Intel Releases New CPU Microcode Due To New Security Vulnerabilities (June 2021)

[phoronix]

Phoronix: Intel Releases New CPU Microcode Due To New Security Vulnerabilities (June 2021)

Intel just issued a big set of CPU microcode updates for addressing a new set of security advisories just made public...

https://www.phoronix.com/scan.php?page=news_item&px=Intel-June-2021-Security

[mbrf]

I don't mean to be horrible, I'm merely curious, but is intel not very good at making their CPU's secure, or are they just much more vigilant than AMD? It seems like there's often news here about intel updating microcode, and intel vulnerabilities, and I can't recall ever having seen any such news from AMD other than updated drivers, sharing code, API's, and ideas. I might be biased, as I can tell that I'm developing a lot of respect for them and their proactiveness in developing new things and sharing them with everyone, including competitors.

[schmidtbag]

I don't mean to be horrible, I'm merely curious, but is intel not very good at making their CPU's secure, or are they just much more vigilant than AMD? It seems like there's often news here about intel updating microcode, and intel vulnerabilities, and I can't recall ever having seen any such news from AMD other than updated drivers, sharing code, API's, and ideas. I might be biased, as I can tell that I'm developing a lot of respect for them and their proactiveness in developing new things and sharing them with everyone, including competitors.

I'd say both and neither. When it comes to finding the problems, most vulnerabilities ever since Spectre and Meltdown were discovered by 3rd parties, but seems like many recent discoveries were by Intel being proactive. I figure the proactivity is because Intel is tired of being put in the spotlight. Find the problems yourself and fix them quietly, and you don't attract as much attention.
As for whether they're good at making their CPUs secure, we've gone over a decade of discovered problems. Either those vulnerabilities were deliberate (so it isn't a matter of being bad at security) or it was an oversight that only a select few people managed to discover after all this time. Now, Intel has to figure out how to secure these problems without tanking performance or overhauling the whole architecture.
From what I can tell, Hyper Threading is the culprit to much of Intel's vulnerabilities too.

[torsionbar28]

I don't mean to be horrible, I'm merely curious, but is intel not very good at making their CPU's secure, or are they just much more vigilant than AMD? It seems like there's often news here about intel updating microcode, and intel vulnerabilities, and I can't recall ever having seen any such news from AMD other than updated drivers, sharing code, API's, and ideas. I might be biased, as I can tell that I'm developing a lot of respect for them and their proactiveness in developing new things and sharing them with everyone, including competitors.

Intel took shortcuts in their design, which resulted in performance improvements at the expense of data security. It's a "sell now, fix later" mentality that allowed them to win benchmarks against AMD, with the idea that they'd fix the flaws post-sale via microcode - if they got caught. It's a shady business practice at best, but I guess it makes financial sense if you're intel and looking to score some sales wins.

[linner]

AMD has their share of vulnerabilities including in their version of Hyper Threading. Also ARM chips too. I don't have a list of articles handy but new vulnerabilities continue to be released all the time.

The whole thing is a big mess. Some of the vulnerabilities are exploitable through a web browser, (remote) sockets, can break out of virtual machines to affect the host, etc. Really, really, bad stuff. Not out of the realm of possibility to be currently used by nation actors and other well-funded adversaries in hacking.

[torsionbar28]

AMD has their share of vulnerabilities including in their version of Hyper Threading. Also ARM chips too. I don't have a list of articles handy but new vulnerabilities continue to be released all the time.

Spectre variants, yes, many different CPU architectures and vendors are affected. But the rest - Meltdown, L1tf, Itlb multihit, Mds, Srbds, TSX async abort, plus these newest ones, are all Intel-only. The fact is, there are far more known vulnerabilities in Intel's products, it's not even close. Intel products have also suffered a much larger performance loss due to all the mitigations than AMD has, as demonstrated in the benchmarks here on Phoronix and other sites.

These conclusions are not mine, they are the industry's: https://www.digitaltrends.com/comput...ssor-security/

• "The fact remains that Intel hardware is more susceptible than AMD’s, simply because there are a greater number of potential exploit paths on Intel CPUs and more of a reliance on software patches that may or may not have been implemented."
• "if you have to choose a winner in terms of security and performance, there’s no denying that AMD hardware currently has the lead."

[mbrf]

Thank you kindly for your answers, though it's kind of scary to know that my perception might not even have been as bad as reality 😅

[ms178]

regardless if its based off of something else, kinda surprising intel didn't scrutinize its architecture for security holes. after all, they had 26 years of looking at an architecture under a microscope. i can understand after 26 years a lot of holes popping up. but why not fix those holes?

I guess they are somewhat reluctant to build something from the ground up, as Itanium and P4 are still remembered as huge failures. But they need to take some risks in trying something new. I am sure Jim Keller tried his best to inject that thinking into Intel. But let's wait and see if they can come up with something or trail AMD for the next decade (as they would do too little to late, also the ARM players are eying on the desktop - Intel better should do something big or they will get less and less relevant over time, getting phased out just like IBM and other dinosaurs in the data center).

[PluMGMK]

Is everything still based on P6? Was that not just the Core 2 series? I'm genuinely asking here, I've never really understood the full story there…

[kgardas]

i'd say its more of the fact intel's architecture in use is based off the original pentium pro architecture. after the failure of netburst architecture with the pentium 4, intel went back to the p6 architecture with the core series. and since then, each new generation is still based off that p6 architecture. 26 years of crust. while others like amd built completely new architectures not based off of anything else. bulldozer and ryzen are original architectures for example.

regardless though, you can make a valid argument about intel not taking security seriously. regardless if its based off of something else, kinda surprising intel didn't scrutinize its architecture for security holes. after all, they had 26 years of looking at an architecture under a microscope. i can understand after 26 years a lot of holes popping up. but why not fix those holes?

This is complete nonsense as PPro is similar to current Rocket/Tiger Lake like for example F35 is similar to Spitfire I. Yeah, those planes do have wings! And PPro and *Lakes also translate x86/x64 ISA to internal RISC isns.

So anyway, few milestones on the road: original Core2, Nehalem, SandyBridge, Haswell, Skylake, Tiger Lake...