Intel Releases New CPU Microcode For Two New Security Advisories

[phoronix]

Phoronix: Intel Releases New CPU Microcode For Two New Security Advisories

It's the second Tuesday of the month and this Patch Tuesday brings new CPU microcode for mitigating the latest Intel processor security vulnerabilities and updates to some previously disclosed issues...

https://www.phoronix.com/news/Intel-November-2024-CPU-Micro

[JEBjames]

Michael

typo "Imrpoer condition checks" should be "improper"

On a technical note...Is it possible to make a secure CPU with speculative execution?

[ahrs]

On a technical note...Is it possible to make a secure CPU with speculative execution?

If you want to sacrifice performance. The whole reason CPUs speculate in the first place is because there are huge performance wins if it guesses right and does so without any side-effects, etc.

[stormcrow]

Michael

typo "Imrpoer condition checks" should be "improper"

On a technical note...Is it possible to make a secure CPU with speculative execution?

Short answer: No.

Long(er) answer: No, because it's impossible to predict future execution needs 100% correctly all the time.

Other answer: These microcode patches aren't about Spectre-style branch misprediction anyway and probably shouldn't have any big impacts on execution speed. In fact, having a faulty state machine in the CPU pretty much means if you trigger that bug, your program fails anyway

Edit to add: Regardless of speculative execution making a system insecure, this is really only a problem with systems that will be running unverifiable code, like multi tenant hosts, systems with web browsers that access the Internet at large, etc. Any system where the code being executed has a reasonably known provenance need not worry about the security problems related to speculative execution. (If you've got a supply channel attack then blocking speculative execution channels is like locking the house door after someone broke into your barn and stole your tractor.)

[Espionage724]

If you want to sacrifice performance. The whole reason CPUs speculate in the first place is because there are huge performance wins if it guesses right and does so without any side-effects, etc.

Let's say I don't like the idea of my CPU guessing anything; can I buy something without speculative exec at all? (ideally that'd work with a modern OS )

[ahrs]

Let's say I don't like the idea of my CPU guessing anything; can I buy something without speculative exec at all? (ideally that'd work with a modern OS )

I don't think you can, they all do it, even the ARM stuff has had its fair share of vulnerabilities. Maybe if you buy a dumb micro controller…

[intelfx]

Let's say I don't like the idea of my CPU guessing anything; can I buy something without speculative exec at all?

Sure. You can buy a 386 or a 486.

[Ranguvar]

Let's say I don't like the idea of my CPU guessing anything; can I buy something without speculative exec at all? (ideally that'd work with a modern OS )

Intel Atom from the Bonnell and Saltwell generations are in-order cores, sure.

ARM Cortex-A8 cores are typically in-order as well I believe.

[NotMine999]

Posting the obligatory "Intel has to open source their CPU microcode firmware before I will even consider it" statement ...

... since I haven't seen it yet in this thread.

[intelfx]

Intel Atom from the Bonnell and Saltwell generations are in-order cores, sure.

ARM Cortex-A8 cores are typically in-order as well I believe.

1. In-order does not mean not speculating.
2. All of the microarchitectures you mentioned here are, in fact, speculating.
3. Also, a given uarch cannot be "typically in-order". This makes no sense. It either is or it isn't.