Researchers have uncovered a fun new vulnerability in Intel processors, and this one has a claim attached that it's not possible to fix it.Sound familiar? Yeah, there's been a lot of problems over at Intel in the last couple years. We reported on some back in January and it seems it's not getting any better.
This issue, found and reported by Positive Technologies, mentions CVE-2019-0090 which as the numbered year suggests was already announced last year. However, the plot thickens. If you have an Intel chipset and/or SoC older than the 10th Generation (so anything in the last few years), you will be affected by this.
Not something you can get a firmware update or an operating system patch to help with either, since it concerns the Converged Security and Management Engine (CSME). As written by the folks over at Positive Technologies:
We will provide more technical details in a full-length white paper to be published soon. We should point out that when our specialists contacted Intel PSIRT to report the vulnerability, Intel said the company was already aware of it (CVE-2019-0090). Intel understands they cannot fix the vulnerability in the ROM of existing hardware. So they are trying to block all possible exploitation vectors. The patch for CVE-2019-0090 addresses only one potential attack vector, involving the Integrated Sensors Hub (ISH). We think there might be many ways to exploit this vulnerability in ROM. Some of them might require local access; others need physical access.
As you can see, it's not going to be the most practical for people to break into so you don't need to go and wildly panic right this second, since they would need some sort of physical and local access but it's still a damning look for Intel's processor security. To have something so severe that can only be fixed by replacing the entire hardware—ouch.
Do you currently have an Intel CPU and are you considering switching to AMD? Let us know in the comments. AMD aren't entirely secure themselves though, multiple past issues have also affected them.
Article taken from GamingOnLinux.com.
Quoting: rkfgWhy do you think AMD is more secure? Sure, their CPUs/chipsets don't have these exact Intel technologies but they have other things that might be vulnerable. Also, many of those CPU data leaks were not Intel-specific.Absence of evidence is naturally not evidence of absence but I think it's still worth considering that with the amount of negative press towards Intel due to the vulnerabilities discovered in their products, Intel would be motivated to throw money at security research into AMD CPUs to alleviate the PR pressure on them. The fact that results of such research have revealed relatively few vulnerabilities would suggest that either Intel isn't paying them enough or the architecture is more sound when it comes to modern side-channel attacks.
The AMD PSP has been revealed to have had security vulnerabilities though, although apparently those were mitigated via firmware updates rather than requiring silicon changes. It would still be nice if we didn't have these co-processors on our CPUs when we don't even use them for anything in consumer computing.
Last edited by Samsai on 6 March 2020 at 2:07 pm UTC
slaapliedje Mar 6, 2020
My next CPU will be AMD, 100%. By the time I do upgrade though, the new AMD processors will be out and I should be able to pick up an older (i.e. current now) CPU for a very decent price.
*mic drop*
I know we're seeing more and more games taking advantages of multiple cores, but for the moment the single-core perf is what I look for.
I wonder if this will result in another performance hit for linux users.
Quoting: BielFPsThis somehow makes me a little happy to still be using an old Athlon II X3 (which "transform" into a Phenon II X4 after using Asus Core Unlocker)It won't and it can't, since the flaw is in the boot ROM. The problem cannot be mitigated from the outside, therefore mitigations cannot cause performance loss. Secondly, it's a flaw in the CSME so it's unlikely the vulnerable code and a possible mitigation would be relevant to a hot code path that would cause a performance regression.
I wonder if this will result in another performance hit for linux users.
Comandante Ñoñardo Mar 6, 2020
How do I know this is not just negative paid publicity?
Patreon
PayPal
See more from me