US-CERT Says Fixing Meltdown & Spectre Involves Replacing Your CPU

[Bot]

The United States Computer Emergency Readiness Team (US-CERT) said in an advisory published this week that addressing the Meltdown and Spectre vulnerabilities discovered in Intel, AMD, and ARM processors doesn’t necessarily come down to software patches, but to replacing the CPUs altogether.

The awkward advice posted on its official website has already been removed, but a cached version of the page (also shown in a screenshot attached to this article) still includes the reference to the recommended hardware replacement.

“The underlying vulnerability is primarily caused by CPU architecture design choices. Fully removing the vulnerability requires replacing vulnerable CPU hardware,” US-CERT said in the original advisory.

Software updates should do the job
The updated support document now only recommends to apply software updates, with a table grouping links to official patches from companies like Google, Microsoft, Apple, Mozilla, and others.

“To execute code locally, an attacker would require a valid account or independent compromise of the target. Attacks using JavaScript in web browsers are possible. Multi-user and multi-tenant systems (including virtualized and cloud environments) likely face the greatest risk. Systems use to browse arbitrary web sites are also at risk. Single-user systems that do not readily provide a way for attackers to execute code locally face significantly lower risk,” the US-CERT notes.

Read more: US-CERT Says Fixing Meltdown & Spectre Involves Replacing Your CPU

 

[ForgottenSeer 58943]

I think people will find out all of this isn't FUD and theater, but is very real and incredibly serious. The only thing I can think of that would come close to this level of severity would be disclosure of AES256 being broken/compromised.

Let's just make sure those CPU's aren't replaced by INTEL eh?

 

[plat1098]

No, it most definitely is not theatre; however, didn't the article state the part about the "necessity" of replacing your CPU was retracted?

Translation: I ain't spending one DIME on replacement CPUs. Have the lawsuits against Intel started yet?

By the way, the Powershell cmdlets suggest a persistent vulnerability to Spectre. Does anyone know anything additionally about this? Source. Lenovo isn't showing additional updates yet.

 

[bribon77]

are right. and change would have to be paid for, companies.

 

[DeepWeb]

I'm not about to buy a new damn CPU...

 

[509322]

No, it most definitely is not theatre; however, didn't the article state the part about the "necessity" of replacing your CPU was retracted?

Translation: I ain't spending one DIME on replacement CPUs. Have the lawsuits against Intel started yet?

By the way, the Powershell cmdlets suggest a persistent vulnerability to Spectre. Does anyone know anything additionally about this? Source. Lenovo isn't showing additional updates yet.

View attachment 177514

CERT probably retracted it so they weren't the object of a lawsuit by the CPU manufacturers. Or they weren't absolutely 100 % certain that their original statement was factual. Or both.

My take on it is that at this point in time nobody is really sure what they are saying until things are proven as fact. Has no one noticed the numerous revisions and re-revisions, clarifications made by multiple parties, extended and concerted efforts to make re-clarifications by various parties that have been made in the prior 48 hours ? What does that tell you ? Does anyone pay attention to these details ?

 

[soccer97]

I am not sure anyone will know the immediate answer to this. I would be hesitant to go out and purchase a brand new CPU, as it will take time to integrate these fixes into future processors by design or a complete redesign. If I am not mistaken, I did read this, as well as we may be hearing about for the next decade.

 

[DeepWeb]

I love how they removed the advice quickly probably after getting an angry call by Intel. They probably said the truth here. A true fix will involve a redesign of the architecture but Intel cannot be bothered. They just keep on putting more lipstick on their pig.