New Intel CPU vulnerability

joepie91

Time to reset the "It's been __ days since the last Intel CPU vulnerability" counter!

We present CacheOut, a new speculative execution attack that is capable of leaking data from Intel CPUs across many security boundaries. We show that despite Intel's attempts to address previous generations of speculative execution attacks, CPUs are still vulnerable, allowing attackers to exploit these vulnerabilities to leak sensitive data.

Moreover, unlike previous MDS issues, we show in our work how an attacker can exploit the CPU's caching mechanisms to select what data to leak, as opposed to waiting for the data to be available. Finally, we empirically demonstrate that CacheOut can violate nearly every hardware-based security domain, leaking data from the OS kernel, co-resident virtual machines, and even SGX enclaves.

Source

Microcode updates are supposedly already available. Best update ASAP, if you're running Intel and haven't yet... you know the drill.

MikeA

sigh..

deank

Meanwhile, @intel, "We are excited to announce that we are now making mediocre gpu."

I don't think they make CPU anymore.

InceptionHosting

@clouvider Ryzen please.

MikeA

@AnthonySmith said:
@clouvider Ryzen please.

"Ryzen is a desktop processor"

InceptionHosting

@MikeA said: "Ryzen is a desktop processor"

That's going to sadly be a stance that looses customers in 2020, really tired of all this crap.

seriesn

I am just happy to be almost xeon free. At this point, even opetrone feels better.

MikeA

@seriesn said:
even opetrone feels better.

I don't know about that lol... Opterons are something...

MikeA

@AnthonySmith said:

@MikeA said: "Ryzen is a desktop processor"

That's going to sadly be a stance that looses customers in 2020, really tired of all this crap.

Yes, and I don't say the quotes to be a dick, but there's a fair market for them and it will just grow. It's why I got some of the Ryzen stuff immediately when the ASRR boards were more available (and it's the reason why OVH uses the ASRR boards for their new Ryzen line.) I've never had an issue with it, across any CPU I've ran and any common memory kits (including UDIMM.)

I really don't want OVH and Hetzner to be the only ones to do it again. I would colo more if I didn't have to deal with shipping.

deank

I knew Intel was going rapidly downhill when they decided to come up with Xeon Poo, Silver, Gold, Pee editions.

Francisco

@AnthonySmith said:
@clouvider Ryzen please.

Got our first test ryzen node up the other day. Runs like a champ.

I expect to do a full Vegas replacement inside the next 60 days.

@joepie91 anyone have benchmarks to see the performance loss?

Francisco

seriesn

@MikeA said:

@seriesn said:
even opetrone feels better.

I don't know about that lol... Opterons are something...

?

comi

@MikeA said:

@AnthonySmith said:
@clouvider Ryzen please.

"Ryzen is a desktop processor"

What about Epyc? Did it go off the ground?

deank

Server market takes a long time to penetrate. From what I am hearing, it's slowly getting there due to Intel's inability to compete.

Clouvider

@MikeA said:

@AnthonySmith said:
@clouvider Ryzen please.

"Ryzen is a desktop processor"

@AnthonySmith said:

@MikeA said: "Ryzen is a desktop processor"

That's going to sadly be a stance that looses customers in 2020, really tired of all this crap.

Epyc.

Clouvider

@comi said:

@MikeA said:

@AnthonySmith said:
@clouvider Ryzen please.

"Ryzen is a desktop processor"

What about Epyc? Did it go off the ground?

It’s more expensive.

comi

@Clouvider said:

@comi said:

@MikeA said:

@AnthonySmith said:
@clouvider Ryzen please.

"Ryzen is a desktop processor"

What about Epyc? Did it go off the ground?

It’s more expensive.

gotta milk that enterprise money

InceptionHosting

@Clouvider said: It’s more expensive.

Ryzen.

Mr_Tom

@Clouvider said: Epyc

I really fancy trying out an Epyc server but no use for one (currently).

I've got a Ryzen server but only as it's also got ECC RAM.

InceptionHosting

Ryzen is simply a better choice and ticks every box in this market segment especially and out performs/delivers over any intel server CPU in the same ballpark, I hate to say it especially as everyone knows how hard I ride the @clouvider train but sadly that train only seems to stop at intel stations now and I may need to consider another route.

1 intel bug... ok, 2 hmm, 3, are you shitting me, 4,..... FOUR!!! ... oh fuck off intel.

deank

@AntGoldFish speaks the truth.

There is absolutely no reason to use Intel CPU at the moment. Mobile segment is slightly different and I favor Intel mobile over Ryzen mobile but that's a different story.

P.S. Still replaced my Intel laptops with Ryzen ones.

comi

@AnthonySmith said:
Ryzen is simply a better choice and ticks every box in this market segment especially and out performs/delivers over any intel server CPU in the same ballpark, I hate to say it especially as everyone knows how hard I ride the @clouvider train but sadly that train only seems to stop at intel stations now and I may need to consider another route.

1 intel bug... ok, 2 hmm, 3, are you shitting me, 4,..... FOUR!!! ... oh fuck off intel.

