On 10/06/19 13:16, Michael Stone wrote:
On Mon, Jun 10, 2019 at 02:01:25PM +1000, Russell Coker wrote:I just discovered the spectre-meltdown-checker package
model name : Intel(R) Core(TM)2 Quad CPU Q9505 @ 2.83GHz
Your CPU is not supported my Intel, so you either accept the risk or buy a new one.
you have another choice: disable the SMP & C. and all mitigation form Linux
(Note that the latest version of the microcode is from 2015--long before any of these speculative execution vulnerabilities were mitigated.) Yours is a yorkfield:https://www.theregister.co.uk/2018/04/04/intel_spectre_microcode_updates/
Intel(R) Core(TM)2 Quad CPU was already on sell on many site when the spectre/meltdown hardware bug was discovered and probably you can buy also now. It is a shame that intel do not give microcode update for these CPU and others.
For me, buying new CPU do not give you protection against possible hardware bug because:
* you will get only mitigation and not bug correction. Mitigation == the attack is more hard, but it can be done successfully. I don't have read any new CPU that was designed against this bug... probably because need 5-10 years have these CPU on the market
* your CPU run slower because of these mitigation (I have rad that for some task you can have 50% or less performance), also some software have been modified (== make more slower) for these bugs: compiler, browser, ... and, in theory, these mitigation in compilation can be propagate to all the software you are running (== slowing all your software)
* each CPU has a lot of undocumented instructions each of these can be a potentially new attack target. There are tools that let you find some of these, but after that understand how to use or abuse of them is an another story
* firmware also is nearly always an obscure piece of code, always bigger that the previous one and in that can be present back door (recently it has been found back doors in firmware of some cellphone sell in Germany)
* new hardware bugs and variant of previous bugs are found constantly, so we need a new CPU class designed for security. I have read that some people want to create a new CPU under free license, I think that is the only solution that we can trust
* ... Ciao Davide