SPECTRE and MELTDOWN: Bug rocks Intel / ARM CPUs

[Antonis000]

https://www.asus.com/News/V5urzYAT6myCC1o2

Thanks for the info.
However although Z270F Gaming ROG Strix appears to be on the list with updated BIOS version 1203 solving the problem, in the motherboard support page the most recent BIOS version (under BIOS and Firmware) is 1009 of 4/8/2017.

https://www.asus.com/gr/Motherboards...HelpDesk_BIOS/

Version 1203 is nowhere to be found.
Where is version 1203???

[A.Catalin]

We recommend customers update their systems by downloading and applying the latest BIOS, as soon as the relevant revision becomes available.

[Silent Scone@ROG]

And AMD has been very clear about these bugs: they admit both variants of Spectre in AMD CPU’s, but they say that Meltdown bug does not affect AMD CPU’s because of their architecture that is different from Intel’s.

Throwing all the complexity of the vulnerabilities in a cliché like “all companies are trying to trick us” is not very smart and helpfull.

Not sure what planet you're on, but the official statement from AMD was near zero threat. That is to say there are no known exploits at this time. It's nothing more than common sense, nobody is trying to trick anybody. You can put the pitchfork down.

[xeromist]

Thanks for post but what why is my Motherboard not on the list ( Asus Rog x99 Rampage V Extreme ) ?

These lists are subject to change and more models may get added. Regardless I would check and see if your board has an update released at the same time as other x99 boards. It's possible there is an update but you're not listed.

[xeizo]

https://www.asus.com/News/V5urzYAT6myCC1o2

Haha! That was quick, kudos to Asus for taking this seriously!

edit. now we just need a download link to the actual bios, seems the product pages hasn't been updated as of yet ...(I even checked the Taiwanese site)

[OzWizard]

Haha! That was quick, kudos to Asus for taking this seriously!

edit. now we just need a download link to the actual bios, seems the product pages hasn't been updated as of yet ...(I even checked the Taiwanese site)

Show me the link! I have Z170-A with 3504 but they show the update will be 3703. The product page does not have that BIOS yet.



I'm hurrying up and waiting.

[segfaulted]

There's a new BIOS out for the Maximus X Formula dated Jan 2. Guru3D does some benchmarks. http://www.guru3d.com/articles-pages...hmarked,1.html Substantial 4K I/O performance degradation is noticeable in CrystalDiskMark, but it's so workload specific that I am finding it hard to elicit an emotion over it. Well, so long the new cleaning staff do their job...

4k blocks are the default in just about every OS so the implications could be severe. I'm a bit confused looking at their results though. He's trying to do an AB comparison but not keeping the sort order?? Proper way to do that would have been either next to each other or even better on the same chart.

Those tests aren't really fair comparisons for this anyway. For one he's using SSD's and NVME which by design avoid CPU involvement more then a regular hard drive.

Cleaning the bus between uses would also make it more difficult for any lowlife to exploit spectre as new rubbish replaces old more frequently, right? ...or wrong?

The analogy was meant to be more high level then technical so a bit of clarity. The act of cleaning the bus, is a cache flush. What intel does is like what a kid would do to clean their room - shove some stuff under the bed and hope no one sees it. Well, people did.

It's still very different then cache observation attacks (the gas gauge), some of which are actually useful byproducts. Think if you had a block in cache and a block on disk, getting it from cache would be quicker. But unless you have complete cache coherency, you cannot know for certain where the block is. Thus things like cache snooping (in a good way), are used. Effectively asking the hardware "do you have this?". The cost of doing that obviously has to be a net gain - both performance and security - the hardware telling you is in of itself an attack for the same reason a CDN can be leveraged against a site. In multi user environments that utilize things like dedupe you can attack the other hosts around you simply by asking the hardware what is in memory. This is all very well understood.. at least it should have been.


Enough analogies though, hope this makes more sense as to the smoke coming from Intel.

[Axle Grease]

Dear.
This sofware withi fixed bat file for Intel.
https://drive.google.com/file/d/13Kb...ew?usp=sharing
Last Public blobe(201711) uCodes not enable HW mitingation.
Best Regards.

The result isn't quite what I expected.



I reinstalled KB4056892 but the MS patch remains disabled.

[ManMountain]

Security hole in AMD CPUs' hidden secure processor code

https://www.theregister.co.uk/2018/0..._cpu_psp_flaw/

Qualcomm joins Intel, Apple, Arm, AMD in confirming its CPUs suffer hack bugs.

https://www.theregister.co.uk/2018/0...lnerabilities/

[Nixon2992]

The result isn't quite what I expected.



I reinstalled KB4056892 but the MS patch remains disabled.

Dear.
Need manual activation for Spectre protection:https://support.microsoft.com/en-us/...erabilities-in
By default behavior Windows if MB uCode not support features guardian disable this on pre-boot stage loading operating system.
Best Regards.