Intel's fix for Meltdown and Spectre had a bug of its own (Broadwell / Haswell: unexpected reboots)

[LASER_oneXM]

Intel took a beating this month as reports of critical vulnerabilities in the operation of its processors going back two decades caused its stock price to go in a nosedive, and led to a massive erosion of confidence in the company's processors.

The chipmaker's troubles aren't over yet, however. Reports of a bug in the firmware updates aimed at mitigating these issues, rolled out a week ago, are now causing the company to recommend some of its bigger customers and OEM partners to delay installing the latest patches.

The bug is causing some models of the company's processors, including Broadwell and Haswell chips, to experience unexpected reboots. Despite the company's promise of greater transparency going forward, the executive vice president and general manager of Intel's Data Center Group, Navin Shenoy, only confirmed these issues after an article by the Wall Street Journal had elucidated the problems. The company was previously advising its bigger customers of the recommendation to delay installation 'quietly'.

The company is not giving the same advice to consumers, however, with Navin stating, "End-users should continue to apply updates recommended by their system and operating system providers."

An Intel partners quoted by the Wall Street Journal argued the company was doing a disservice to its customers as the public has "been given the microcode update but has not been given the important technical information that Intel recommends that you don’t use this".

 

[LASER_oneXM]

source: Intel Confirms Meltdown & Spectre Updates Bug Causing System Reboots

Intel Confirms Meltdown & Spectre Updates Bug Causing System Reboots

Broadwell and Haswell chips likely to experience bugs

Intel rolled out its own security updates to address Meltdown and Spectre vulnerabilities disclosed earlier this year, but it turns out that just like it happened with Windows and Ubuntu patches, they’re causing unexpected reboots on a number of PCs.

Intel has just confirmed that it’s indeed aware of the reports and is currently investigating, though the company doesn’t have a workaround for impacted systems just yet.

The executive vice president and general manager of Intel's Data Center Group, Navin Shenoy, explained that Broadwell and Haswell processors are affected by the bug, though no specifics were provided, other than impacted systems are pushed into an infinite reboot loop.

“We have received reports from a few customers of higher system reboots after applying firmware updates. Specifically, these systems are running Intel Broadwell and Haswell CPUs for both client and data center. We are working quickly with these customers to understand, diagnose and address this reboot issue,” he said.

No workaround just yet

While no workaround was offered to deal with the bug, the Intel official said new firmware versions could be released in the coming weeks depending on the conclusion of the company’s investigation.


“If this requires a revised firmware update from Intel, we will distribute that update through the normal channels. We are also working directly with data center customers to directly discuss the issue,” he said.


So what should customers do now given that some of the updates could lead to boot failures on their computers? Intel says that patching is still recommended, despite the risk of breaking down the system.

 

[boredog]

I see it was not only Intel's CPU's that were exploitable and the patch Intel did caused other issues. This leads me to believe people need to stop blaming all this on Intel.
The Meltdown and Spectre chip flaws — which devices are at risk, and what can you do to safeguard them? And here is what Firefox has to say about what they did to the browser for now.
Mitigations landing for new class of timing attack

 

[Deleted member 65228]

I see it was not only Intel's CPU's that were exploitable and the patch Intel did caused other issues.

All of them are exploitable but it appears that Meltdown is the one for Intel only, and the ones for the other CPUs are also for Intel. Intel took the hardest hit due to possessing the most known vulnerabilities at this moment in time.

Intel down-played the vulnerabilities, and allegedly knew about it for a long time. Their CEO sold a lot of stock for crying out loud, likely because of these vulnerabilities.

Intel will probably walk clean from all of this though - considering they are one of the most known computer hardware manufacturers - despite all the issues. Their lawyers will get them out of the mess they are in and then in 10 years time it'll happen all over again with them or another manufacturer.

 

[AtlBo]

I see it was not only Intel's CPU's that were exploitable and the patch Intel did caused other issues. This leads me to believe people need to stop blaming all this on Intel.
The Meltdown and Spectre chip flaws — which devices are at risk, and what can you do to safeguard them?

I kind of agree with this in a way at this point. Part of me is thinking, "You know, MS surely wasn't slow to jump on board developing Windows for the Intel architecture." Same with all the other architectures supported by Windows. Anyone doubt MS didn't know about this before Intel? Doesn't seem unlikely to me. That is unless Intel did work with the U.S. government to leave this back door (and MS too). Anyway, I feel that the best solution to this might actually involve changing the architecture of operating systems and changing some computer languages fundamentally.

