for? Well, it stands for Creimy Dumpty of course!

    Creimy Dumpty sat on the wall,
    Creimy Dumpty had a great fall.
    All the king's horses
    And all the king's men
    Couldn't put Creimy Dumpty
    Together again.

    Creimy's siblings video and theme song, very realistic, especially the pants, just like Creimy's:
    https://www.youtube.com/watch?...

    With "Vice President Pence Vowing US Astronauts Will Return To the Moon", we are sure they will need miracle workers up there, here is what it would look like. Note that Creimy takes care of bringing a lot of food to the moon as depicted below:
    https://www.youtube.com/watch?...

    Creimy's real pictures:
    Before the sex change:

  9. Will the motherboard manufactors react? by Anonymous Coward · · Score: 0

    I highly doubt that the motherboard makers are going to make new BIOS releases for seven year old motherboards.
    So may be we'll see updates to HP's DL385 servers etc., but most private users will stay at the status quo.

  10. Re:MODDOWN! ; creimer karma whoring sock puppet po by Anonymous Coward · · Score: 0

    Creimer left Slashdot for YouTube. You can find him there. He started posting videos from Silicon Valley Comic Con.

  11. Don't these patches cripple speed? by citylivin · · Score: 2

    Theres no way in hell i am taking a 30% performance decrease because of some theoretical memory exploit..

    I have been purposely avoiding any 2018 firmwares for just this reason!

    But it would be nice to get a confirmation of my bias as things may have changed. Even a 10% performance hit would be not worth it imho. So some rogue process can read a random part of the computers memory. I'm sure some clever person will figure out a way to exploit it, but I am not buying the hype that this is a super big deal at the current time.

    --
    As a potential lottery winner, I totally support tax cuts for the wealthy
    1. Re:Don't these patches cripple speed? by Anonymous Coward · · Score: 3, Informative

      Spectre variant 2 even when mitigated by software-only workarounds has almost no performance penalties.

      It's variant 3 (Meltdown) which is Intel-only that has from almost no (gaming) to huge (heavy I/O like Redis which gets almost halved performance) impact.

    2. Re:Don't these patches cripple speed? by Anonymous Coward · · Score: 0

      Uh, no. Spectre variant 1 can be worked around with software and has negligible performance impact. Spectre variant 2 requires hardware support, and some benchmarks suggest up to a 20% performance hit. That includes the Meltdown patch in that benchmark (which showed only a 2-3% hit alone). Other benchmarks show a performance hit of 30-60% with the Metldown patch. Ie it varies a lot on your workload. The impact could be negligible or a lot. I'd definitely like to see more benchmarks for the Spectre v2 patches.

      PS - AFAIK both Spectre v1 and v2 require that programs you don't want to leak information to be patched. So far the patches have focused on protecting the kernel. There's been little to no effort on protecting non-kernel programs. I'm not sure how practical an attack on another user's process is, though.

    3. Re:Don't these patches cripple speed? by Anonymous Coward · · Score: 0

      There are two mitigations for Spectre v2: ibrs/ibpb that require microcode support and retpolines that can be implemented by recompilation with a supported compiler. The former's performance impact depends on the CPU core used - most of Intel's are pretty bad at this since the microcode in question is a hack that works against the core's original design. The latter is almost universally faster.

      You're linking to relatively old information about the initial patches. We've been improving the mitigations focusing on the performance impact. This will take time to trickle down to user-facing systems of course.

    4. Re:Don't these patches cripple speed? by Anonymous Coward · · Score: 0

      As I understand it, one of the major issues with reptolines is that they're not put everywhere in the code but in places where there's a belief that a Spectre exploit is possible because the performance cost of putting them everywhere would be very high. Meanwhile, the ibrs/ibpb can be blanket set/cleared upon entering/exiting the kernel which should make patching pretty straight-foward and complete. Am I mistaken on this?

      I'd be curious if you'd link to some new information so I can be more informed on this. It doesn't seem like there's a clear repository for this stuff, especially to the degree on what's covered, how it's implemented and if that varies on different systems/CPUS, what the performance costs are, and what the real trade-offs are. For example, my understanding is that Linux supports using PCID so KPTI has less performance cost on older systems while Windows needs INVPCID which means you need a Haswell or later CPU or you may have a substantial performance penalty. I presume reptolines have less gotchas per CPU line as far as performance?

    5. Re:Don't these patches cripple speed? by Anonymous Coward · · Score: 0

      Doesn't matter. You might want some future update and have no option to skip past inclusions. Nor do you actually know what went into any update whatsoever. Welcome to closed source.

    6. Re:Don't these patches cripple speed? by thegarbz · · Score: 2

      No these patches cause no noticeable change in speed. What you're thinking of is the meltdown patch that requires kernel page table isolation. That causes a 5-20% hit depending on application with nearly all applications that a normal user can expect falling below the 10% mark.

      To be clear the is no patch for any of the spec exec bugs that hits 30% penalties in anything other than synthetic benchmarks on that specific worst off case on very specific subset of CPUs.

      You'll be fine, not only with this patch but the other ones too.

    7. Re:Don't these patches cripple speed? by Anonymous Coward · · Score: 0

      You're confused. It's meltdown which is the really big deal, and the mitigation, not "fix", of which carries a huge performance penalty. It's also, as far as x86 goes, a completely Intel-specific problem.

      What can actually be done with spectre is a lot less clear, and the patches so far seem to have little to no impact on performance.

  12. Re:MODDOWN! ; creimer karma whoring sock puppet po by Anonymous Coward · · Score: 0

    Jesus christ, asshole. No one cares about your creimer fixation. No one.

  13. will supermicro update there old 6XXX boards by Joe_Dragon · · Score: 1

    will supermicro update there old 6XXX boards

    1. Re:will supermicro update there old 6XXX boards by Anonymous Coward · · Score: 0

      Supermicro don't generally even update 6 month old kit.

  14. No k10 support? by Anonymous Coward · · Score: 0

    k10 was still being sold at that point, and a lot of us stuck with it due to Bulldozer's lackluster performance.

    Better than Intel is ok, but AMD only had like 3 fucking uArches during that period and they couldn't bother to at least cover all the DDR3 ones?

  15. Rock64 now. by Anonymous Coward · · Score: 0

    The RockChip model from the Pine64 guys is across the board better, including up to 4GB of LPDDR3.

    Finally a cheap SBC whose memory specs make it a 'minimal 2d desktop replacement'. It still won't do the 3d lifting for a composited desktop or gaming, but it is big enough to run a few dozen tabs in Firefox without crashing or grinding to a halt, unlike alternative boards. Or run a pretty decent sized web frontend for someone who really needs it.

    Oh also in one of these discussions somebody mentioned having trouble with SATA storage adapters and Linux: You might read up on the UAS driver and how it broke a lot of devices that worked with the usb-storage driver, but whose firmware doesn't properly support the featureset that UAS probes the device for. The Hitachi Touro series of usb drives have this problem for instance, to the point of not only not booting, but not enumerating during plug and play operations either. I have yet to find a documented approach that works (blacklisting the uas driver doesn't seem to work on fedora at least.) End result unless you stick to kernel 3.12 is a variety of usb devices may be broken, if you choose the wrong one.

  16. Older CPU by manu0601 · · Score: 2

    There is no patch for pre-2011 CPU, but are they vulnerable? If I understand correctly, Spectre stems from optimization that are present in recent CPU.

    Do we have a list of affected AMD processors?

  17. Re:MODDOWN! ; creimer karma whoring sock puppet po by Anonymous Coward · · Score: 0

    Yet here you are, you fat pest.