Intel Releases New "20220809" CPU Microcode For Latest Security Vulnerability

[phoronix]

Phoronix: Intel Releases New "20220809" CPU Microcode For Latest Security Vulnerability

As part of today's "Patch Tuesday", Intel has made a new round of security vulnerabilities public -- including a new processor advisory that affects their latest Xeon Scalable and Core wares resulting in new CPU microcode being required...

https://www.phoronix.com/news/Intel-20220809-Microcode

[birdie]

A write-up on what this CPU microcode fixes: https://arstechnica.com/information-...for-sgx-users/

[andyprough]

A write-up on what this CPU microcode fixes: https://arstechnica.com/information-...for-sgx-users/

From that article:

stale data may be exposed by an attacker who controls the OS and can read from the legacy xAPIC

Is it just me, or does it seem like we're being "protected" from a lot of stuff that requires a black-hat to physically control our systems, in which case we are screwed regardless?

Or maybe I'm reading this article wrong. I'm, of course, no expert on SGX enclaves.

[jntesteves]

From that article:


Is it just me, or does it seem like we're being "protected" from a lot of stuff that requires a black-hat to physically control our systems, in which case we are screwed regardless?

Or maybe I'm reading this article wrong. I'm, of course, no expert on SGX enclaves.

SGX on your PC doesn't protect you, it protects the media industry's DRM. The black-hat in front of the computer messing with this thing would be you. You don't need this microcode update, they need it.

SGX is also a probable backdoor into your computer, it has network access and is fully independent of the OS. A computer inside a computer.

[archkde]

From that article:


Is it just me, or does it seem like we're being "protected" from a lot of stuff that requires a black-hat to physically control our systems, in which case we are screwed regardless?

Or maybe I'm reading this article wrong. I'm, of course, no expert on SGX enclaves.

Physical control is not relevant here, this is a different threat model. Normally, data in SGX enclaves is protected even against a malicious os; the present attack undermines this guarantee. If you don't use SGX (you probably don't), then this time you don't need to care at all. The microcode updata is likely not going to slow down anything for you either.

[milkylainen]

Bleh. I just updated everything. Not being constructive here unfortunately...

But I'm getting ever more frustrated by all these sidechannel holes in CPUs.
Intel might just have more holes than the actual swiss cheese.

[andyprough]

SGX on your PC doesn't protect you, it protects the media industry's DRM. The black-hat in front of the computer messing with this thing would be you. You don't need this microcode update, they need it.

SGX is also a probable backdoor into your computer, it has network access and is fully independent of the OS. A computer inside a computer.

Yeah, what you are saying does ring true. So we are being given microcode "security updates" to protect our computers from our own selves. How tragic.

[RahulSundaram]

Yeah, what you are saying does ring true. So we are being given microcode "security updates" to protect our computers from our own selves. How tragic.

This is an incomplete understanding since SGX usage isn't limited to DRM. SGX is used by a lot of security sensitive software including the Signal messenger, so vulnerabilities here can and do real world harm and should be fixed.

[archkde]

This is an incomplete understanding since SGX usage isn't limited to DRM. SGX is used by a lot of security sensitive software including the Signal messenger, so vulnerabilities here can and do real world harm and should be fixed.

Yes. To be clear here, SGX can be used for protection in scenarios where the operating system and/or computer owner is not trusted. This, as already mentioned, includes DRM and Signal, but also things like remote attestation (for corporate IT, cloud computing or similar).

[colejohnson66]

SGX on your PC doesn't protect you, it protects the media industry's DRM. The black-hat in front of the computer messing with this thing would be you. You don't need this microcode update, they need it.

SGX is also a probable backdoor into your computer, it has network access and is fully independent of the OS. A computer inside a computer.

You're thinking of Intel ME. SGX is nothing more than APIs for an enclave that can run code while knowing it's not in a VM and isn't modified. As said above, Signal uses it for encryption purposes.

Unfortunately, running trusted code of any kind on an untrusted system is very complicated and full of edge cases.