Tweet
Link....
Core 2 Duo: Intel's insecurity blanket
Is OpenBSD founder prophet or scaremonger?
A prominent software developer with a reputation for making waves in coding circles is doing it again - this time warning that Intel's celebrated Core 2 Duo is vulnerable to security attacks that target known bugs in the processor.
Discussion forums on Slashdot and elsewhere were ablaze with comments responding to the claims made by Theo de Raadt, who is the founder of OpenBSD. Intel strongly discounted the report, saying engineers have thoroughly scanned the processor for vulnerabilities.
In it he warns that errata contained in the Intel processor is susceptible to security exploits that put users and enterprises at serious risk of being compromised. The exposure can exist even in cases where Intel has issued a fix, de Raadt said, because patches in the microcode frequently don't get installed on systems purchased from smaller vendors or that run less popular operating systems.
"At this time, I cannot recommend purchase of any machines based on the Intel Core 2 until these issues are dealt with (which I suspect will take more than a year)," de Raadt concluded in his post to an OpenBSD discussion group.
Many of the bugs lead to potentially dangerous buffer overflow in which write-protected or non-execute bits for a page table entry are ignored. Others involve floating point instruction non-coherencies or memory corruptions. Intel is aware of the security implications, but has yet to disclose them, he said in an interview.
While Intel engineers and some outside security researchers disagree with de Raadt's conclusion, the implications of them being correct are serious. Thanks to its high performance and plentiful supply, the Core 2 Duo is seemingly everywhere - in Macs, phone switches and PCs running a wide variety of operating systems.
What's more, a vulnerability in the processor could be exploited regardless of the OS it runs, and if the flaw resides in the silicon itself, the traditional remedy of pushing out a software patch could be rendered ineffective.
While something of a spiritual leader in the open source world, De Raadt is also known for stirring the pot. In 2003 his public criticism of the US-led occupation in Iraq cost OpenBSD a $2m grant from the US Defense Advanced Research Project (DARPA). Conflicts with members of the NetBSD ultimately led to his ouster from that project and earned him a reputation as someone whose directness rubbed some people the wrong way.
Of the 105 Core 2 errata Intel has published (PDF), as many as 30 have no OS work-around and are potentially exploitable, de Raadt says. For example, de Raadt says, AI39 has the potential cause one of the CPU's cores to "read garbage" if the other core executes code in a shared thread. Others simply cause a system to freeze.
In his OpenBSD post, de Raadt lists six errata - designated as AI39, AI43, AI65, AI79, AI90 and AI99 - that he says "scare the hell out of us." Many of the errata de Raadt finds worrisome are the result of significant changes the Core 2 made in the way the memory management units work in Intel CPUs.
Intel spokesman Nick Knuppfer took strong issue with de Raadt's contention that Core 2 is vulnerable. Like previous processors, the chip has been thoroughly examined by errata testers and any bug that is deemed to have an effect on performance is fixed, he said.
"I talked to the people on the errata team and they were pretty surprised by de Raadt's comments," he said. In the rare instances that a bug can't be fixed by issuing a microcode fix, Intel has volunteered to replace defective chips at no cost.
Also challenging de Raadt's conclusion was Rodney Thayer, a security researcher with Canola & Jones. While the six errata in de Raadt's post have the ability to harm the inner workings of an OS, they have little implication for security.
"Like usual, Theo's grumbling is never completely guff, but often it has a lot of noise to it," Thayer says. "I'm having a lot of trouble finding signal there."
But de Raadt said he remains concerned. He cautioned that just because Intel has issued a fix or instructions for a work-around doesn't mean they're being pushed out to Core 2 machines, particularly if they're using a less standard OS or are in an embedded device such as a phone switch.
And he also warned that the lack of stability is itself a cause for concern among the security conscious.
"Part of exploitability is being able to crash a machine reliably," he said. "We're trying to build reliable systems on an unreliable framework."
Is OpenBSD founder prophet or scaremonger?
A prominent software developer with a reputation for making waves in coding circles is doing it again - this time warning that Intel's celebrated Core 2 Duo is vulnerable to security attacks that target known bugs in the processor.
Discussion forums on Slashdot and elsewhere were ablaze with comments responding to the claims made by Theo de Raadt, who is the founder of OpenBSD. Intel strongly discounted the report, saying engineers have thoroughly scanned the processor for vulnerabilities.
In it he warns that errata contained in the Intel processor is susceptible to security exploits that put users and enterprises at serious risk of being compromised. The exposure can exist even in cases where Intel has issued a fix, de Raadt said, because patches in the microcode frequently don't get installed on systems purchased from smaller vendors or that run less popular operating systems.
"At this time, I cannot recommend purchase of any machines based on the Intel Core 2 until these issues are dealt with (which I suspect will take more than a year)," de Raadt concluded in his post to an OpenBSD discussion group.
Many of the bugs lead to potentially dangerous buffer overflow in which write-protected or non-execute bits for a page table entry are ignored. Others involve floating point instruction non-coherencies or memory corruptions. Intel is aware of the security implications, but has yet to disclose them, he said in an interview.
While Intel engineers and some outside security researchers disagree with de Raadt's conclusion, the implications of them being correct are serious. Thanks to its high performance and plentiful supply, the Core 2 Duo is seemingly everywhere - in Macs, phone switches and PCs running a wide variety of operating systems.
What's more, a vulnerability in the processor could be exploited regardless of the OS it runs, and if the flaw resides in the silicon itself, the traditional remedy of pushing out a software patch could be rendered ineffective.
While something of a spiritual leader in the open source world, De Raadt is also known for stirring the pot. In 2003 his public criticism of the US-led occupation in Iraq cost OpenBSD a $2m grant from the US Defense Advanced Research Project (DARPA). Conflicts with members of the NetBSD ultimately led to his ouster from that project and earned him a reputation as someone whose directness rubbed some people the wrong way.
Of the 105 Core 2 errata Intel has published (PDF), as many as 30 have no OS work-around and are potentially exploitable, de Raadt says. For example, de Raadt says, AI39 has the potential cause one of the CPU's cores to "read garbage" if the other core executes code in a shared thread. Others simply cause a system to freeze.
In his OpenBSD post, de Raadt lists six errata - designated as AI39, AI43, AI65, AI79, AI90 and AI99 - that he says "scare the hell out of us." Many of the errata de Raadt finds worrisome are the result of significant changes the Core 2 made in the way the memory management units work in Intel CPUs.
Intel spokesman Nick Knuppfer took strong issue with de Raadt's contention that Core 2 is vulnerable. Like previous processors, the chip has been thoroughly examined by errata testers and any bug that is deemed to have an effect on performance is fixed, he said.
"I talked to the people on the errata team and they were pretty surprised by de Raadt's comments," he said. In the rare instances that a bug can't be fixed by issuing a microcode fix, Intel has volunteered to replace defective chips at no cost.
Also challenging de Raadt's conclusion was Rodney Thayer, a security researcher with Canola & Jones. While the six errata in de Raadt's post have the ability to harm the inner workings of an OS, they have little implication for security.
"Like usual, Theo's grumbling is never completely guff, but often it has a lot of noise to it," Thayer says. "I'm having a lot of trouble finding signal there."
But de Raadt said he remains concerned. He cautioned that just because Intel has issued a fix or instructions for a work-around doesn't mean they're being pushed out to Core 2 machines, particularly if they're using a less standard OS or are in an embedded device such as a phone switch.
And he also warned that the lack of stability is itself a cause for concern among the security conscious.
"Part of exploitability is being able to crash a machine reliably," he said. "We're trying to build reliable systems on an unreliable framework."
Comment