Ryzen shows better performance, but AFAIK it is not generally more secure. This particular vulnerability affects Intel specifically, but speculative execution attack vector is present in AMD as well.

Also, are there platforms with Ryzen and IPMI?

Clouvider

It’s simply not possible to deliver what you are looking for at a reasonable price, at scale, in these DCs at these power and space costs with Ryzen. Math doesn’t add up, nor it would if you calculated colo in the same locations. I’ll start with the lack of blade chassis followed by the power consumption, but really there is so much more limitations. Show me a blade chassis with Ryzen and we will happily look into it.

Epyc is the way to go, wish more people were interested, or that AMD decided to make something between nothing and a very big server CPU, but that’s their choice and that’s why we have ordered another couple hundred of Intel CPUs to beef up the existing locations. Believe me, Il be the first one to jump to AMD after all I’ve been through with Intel as soon an actual alternative becomes available, there is none at the moment.

Clouvider

@comi said:

@AnthonySmith said:
Ryzen is simply a better choice and ticks every box in this market segment especially and out performs/delivers over any intel server CPU in the same ballpark, I hate to say it especially as everyone knows how hard I ride the @clouvider train but sadly that train only seems to stop at intel stations now and I may need to consider another route.

1 intel bug... ok, 2 hmm, 3, are you shitting me, 4,..... FOUR!!! ... oh fuck off intel.

Ryzen shows better performance, but AFAIK it is not generally more secure. This particular vulnerability affects Intel specifically, but speculative execution attack vector is present in AMD as well.

Also, are there platforms with Ryzen and IPMI?

There are some. Choice is extremely limited though and from those majority are indeed aimed at workstations - not servers, as per their very own marketing.

dahartigan

Another day, another Intel CPU hacked. AMD gets more and more premium as days go by.

The only people who would argue that Intel are the best would be those who recently purchased any quantity of Intel CPUs.

cybertech

Maybe at datacenter level the demand for Ryzen is not that much, so many can only rely on hetzner,rs,OVH etc

And some enthusiast providers like extravm who own their hardware as well

Don't know about blade but is that the answer to changing needs?

Clouvider

@cybertech said:
Maybe at datacenter level the demand for Ryzen is not that much, so many can only rely on hetzner,rs,OVH etc

And some enthusiast providers like extravm who own their hardware as well

Don't know about blade but is that the answer to changing needs?

What do you want a provider to do when there are simply no suitable platforms, for the very reason that the CPU is not designed for this use case? This is not something that can be reasonably addressed at this level.

Of course one can provide a custom “server” based on this CPU but it won’t be as functional nor as competitive as Intel platform in the enterprise setting.

Really, google and have a look what metal is available to buy, you won’t be pleased with the result.

You’re addressing your frustration with Intel to a completely wrong person.

Clouvider

@dahartigan said:
Another day, another Intel CPU hacked. AMD gets more and more premium as days go by.

The only people who would argue that Intel are the best would be those who recently purchased any quantity of Intel CPUs.

No one says no, EPYC is the answer, if you need the actual density and have a budget for that.

yoursunny

I have Cascade Lake with hyper-threading and virtualization turned off. Do I need to worry?

Intel is no longer the best. Xeon has only 48x PCI3.
EPYC has 128x PCI4, although I couldn't find a motherboard with more than four 16x PCI4 slots.

vimalware

Intel still good for single tenant virtualization workloads right or ones with just a couple of trusted tenants?

poisson

@vimalware said:
Intel still good for single tenant virtualization workloads right or ones with just a couple of trusted tenants?

Yes. Not for providing commercial VPS services, or at least I would be concerned as an informed customer on mitigation measures. However, at this point, it might be less troublesome to switch and have peace of mind for a while. There seems to be some poor technical culture on Intel's end that resembles Boeing. Pick one of the few reliable AMD providers @seriesn @Delong @MikeA and move.

MikeA

@poisson said:
@MikeA and move.

I'll be moving all of my Intel VMs to Ryzen throughout the next few months as well. Already done a little bit.

poisson

@MikeA said:

@poisson said:
@MikeA and move.

I'll be moving all of my Intel VMs to Ryzen throughout the next few months as well. Already done a little bit.

This is why y'all should consider @MikeA if you are thinking of changing your VPS from Intel to AMD. Super proactive provider.

InceptionHosting

The issue with EPYC is long contracts and poor single thread performance, there is no good config combination that works if you want to compete on price with the likes of Vultr, Do, hetzner, ovh clouds etc.

That is unless you go for an insane config like a high end EPYC with 1TB ram and about 10TB NVMe raid which no one is doing.

So I suppose the answer is to move the finance elsewhere and look at colo ryzen boxes, I will have to investigate it.

vpsgeek

From today onward I am not going to shop for shared hosting & vps from any provider using Intel until they start offering AMD

Clouvider

@AnthonySmith said:
The issue with EPYC is long contracts and poor single thread performance, there is no good config combination that works if you want to compete on price with the likes of Vultr, Do, hetzner, ovh clouds etc.

That is unless you go for an insane config like a high end EPYC with 1TB ram and about 10TB NVMe raid which no one is doing.

