A fairly substantial vulnerability was uncovered yesterday in Intel CPU chips and it’s going to have a huge impact going forward.
The high level issue is kernel memory leaking; Linux and Windows kernels both need a re-design. Unfortunately, both updates are going to incur significant performance hits, ranging from 5 to 30% slower.
It’s a bit early to say but following the Wannacry incident last year where everyone was told to patch and many didn’t, it would seem wise to bite the bullet and start preparing to push out the patch. It’s going to need more care than usual as there is potentially a high performance cost on some systems such as databases.
The key steps right now are to raise awareness and to check performance reports to identify any servers that may struggle resource wise with the worst case 30% impact.
There has been more information released overnight in relation to the Intel Vulnerability and this is a really bad bug especially for cloud service providers. The issue is broken down into two different related vulnerabilities, Meltdown and Spectre. These were both identified by Google’s Project Zero Team.
Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.
So what happened exactly? This vulnerability is nasty because it’s a widespread hardware bug. Updating your computer can’t make the problem disappear altogether. That’s why operating system vendors are currently redesigning some of the core functionalities of your computer as a workaround.
Intel said that it would issue its own microcode updates to address the issue, and over time some of these fixes will be rolled into hardware. Microsoft has also released an emergency patch to all devices running Windows 10, with further updates planned. There have also been rumors of a partial MacOS fix deployed with version 10.13.2, although the extent of the changes remains unclear. Google, too, issued its own report on which of its products could be affected: These include Chrome and Android phones, though the latter will depend on how quickly phone makers roll out updates.
It’s also unclear how the various patches will affect processor performance. The Register explains that a patch would likely result in anywhere between a 5 percent and a 30 percent decrease in processing speeds.
What now? You should update your computer as soon as a patch is released for your operating system. And, when it comes to your computer's speed, hope that the remedy won't be worse than the disease.