> Fully removing the vulnerability requires replacing vulnerable CPU hardware.
Proof: https://webcache.googleusercontent.com/search?q=cache:rzc6iQ...
This smells really bad to me, as if Intel pressured CERT into removing language that could have caused their market value to instantly vaporize as every consumer for the last 20 years joins a class action suit...
Here's the vulnerability note stating to replace hardware on 01/04/2018 at about 1800 GMT: https://web.archive.org/web/20180104032628/https://www.kb.ce...
Then here is the same page with the replace verbiage removed on 01/04/2018 at about 1900 GMT: https://web.archive.org/web/20180104180023/https://www.kb.ce...
In any case, I doubt Intel would pressure anyone to remove the generic imperative "buy a new CPU".
[0] https://twitter.com/anders_fogh/status/948904282568392704
Imho intel would much rather them keep this language, which is why they removed it. There is no drop-in non-intel replacement for an intel CPU. Telling everyone that they need to replace CPUs is basically a mandate for them to by whatever replacement intel can cobble together. Having to replace all those chips would see intel's stock price skyrocket. The reality is that chips don't need to be replaced asap and customers have time to perhaps choose non-intel chips.
A product manufacturer with serious defects almost always ends up eating the costs of hardware repair or replacement.
Intel is 100% liable to face a lawsuit over this. Consider if a major car brake manufacturer discovered that there was a design flaw in the brakes that prevented them from functioning in certain situations. It'd be facing multiple lawsuits by now whereas Intel is going with "our chips are the most secure ever" line.
Your example with the brakes is about safety, i.e. making sure the car won't kill you during normal operation. Normally, unless their CPUs start bursting into flames, this is not a problem for Intel.
The problem here is about security. A car analogy would be that to start your car, you need a code and that code can be found by measuring how long it takes to process the input, making life easier for thieves.
As for liability, I don't think you can be liable in court if you didn't plan for something that wasn't known at the time and isn't trivial.
Engineering brakes that work reliably over months and years of use isn't trivial.
Process isolation and kernel security issues have been known for decades and have been fundamental design requirements for decades.
In both of those cases the products can cause serious harm without any third party implication. The brakes would just go of or the battery would explode during normal function.
However, in the Intel case there has to be an attacker that actively exploits an issue in design.
To me this would be like making a class action suit against all lock vendors because they can be bypassed with the right set of tools. The fact that this affects everyone (Intel more than others) and that it took 10 years to find grants them some excuse. Also the architecture is not secret as far as I know so anybody could have audited this. They most probably did do so and found nothing until now.
Now, I do not like Intel communication around this and if it comes out that they knew this for years and decided to sit on it then it would be a different story.
Class action lawsuits are useful when there is negligence, or bad intent but in this case what could it possibly solve?
Sorry, but in the 21st century world of the internet, cracking needs to be taken as a given. In many cases, "normal use" for a computing product means exposing it to use and therefore potential attack from anywhere on the internet. CPUs certainly fall into this category.
If you bought a car that was advertised as having 300 horsepower, and then the manufacturer realized it was unsafe unless they made a software change limiting the horsepower to 200, wouldn't you expect some compensation?
Example. Intel worked on rushed product to compete against AMD threadripper. That time was after the time of the known issue. Thus Intel was investing in continual bad practices and selling known bad products instead of investing in fixing the hardware flaw.
Major flaw in a car prevent selling a card until the flaw is fixed. Why shouldn't this also applying to computers that run the cars and other products?
You don't think people should be able to sue for negligence?!?
If they don't do anything after finding out vulnerabilty - probably it depends, I dont know.
But thy are clearly putting in effort with vendors to mitigate and solve the issue. Doesn't look like negligence to me.