Intel admits a load of its CPUs have Spectre v2 flaw that can’t be fixed
Intel has issued new a new “microcode revision guidance” that confesses it won’t address the Meltdown and Spectre design flaws in all of its vulnerable processors – in some cases because it’s too tricky to remove the Spectre v2 class of vulnerabilities.
The new guidance, issued April 2, adds a “stopped” status to Intel’s “production status” category in its array of available Meltdown and Spectre security updates. “Stopped” indicates there will be no microcode patch to kill off Meltdown and Spectre.
The guidance explains that a chipset earns “stopped” status because, “after a comprehensive investigation of the microarchitectures and microcode capabilities for these products, Intel has determined to not release microcode updates for these products for one or more reasons.”
Those reasons are given as:
Thus, if a chip family falls under one of those categories – such as Intel can’t easily fix Spectre v2 in the design, or customers don’t think the hardware will be exploited – it gets a “stopped” sticker. To leverage the vulnerabilities, malware needs to be running on a system, so if the computer is totally closed off from the outside world, administrators may feel it’s not worth the hassle applying messy microcode, operating system, or application updates.
“Stopped” CPUs that won’t therefore get a fix are in the Bloomfield, Bloomfield Xeon, Clarksfield, Gulftown, Harpertown Xeon C0 and E0, Jasper Forest, Penryn/QC, SoFIA 3GR, Wolfdale, Wolfdale Xeon, Yorkfield, and Yorkfield Xeon families. The new list includes various Xeons, Core CPUs, Pentiums, Celerons, and Atoms – just about everything Intel makes.
Most the CPUs listed above are oldies that went on sale between 2007 and 2011, so it is likely few remain in normal use.
Intel has not revealed which of the “stopped” CPUs listed can’t be mitigated at all, and which Chipzilla can’t be bothered finishing patches for. We’ve asked Intel to provide that list, and will update this story if the biz replies.
Woo-yay, Meltdown CPU fixes are here. Now, Spectre flaws will haunt tech industry for years
There’s some good news in the tweaked guidance: the Arrandale, Clarkdale, Lynnfield, Nehalem, and Westmere families that were previously un-patched now have working fixes available in production, apparently.
“We’ve now completed release of microcode updates for Intel microprocessor products launched in the last 9+ years that required protection against the side-channel vulnerabilities discovered by Google Project Zero,” an Intel spokesperson told The Reg.
“However, as indicated in our latest microcode revision guidance, we will not be providing updated microcode for a select number of older platforms for several reasons, including limited ecosystem support and customer feedback.”
Now all Intel has to do is sort out a bunch of lawsuits, make sure future products don’t have similar problems, combat a revved-up-and-righteous AMD and Qualcomm in the data centre, find a way to get PC buyers interested in new kit again, and make sure it doesn’t flub emerging markets like IoT and 5G like it flubbed the billion-a-year mobile CPU market. ®
PS: Chipzilla today launched some eighth-gen Core i9 parts for laptops. These are allegedly free of Spectre and Meltdown.
Sponsored:
Minds Mastering Machines – Call for papers now open
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/04/intel_says_some_cpus_with_spectre_v2_cant_be_fixed/