Aggiornamenti firmware / microcodice Intel che rendono i processori "immuni" sia da Spectre che da Meltdown?

Intel rilascerà patch per tutti i processori che non hanno più di 5 anni. La maggior parte di questi patch verrà fornita entro la prossima settimana, il resto fino alla fine di gennaio 2018.

Hanno anche rilasciato questo pdf e questo dovrebbe rispondere a tutte le ulteriori domande riguardanti queste patch.

TL; DR:

Attenuazione per:

Limita controllo Bypass (= Spettro ): modifiche del software
Branch Target Injection (= Spectre ): modifiche al software e aggiornamento del microcode
Carico di Rogue Data Cache (= Meltdown ): per ora i sistemi operativi devono essere aggiornati, ma i processori più recenti avranno "supporto hardware" per la mitigazione.

Segue una citazione abbreviata dal whitepaper. Ho sottolineato le parti, che riguardano la tua domanda:

Bounds Check Bypass Mitigation

For the bounds check bypass method, Intel’s mitigation strategy is focused on software modifications. The software mitigation that Intel recommends is to insert a barrier to stop speculation in appropriate places. In particular, the use of an LFENCE instruction is recommended for this purpose. Serializing instructions, as well as the LFENCE instruction, will stop younger instructions from executing, even speculatively, before older instructions have retired but LFENCE is a better performance solution than other serializing instructions. An LFENCE instruction inserted after a bounds check will prevent younger operations from executing before the bound check retires. Note that the insertion of LFENCE must be done judiciously; if it is used too liberally, performance may be significantly compromised.

Intel’s analysis of the Linux kernel for example has only found a handful of places where LFENCE insertion is required, resulting in minimal performance impact.^{No comment on Windows/MacOS}

Branch Target Injection Mitigation

For the branch target injection method, two mitigation techniques have been developed. This allows a software ecosystem to select the approach that works for their security, performance and compatibility goals. The first technique introduces a new interface between the processor and system software. This interface provides mechanisms that allow system software to prevent an attacker from controlling the victim’s indirect branch predictions, such as flushing the indirect branch predictors at the appropriate time to mitigate such attacks. [...] This mitigation strategy requires both updated system software as well as a microcode update to be loaded to support the new interface for many existing processors.

The second technique introduces the concept of a “return trampoline”, also known as “retpoline”. Essentially, software replaces indirect near jump and call instructions with a code sequence that includes pushing the target of the branch in question onto the stack and then executing a Return (RET) instruction to jump to that location, as Return instructions can generally be protected using this method. This technique may perform better than the first technique for certain workloads on many current Intel processors. [...] For Intel® Core™ processors of the Broadwell generation and later, this retpoline mitigation strategy also requires a microcode update to be applied for the mitigation to be fully effective.

Rogue Data Cache Load Mitigation

For the rogue data cache load method, the operating system software may ensure that privileged pages are not mapped when executing user code in order to protect against user mode access to privileged pages.

This basic dual-page-table approach was previously proposed as a mitigation for side channel attacks on Kernel Address Space Layout Randomization (KASLR) in the “KASLR is Dead: Long Live KASLR1” paper and was called KAISER. This approach also mitigates Rogue Data Cache Load. Intel has worked with various OS vendors to enable a dual-page-table approach in their operating systems. An OS implementing this dual-page-table mitigation may wish to take advantage of the Process Context Identifier (PCID) feature on processors which support it. PCID can greatly reduce the performance cost of TLB flushes caused by frequent reloading of CR3 during user/supervisor mode transitions.

Future Intel processors will also have hardware support for mitigating Rogue Data Cache Load.

Anche il CEO di Intel, Brian Krzanich, a quanto pare ha parlato di questo durante il suo keynote del CES 2018.

link

Che cosa significa per me come utente finale?

1. La tua macchina ha un processore Intel?

   1. No? Ricevi aggiornamenti per il tuo sistema operativo / VM e il tuo browser. Cerca patch AMD o ARM. Se non ne hai neanche uno, tieni gli occhi aperti, se il tuo fornitore compare nell'elenco "è anche interessato".
   2. Sì! Ottieni le patch da fonti ufficiali. Aggiorna anche il tuo sistema operativo. Dovresti stare bene allora. Forse questo può essere fatto in un unico passaggio. Fallo appena le patch saranno disponibili, domani potrebbe apparire un nuovo WannaCry.