Intel CPUs vulnerable to new LVI attacks

erek

erek

8-D
2FA
Joined
Dec 19, 2005
Messages
18,846
Tit for Tat? Sponsored security research?

"Currently, many administrators are expected to skip these patches, primarily because of the severe performance impact.

For good reasons, Intel has downplayed the severity of the LVI attack, and, for once, researchers have agreed.

"Due to the numerous complex requirements that must be satisfied to successfully carry out, Intel does not believe LVI is a practical method in real-world environments where the OS and VMM are trusted," an Intel spokesperson told ZDNet in an email last week.

"Agree with Intel," Bogdan Botezatu, Director of Threat Research and Reporting, told ZDNet yesterday. "This type of attack is much harder to pull off in practice, compared with other side-channel attacks such as MDS, L1TF, SWAPGS."

Below is a long list of resources that ZDNet readers can consult to learn more about the new LVI attacks disclosed today:"

https://www.zdnet.com/article/intel-cpus-vulnerable-to-new-lvi-attacks/
 
Mooooore security issues for Intel. What's the number up to now?

Also, in the AMD security thread people were asking about AMD funding research. The LVI research paper lists AMD as providing additional gifts (along with Intel and ARM). So, looks like AMD funds this kind of research as well.
 
Master_shake_ said:
Doesn't the mei live in the cpu? Nope PCh
Click to expand...

No.

"The Intel Management Engine (ME), also known as the Intel Manageability Engine,[1][2] is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008.[3][4][1] It is located in the Platform Controller Hub of modern Intel motherboards. It is a part of Intel Active Management Technology, which allows system administrators to perform tasks on the machine remotely.[5] "

Side point with LVI does that mean my game trainers will work better lol?
 
Damn!

Tests performed by the two research teams -- who found the LVI attack independently from one another -- have been successful at proving the attack's broad impact.

For example, the academic research team focused on leaking data (an encryption key) from an Intel SGX enclave, a secure area of Intel processors, while Bitdefender focused on proving the attack's impact on cloud environments.

"This type of attack is particularly devastating in multi-tenant environments such as enterprise workstations or servers in the data center, where one less-privileged tenant would be able to leak sensitive information from a more privileged user or from a different
virtualised environment on top of the hypervisor," Bitdefender said.
Click to expand...
 
Can't wait to see the performance benchmarks before and after this is patched - if it can be patched, that is.
Intel did a good job with their vendor-lock-in practices, because if they hadn't, no one with any brains would continue buying their CPUs or platforms.

Not that I think AMD is so holier than thou, but at least their products' security isn't veritable Swiss cheese at this point.
 
Red Falcon said:
Can't wait to see the performance benchmarks before and after this is patched - if it can be patched, that is.
Intel did a good job with their vendor-lock-in practices, because if they hadn't, no one with any brains would continue buying their CPUs or platforms.

Not that I think AMD is so holier than thou, but at least their products' security isn't veritable Swiss cheese at this point.
Click to expand...

Vendor lock-ins don’t really matter here. Even without them it would take YEARS before people switched to AMD en masse. Have to get past the whole “no one ever got fired for buying Intel” mentality in the enterprise and sever space first. Not to mention convince people outside of little circles like ours that AMDs business platforms are stable enough to be reliable.
 
Yet another Intel issue, two years ago the blue sponging was its new eventually AMD will have the same issues........still waiting. Meltdown was just the start of a complicit lack of corporate ethics and Intel's snail trail of executive leadership which started with Brian Kittensandwich.

When money is more important that quality this happens, Intel sat on their hands content with giving absolute minimum.

Toss us some of those wonky half full core half repurposed defective silicon parts on a new platform, that is innovation to the extreme
 
You must log in or register to reply here.
Back
Top