Downfall fallout lawsuit: Intel knew AVX chips were insecure and did nothing
theregister.com
theregister.com
I don't see this going anywhere.
Asking silicon manufacturers to be nimble and respin chips already in the pipeline is not realistic given the huge lead times these vendors have to change their chips.
Why do people conveniently forget even fairly recent history is beyond me.
Let's look at a random processor, like, say, the Intel Pentium G3420. A budget CPU released in December 2013 (coming up on its 10th birthday), it's a duo core CPU with a 3.2 GHz clock speed. Now I don't know what your usecase is, not many problems are nicely parallelizable, however at the scale we're talking it doesn't really matter that much. Because 3.2 billion instructions is a really big number. Now don't get me wrong, a million is also a quite sizable number; while 1 dollar won't even buy you a loaf of bread a million dollars will buy you a real fancy house, but a billion goes even beyond that. For example if you live to be 85 years old and from the moment you are born until the moment you pass away you do a thousand calculations per hour, every hour of the day, every day of every year, you will have done 750 million calculations. That's less than a quarter of what that ancient budget CPU does _per second_.
Unfortunately some people, when given access to such power, have a tendency to abuse it. And that's what leads us to things like a chat app taking 9 seconds to launch.
(Though an hardware switch would be better for these.)
The OG transient execution CPU vulnerability, Spectre, works on Intel, AMD, modern ARM-based, and IBM processors.
Hopefully yes, if it’s proven the vendor knew but released anyway or didn’t disclose.
mitigations=off
And all bugs are potentially a security issue.
* Even if we completely accepted the prosecution's dubious theory, the buyers had 5 years of decent use of the product. That's an acceptable period for warranties and a typical personal computer lifetime.
In both cases they fully knowingly sold customers inferior, dangerous products without telling what they knew. Intel deserves to get massive fines and their managers deserve criminal charges as it has happened to the car industry.
As for Intel it’s difficult to judge without knowing how complicit they were. The fact it took years to for a proof of concept of Downfall to surface lends some credibility to their choices. Moreover equating a security vulnerability to being outright defective is overeager, to say the least. If that were true then you might as well sue the vendor of any lock that has been successfully picked, cut, shimmed, or broken.
Lock manufacturers will tell you how resistant their products are to particular attacks, eg being drilled out.
I wouldn’t say Intel sold defective products if they were honest — and said that speed ups came at the cost of chip level security. But they didn’t.
Do you believe that Intel would have sold as many chips if they’d been honest — “our products are faster than before by trading your security for speed”?
Most padlocks you can buy in Home Depot can be trivially bypassed in at least one way (typically shimming, often also vulnerable to comb picking or reaching through the core); virtually all wafer locks are highly susceptible to raking and can literally be opened with a paperclip. These are akin to admin/admin credentials.
Physical security is an absolute joke most of the time compared to software security.
The trade off between risk and performance isn’t a smooth gradient in this case. Eventually conservative behavior under a certain threshold does nothing but cost performance and waste power. Therefore, the multi-billion dollar question is where that threshold is and how closely can a design toe that line. Perhaps I am wrong, but I don’t believe Intel’s management would risk a vulnerability like Downfall for better SIMD benchmarks.
Do you believe that Intel would have sold as many chips if they’d been honest — “our products are faster than before by trading your security for speed”?
Outside of the “prosumer” market, the vast majority of retail consumers do not even look at CPU benchmarks, nor could they understand them if they did. The true target of those performance numbers is the enterprise segment, a reoccurring multi-billion dollar revenue stream for Intel. With that in mind, it makes about as much sense for Intel to ignore vulnerabilities for benchmarks as it does for a milkman to sell spoiled milk.