Slashdot Mirror
AMD Releases Spectre v2 Microcode Updates for CPUs Going Back To 2011 (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: AMD has released CPU microcode updates for processors affected by the Spectre variant 2 (CVE-2017-5715) vulnerability. The company has forwarded these microcode updates to PC and motherboard makers to include them in BIOS updates. Updates are available for products released as far as 2011, for the first processors of the Bulldozer line. Microsoft has released KB4093112, an update that also includes special OS-level patches for AMD users in regards to the Spectre v2 vulnerability. Similar OS-level updates have been released for Linux users earlier this year. Yesterday's microcode patches announcement is AMD keeping a promise it made to users in January, after the discovery of the Meltdown and Spectre (v1 and v2) vulnerabilities.
Sandy bridge Intel still hasn't been patched, and that's only a few years old.
What about my 486DX-40?
#DeleteFacebook
Now to apply it to my desktops
-- Tigger warning: This post may contain tiggers! --
but not my Phenom II 840 (quad-core) from 2010. Both are still going strong after all these years.
This is the last non-backdoored x86 CPU available, so that's especially painful. I'm using a 6-way Phenom II myself, and it's adequate for pretty much all tasks I do: none of pieces of software I maintain is big enough, and despite me doing tons of mentoring, stuff that gets sponsored is no LibreOffice or llvm-toolchain.
But then, for secure tasks I can use Allwinner A64 in a Pinebook -- turns out a murderous repressive communist country produces trustworthy hardware while the "land of the free" that sports that 4th Amendment does not.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Please elaborate.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
It's worth noting AMD has said that Spectre 2 is virtually impossible to exploit on the Zen architecture. Even AMD engineers were unable to create a working exploit for it. Of coarse, they still have to release a patch for it to be on the safe side.
It's a special processor mode that runs above everything else, including the OS and a hypervisor (if present). It's been shown to be insecure even on UEFI-based systems allowing persistent rootkits. It's also possible to use an exploit to elevate from ring-0 to SMM therefore owning the entire computer..
https://www.blackhat.com/docs/us-15/materials/us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation-wp.pdf
But there's a lot more examples if you just searhc for it online. Including Wikileaks materials of NSA exploits for it.
but not my Phenom II 840 (quad-core) from 2010. Both are still going strong after all these years.
This is the last non-backdoored x86 CPU available, so that's especially painful.
Which backdoor do you mean? PSP (the equivalent to Intel Management Engine) is not found on the Bulldozer family, which was being developed and sold until Ryzen came out (and it's probably still available). On the mobile and low-power market, they were quicker to change into a new architecture (Bobcat to Jaguar) so PSP appeared there around 2013.
Escher was the first MC and Giger invented the HR department.
Theres no way in hell i am taking a 30% performance decrease because of some theoretical memory exploit..
I have been purposely avoiding any 2018 firmwares for just this reason!
But it would be nice to get a confirmation of my bias as things may have changed. Even a 10% performance hit would be not worth it imho. So some rogue process can read a random part of the computers memory. I'm sure some clever person will figure out a way to exploit it, but I am not buying the hype that this is a super big deal at the current time.
As a potential lottery winner, I totally support tax cuts for the wealthy
I'm also running a Phenom II in my main house machine. Works fine with the things I do with it - browsing, CD ripping, etc - but I use a much more modern processor in my work machine...
I was going to build a new machine this winter, but the price of GPUs kinda discouraged me from that endeavour.
And the worms ate into his brain.
But then, for secure tasks I can use Allwinner A64 in a Pinebook -- turns out a murderous repressive communist country produces trustworthy hardware while the "land of the free" that sports that 4th Amendment does not.
How many binary blobs do you have to run to get full functionality out of your Allwinner-based system? How much do you trust those blobs? Last I checked, kernel mainlining of the A64 had stalled, do you know better?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Works perfectly on Pine64, for Pinebook I use anarsoul's tree; mainlining of that is waiting for dp work that was sluggish but recently gained pace. You also need patched u-boot, but patched ATF is in Debian (and lookie who's packaging that part :) ).
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
will supermicro update there old 6XXX boards
There is no patch for pre-2011 CPU, but are they vulnerable? If I understand correctly, Spectre stems from optimization that are present in recent CPU.
Do we have a list of affected AMD processors?
I didn't read that, but backdoored isn't the same as exploitability. So, you sound more like a tinfoiler than researcher.
Well, I have a Pine A64+, but I certainly don't trust it, and I won't until it's a) mainlined and b) functions completely without closed blobs. It's a cool little piece of kit, and it's fun to play with, but it's just a toy. I've had it do a few different minor tasks, and it actually seems like pretty good hardware.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"