So I suppose the answer is to move the finance elsewhere and look at colo ryzen boxes, I will have to investigate it.

I beg to differ, biggest cloud providers run Epyc.

By all means you’re welcome to do that. This doesn’t make the platforms for Desktop CPU - Ryzen - in server chassis - any more available though, but I’ll be sure to take a careful note of this statement :-).

You’re more than welcome to find a platform that exists and has usable specs, and I’ll be more than happy to consider putting it in the offer. No one did so far. I understand the frustration with Intel, but as far as this thread is concerned I feel you’re all barking here at the wrong tree, until proven otherwise.

I don’t appreciate the attempts of Intel shaming me, you’re trying to do here. If anything this will only make me spend my time elsewhere.

And please, when actually researching, don’t come back with the asrock platforms that have single PCIe, 1G only and no NVMe as that’s more absurd to invest in than Intel.

comi

@MikeA said:

@poisson said:
@MikeA and move.

I'll be moving all of my Intel VMs to Ryzen throughout the next few months as well. Already done a little bit.

how do you deal with lack of IPMI?

Clouvider

Current options: Tyan - they have a mobo marketed for workstation but no platform, they don’t want to take any responsibility for this overheating. 1U chassis is risky, 2U will be expensive to the Customer. People who tried recommend 4U/Tower or external water cooling.

Asrock, they do in fact have a very custom chassis that houses their
Ryzen motherboard, does not support NVMe on the backplane or motherboard, and has one usable PCIe slot, so you’re loosing hard in storage.

Everything else is basically custom DIY you can do, but with how hot they like to run, they are not designed for servers, You don’t have many options available to deal with for a commercial dedicated server that needs to work well and be supported. There is a reason virtually no one is offering these as servers.

I’m more than happy to be proved otherwise, I only spent a couple of hours re-researching options and I’m pleased to find that workstation motherboard are now readily available but the server platforms are still rare and flawed.

Clouvider

@comi said:

@MikeA said:

@poisson said:
@MikeA and move.

I'll be moving all of my Intel VMs to Ryzen throughout the next few months as well. Already done a little bit.

how do you deal with lack of IPMI?

And cooling?

Francisco

IPMI is no problem, the ASROCK boards have it.

Cooling is harder but so far things have been decent.

The supermicro chassis i'm using have 3 x 15k RPM fans at the front that do help push a lot of air.

I wouldn't mind finding a 1U passive and see if that'd work better than the active.

Francisco

cybertech

@Francisco said:
IPMI is no problem, the ASROCK boards have it.

Cooling is harder but so far things have been decent.

The supermicro chassis i'm using have 3 x 15k RPM fans at the front that do help push a lot of air.

I wouldn't mind finding a 1U passive and see if that'd work better than the active.

Francisco

cybertech

clouvider network (UK) is good. dont know how these colo things work but hope ryzens end up in there one way or another.

debaser

I do understand the Ryzen hype train, but I’m still a bit weary of using them. Fact is: these are consumer grade CPU’s designed for desktops. Not for servers. This is no problem when using them for your own hobby VM or dedi, but I wouldn’t use them for production environments. EPYC on the other hand...

Companies like Hetzner, RS and OVH have a long history of providing consumer CPU’s. They probably have best practices.

Clouvider

@Francisco to confirm, you’re doing it in 2U at the moment?

vpsgeek

Anyone got some idea on how much is the impact on performance by applying microcode updates to mitigate this issue?

Clouvider

@vpsgeek said:
Anyone got some idea on how much is the impact on performance by applying microcode updates to mitigate this issue?

I don’t think they released the microcode, the one I have in hand doesn’t mention in the changelog. I’ve chased SM to see if there’s something newer I might have no access to.

Digital Ocean mentioned they are also waiting in their mailing.

Clouvider

@debaser they are also, at least Hetzner and OVH out of prime locations so cost of space is less and so they can do 2U+ chassis to accommodate this desktop without hiking the price.

dahartigan

@Clouvider said:
Intel shaming me

Now I've seen it all!

InceptionHosting

@Clouvider said: I beg to differ, biggest cloud providers run Epyc.

Hi welcome to lowend*

@Clouvider said: I don’t appreciate the attempts of Intel shaming me, you’re trying to do here. If anything this will only make me spend my time elsewhere.

You should see it as a compliment, I am desperate to give you more money above other already available options

debaser

@Clouvider said:
@debaser they are also, at least Hetzner and OVH out of prime locations so cost of space is less and so they can do 2U+ chassis to accommodate this desktop without hiking the price.

This is true as well of course. These providers don’t just own a DC but own vast complexes. That being said, I wouldn’t know if their Ryzen dedis are 1U, 2U or maybe even 4U. Maybe @Hetzner_OL or @ninzo59 will share this information (probably not, but can’t blame me for trying).

Clouvider

@dahartigan said:

@Clouvider said:
Intel shaming me

Now I've seen it all!

See, I’m coining out new phrases. When everyone uses it remind them I did it

Of course Intel is in defence now, but it’s not like AMD is an ultimate solution in this particular segment yet.