Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unexpected Page Fault In Virtualized Environment Advisory

intel.com

Post reply on HN
Print view View original

11–20 of 44 posts

Re: Unexpected Page Fault In Virtualized Environment Advisory

#11

Post by MayeulC »

vajrabum wrote: post #8
monocasa wrote: post #7

Earlier quoted context omitted.

Hence why we need open source CPUs pretty badly.

I'm pretty sure that high performance open source CPUs will have their own obscure problems. Too much complexity, too many dependencies, too many possible feature interactions.

That is undoubtedly true, but at least you will have more engineers that are able to dig into them to identify the root cause of these behaviours and fix it.

If you are badly impacted by a bug and no one else is, you are the only one with an incentive to find and fix it. You might pay the CPU manufacturer to share the incentive with them, but you'd need quite deep pockets for this.

I wouldn't be surprised if widespread open source CPUs also had better debugging tools at their disposal.

Re: Unexpected Page Fault In Virtualized Environment Advisory

#12

Post by ddtaylor »

vajrabum wrote: post #8
monocasa wrote: post #7

Earlier quoted context omitted.

Hence why we need open source CPUs pretty badly.

I'm pretty sure that high performance open source CPUs will have their own obscure problems. Too much complexity, too many dependencies, too many possible feature interactions.

At least with an open source one more than a handful of engineers at a single company could work on the problem.

Re: Unexpected Page Fault In Virtualized Environment Advisory

#13

Post by thu2111 »

ddtaylor wrote: post #12
vajrabum wrote: post #8

Earlier quoted context omitted.

I'm pretty sure that high performance open source CPUs will have their own obscure problems. Too much complexity, too many dependencies, too many possible feature interactions.

At least with an open source one more than a handful of engineers at a single company could work on the problem.

Is that actually better in this case? Intel found the issue internally. Nobody knows what it is. The advisory isn't sufficient information to figure it out. People can patch at their leisure, fairly sure that nobody is about to pop up with a 1-day exploit for it.

With an open source CPU, by now someone would have looked at the commits that fixed the Verilog/microcode, figured out what the bug is, and there'd be a convenient command line tool to get root on the hypervisor uploaded to GitHub within an hour.

This is one of those times when from a practical perspective proprietary seems to win.

Re: Unexpected Page Fault In Virtualized Environment Advisory

#14

Post by m00x »

sp332 wrote: post #10
olyjohn wrote: post #5

Earlier quoted context omitted.

I was under the impression that AMD has their own fair share of these vulnerabilities, too. They just aren't as common in the datacenter.

AMD never had one as boneheaded as Meltdown. Intel keeps having more and more uncovered, and according to researchers who went on the record in the NYT, they are not handling reported vulnerabilities quickly or thoroughly. https://www.nytimes.com/2019/11/12/technology/intel-chip-fix...

Intel is also the most used processor in the market at the moment, once that balance shifts, more attention will be paid to AMD processor so we'll potentially have more vulns uncovered.

Re: Unexpected Page Fault In Virtualized Environment Advisory

#15

Post by dmead »

sp332 wrote: post #10
olyjohn wrote: post #5

Earlier quoted context omitted.

I was under the impression that AMD has their own fair share of these vulnerabilities, too. They just aren't as common in the datacenter.

AMD never had one as boneheaded as Meltdown. Intel keeps having more and more uncovered, and according to researchers who went on the record in the NYT, they are not handling reported vulnerabilities quickly or thoroughly. https://www.nytimes.com/2019/11/12/technology/intel-chip-fix...

IIRC intel stopped doing as much validation like 10ish years ago (so, 2009/2010). it would be nice to see then publish a paper about how those decisions lead into these problems...

Re: Unexpected Page Fault In Virtualized Environment Advisory

#17

Post by bonzini »

thu2111 wrote: post #13
ddtaylor wrote: post #12

Earlier quoted context omitted.

At least with an open source one more than a handful of engineers at a single company could work on the problem.

Is that actually better in this case? Intel found the issue internally. Nobody knows what it is. The advisory isn't sufficient information to figure it out. People can patch at their leisure, fairly sure that nobody is about to pop up with a 1-day exploit for it. With an open source CPU, by now someone would have looked at the commits that fixed the Verilog/microcode, figured out what the bug is, and there'd be a con…

> This is one of those times when from a practical perspective proprietary seems to win.

I'm not sure about that, but I must say that Intel is being surprisingly candid. Similar errata have been swept under a rug and published a dozen at a time with no workarounds for years.

Re: Unexpected Page Fault In Virtualized Environment Advisory

#18

Post by cortesoft »

rossmohax wrote: post #16

Intel now runs bug bounty program with up to $100k payouts ( https://www.intel.com/content/www/us/en/security-center/bug-... ), where one of the requirements is not to leak vulnerability details.

Isn't that a pretty standard bug bounty requirement? The idea is that you submit the bug to the company and they fix it before it is disclosed.
Post reply on HN