{"id":3044,"date":"2019-04-05T01:48:50","date_gmt":"2019-04-05T01:48:50","guid":{"rendered":"http:\/\/pariswells.com\/blog\/?p=3044"},"modified":"2020-04-05T01:49:25","modified_gmt":"2020-04-05T01:49:25","slug":"spector-and-meltdown","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/spector-and-meltdown","title":{"rendered":"Spector and Meltdown"},"content":{"rendered":"<p class=\"x_MsoNormal\">Firstly, Spectre and Meltdown is a completely different class of flaws that is not the same as the traditional flaws. Hence, the industry is trying to quickly develop \u201cworkarounds\u201d to mitigate them. And as we all know, workarounds and quick fixes has their impacts, and this is what we are seeing now with all the blogs about performance issues and confusion. \u00a0This doesn\u2019t mean we don\u2019t do anything and ignore patching the flaw. We need to understand these flaws and patches, so the appropriate actions are taken.<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\">As the industry work on better solutions, new better patches will be released and we need to know about them. Hopefully, the information below will help all of us to understand more about these vulnerabilities. Also, attached are the research papers released by Google Project Zero that started all these (if you are really interested).<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\"><b>Vulnerabilities summary and current mitigation approach<\/b><\/p><p class=\"x_MsoNormal\">Spectre : CVE-2017-5753 : Variant 1 : Bounds Check Bypass<br \/>Compiler change; recompiled binaries now part of Windows Updates<\/p><p class=\"x_MsoNormal\">Edge &amp; IE11 hardened to prevent exploit from JavaScript<br \/><b>Silicon Microcode Update ALSO Required on Host :\u00a0No<\/b><br \/><br \/>Spectre : CVE-2017-5715 : Variant 2 : Branch Target Injection<br \/>Calling new CPU instructions to eliminate branch speculation in risky situations<br \/><b>Silicon Microcode Update ALSO Required on Host :\u00a0Yes<\/b><br \/><br \/>Meltdown : CVE-2017-5754 : Variant 3 : Rogue Data Cache Load<br \/>Isolate kernel and user mode page tables<br \/><b>Silicon Microcode Update ALSO Required on Host :\u00a0No<\/b><\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\"><b>The MS<\/b>\u00a0<b>Patch Confusion<\/b><\/p><p class=\"x_MsoNormal\"><a href=\"https:\/\/support.microsoft.com\/en-hk\/help\/4073119\/protect-against-speculative-execution-side-channel-vulnerabilities-in\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/support.microsoft.com\/en-hk\/help\/4073119\/protect-against-speculative-execution-side-channel-vulnerabilities-in<\/a><\/p><p class=\"x_MsoNormal\">When the patch is applied to workstations the default behaviour is to enable the mitigations for both \u201cbranch target injection\u201d and \u201crogue data cache load\u201d vulnerabilities.<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\"><a href=\"https:\/\/support.microsoft.com\/en-hk\/help\/4072698\/windows-server-guidance-to-protect-against-the-speculative-execution\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/support.microsoft.com\/en-hk\/help\/4072698\/windows-server-guidance-to-protect-against-the-speculative-execution<\/a><\/p><p class=\"x_MsoNormal\">But when applied to servers, you have to enable these settings manually.<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\">This can be verified by the powershell command provided by MS.<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p><img loading=\"lazy\" decoding=\"async\" width=\"525\" height=\"321\" class=\"alignnone size-full wp-image-3045  img-responsive\" src=\"http:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab4a149e.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab4a149e.png 525w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab4a149e-300x183.png 300w\" sizes=\"auto, (max-width: 525px) 100vw, 525px\" \/><\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\"><b>Performance Myth<\/b><\/p><p class=\"x_MsoNormal\">On my Surface, when both mitigation are enabled, it slowed down my Surface significantly (feels like having HDD again, everything lags)<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\">If you read the article in detail, you can actually override each mitigation individually or altogether.<\/p><p><img loading=\"lazy\" decoding=\"async\" width=\"849\" height=\"305\" class=\"alignnone size-full wp-image-3046  img-responsive\" src=\"http:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab5e0f13.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab5e0f13.png 849w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab5e0f13-300x108.png 300w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab5e0f13-768x276.png 768w\" sizes=\"auto, (max-width: 849px) 100vw, 849px\" \/><\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\">Setting FeatureSettingsOverride to 0x1, disable to mitigation for \u201cbranch target injection\u201d, which is the one that (in theory) impacts on performance. After doing this, my Surface is back to normal again.<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p><img loading=\"lazy\" decoding=\"async\" width=\"798\" height=\"729\" class=\"alignnone size-full wp-image-3047  img-responsive\" src=\"http:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab8cf04f.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab8cf04f.png 798w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab8cf04f-300x274.png 300w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/01\/img_5a656ab8cf04f-768x702.png 768w\" sizes=\"auto, (max-width: 798px) 100vw, 798px\" \/><\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\"><b>Take Away<\/b><\/p><ul type=\"disc\"><li class=\"x_MsoListParagraph\">So if you don\u2019t know about these registry keys and you have applied the patch to Windows servers 2008 R2 and 2012 R2, the mitigation is not in effect yet. Use the powreshell to verify that the mitigation is in place.<\/li><li class=\"x_MsoListParagraph\">Based on MS KB, performance impact applies to specific workload. Hence, do not blindly enable both mitigations on all systems. Suggestion is to, \u00a0<\/li><\/ul><ul type=\"disc\"><li style=\"list-style-type: none;\"><ol start=\"1\" type=\"1\"><li class=\"x_MsoListParagraph\">Enabled the mitigation for \u201crouge data cache load\u201d first, this should have relatively lower performance impact comparing to the \u201cbranch target injection\u201d.<\/li><li class=\"x_MsoListParagraph\">Once the above is done, go back and start applying the \u201cbranch target injection\u201d patch one system at a time and observe performance impact. Revert, if performance degradation is too great.<\/li><\/ol><\/li><\/ul><p class=\"x_MsoNormal\">\u00a0<\/p><p class=\"x_MsoNormal\"><b>Other Developments<\/b><\/p><ul type=\"disc\"><li class=\"x_MsoListParagraph\">Google is claiming to have a mitigation for \u201cBranch Target Injection\u201d that doesn\u2019t impact on performance. Intel apparently has admitted this is a better fix that what they have in development.<br \/><a href=\"https:\/\/www.itnews.com.au\/news\/google-promises-spectre-fix-that-wont-slow-pcs-481132\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/www.itnews.com.au\/news\/google-promises-spectre-fix-that-wont-slow-pcs-481132<\/a><\/li><\/ul><p class=\"x_MsoNormal\">\u00a0<\/p>","protected":false},"excerpt":{"rendered":"<p>Firstly, Spectre and Meltdown is a completely different class of flaws that is not the same as the traditional flaws. Hence, the industry is trying to quickly [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3044","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=3044"}],"version-history":[{"count":1,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3044\/revisions"}],"predecessor-version":[{"id":3048,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3044\/revisions\/3048"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=3044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=3044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=3044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}