Seems to me the issue is that application devs want to be able to sculpt the use of memory with the languages (supported by Windows, Linux o/c) giving them the ability to do so. This means access to the kernel to see "what is out there" memory-wise, etc. This would then also mean that rogue coders can use the same handles to do the same thing. So, if "sculpting" memory management for developers were restricted to set choices (through the language and through OS support for such) via prefetch based handles, then existing handles that make it possible for applications to reach this level of the kernel to sculpt would not even be necessary for application creators. Windows memory management could handle it all. Even this could be made fairly sophisticated, giving developers the flexibility for the optimization that they desire...just make sure that Windows is actually carrying out of the assignment...no need for an application to read "what is out there".

I may be misunderstanding the issue fundamentally, but this is where I am for now. MS doesn't expressly forbid access to the kernel for devs who want to optimize better than the Windows native management. I am interested in what is happening here, although working from a sophmore knowledge base, so to speak. Thanks for any angle on this topic.

From what I have read, an "exploit of Intel's architecture" wasn't an easy one to find. This provides some evidence for the notion that some work had been done previously to try to make sure this could not happen. At least this seems apparent. It also seems apparent to me, though, that Microsoft could be going further to assist with Intel's dilemma with this vulnerability, working 100% as transparently as possible to better this "take my resources" patch. So I do wonder why all the focus is on Intel. Both Microsoft and Intel should be at the front with the details...specifically what's wrong and specifically what is being done.

One last thing. With this industry there are always multiple ways to see a problem...like prisms. Each one, be it Intel's view or MS' view or Apple's view, etc. are all driven by capitalistic concerns...normal healthy concerns...until there is a breakdown. The manufacturers and parts makers obviously have a big problem here, too. Yet, I think for the first time, we see the tower of PC computing, Intel, facing a genuinely grave situation. The company really needs cooperation from MS, or Intel's problem doesn't go away.

Unfortunately, this puts MS in the position of being viewed as the problem all along. If they come up with something that really bails out Intel, public perception would likely become "this fix should have been in place in the first place" and/or "look at what MS put us all through for an OS vulnerability". That said, I think the finger should be being pointed at MS to explain why the fix for this vulnerability requires stripping PCs of their edge power-wise. Intel, too. Yet, let's not forget about the prisms of computer owners, computer users, and IT professionals and network managers. These performance hits are big and not a little thing to them. The longer this drags out, the worse for them. What we need is full transparency on this issue. We need at least the general details of what is being looked at as a better option to the current patch. Give us everything that is 100% safe to divulge. Is MS looking into the possibility that languages are to blame? Is MS looking into the idea that MS' kernel could be upgraded or improved? OK, we have the emergency patch we can use, but I feel certain these other groups are going to want an answer better than the one we have seen so far.

It's not clever to speculate about this, but I wonder if the U.S. government, Intel, and MS are giving their last gasp to try to stay on the same page about this vulnerability...to keep it in place (keep it secret?). 100% true, I don't know if there was any kind of agreement, and it's pure speculation. If so, I can certainly imagine that perhaps MS' patch preserves it somehow. Some of the responses seem to point to this to me...knowing about the vulnerability for so long with no progress toward a fix, the fix after all that time seriously reducing PC performance, and the focused propoganda for ignoring the problem from MS and Intel, especially. Hope it's something else like just pure laziness or plain failure to cooperate, but full 100% transparency is the only way for this to be turned into any kind of a moral victory.

Other than a government/Intel/MS back door alliance, the worst possible angle I can think of on this...what if MS knows a better fix but is delaying it (with or without Intel's knowledge), hoping to be able to write off Windows 7 and Windows 8.1 without having deliver a patch to those programs? Hope this isn't happening...

 

[boredog]

One reason these things are not always made public is because of national security. We all know there are a lot of nation state hackers working 24/7 to gather as
much technical and manufacturing knowledge as they can. Remember back to Kevin and Bo Clean. The government would not let him touch the kernel and so when malware became so advanced as to need to get at the kernel, they stopped using his program. Now days they use anybodies software that messes with the kernel.

 

[codswollip]

Intel dodged and weaved and blew smoke through all the initial Meltdown/Spectre communications in order to sidestep a chip recall and the class action suits that would follow. Now their firmware updates are creating havoc. Surely the "do it on the cheap" and "rush it out the door" culture that flooded the world with faulty chip designs continues to push processor computing back ten years in time.

...and this from a firm whose CEO reduced his stock holdings to the minimum required just before the Meltdown/ Spectre shockwave was made public.

Who can trust Intel?