Intel Fixes Security Patch it Said Was Fixed 6 Months Ago
nytimes.com/2019/11/12/technology/intel-chip-...Posted Nov 17, 2019, 4:14 PM UTC
5933
nytimes.com
Why has this post been labelled as “misleading”?
8
Well known application like jvm use TSX as RTM locking implementation right ? Or is my understand wrong? All context about this news and comments are so confusing.
2
From the article:
Researchers often agree to disclose vulnerabilities privately to tech companies and stay quiet about them until the company can release a patch. Typically, the researchers and companies coordinate on a public announcement of the fix. But the Dutch researchers say Intel has been abusing the process.
*Another part about this is that Intel tried to bribe the researchers to make a vulnerability in a way that would make the severe vulnerability they demonstrated seem less severe than it really is.
2
Fixes
more like "now recommends performance-killing workarounds that they've been lying about for 6 months by saying they weren't needed"
1†
In the fact, rare consumer users will be affected right?
-4
Do you use TSX? I doubt it.
6
not consumers, but databases will get shafted again
10
Depends on the database. Most don't use TSX
3†
7
That's an application which uses TSX.
2
and it's an application that a lot of people (including me) use.
12
RPCS3 takes advantage of TSX instructions, so emulation fans are SOL.
4
Whats the perf loss with TSX disabled on that? And what is perf loss with the mitigation?
0
Approx 15 to 20 percent with TSX disabled.
1
RPCS3 users that got an Intel proc for TSX would like to have a word
2
It's not the same vulnerability. In fact it's basically completely different in the attack vector. The only think that's the same is the name and researchers. I get how it's hard to distinguish with the cheese grater they have become though
Think you might be confusing this article with another one. This isn't just about TSX.
And this is coming directly from the original researchers behind the side channel vulnerabilities.
Zombie v2. Zombie v1 was patched. This is claiming v2 is the same when it isn't. It works completely differently, and disabling TSX is all you need to mitigate it. If you want to leave tsx on then you need to take an additional patch with a perf hit. It works completely different than zombie v1.
That's not what this is about. From the article:
*Also, Intel tried to bribe the researchers in a way that would make the vulnerability they demonstated seem less severe.
Zombie v1 and Zomibe v2 are different bugs end of story. Bribe is some strong language and illegal. I look forward to litigation if that is true
Unfortunately for RPCS3 users the performance deficit is there when TSX instructions are not used, but now there's also a performance deficit with the mitigations on while TSX instructions are in use, so it's lose lose.