If after about ZombieLoad you are in a panic trying to figure out how to disable Intel Hyper-Threading to prevent the use of a new vulnerability similar to Spectre and Meltdown, then take a deep breath — Intel's official guidance actually does not recommend doing this in most cases.
ZombieLoad is similar to previous attacks via 'side channels', forcing Intel processors to expose potentially confidential information that is usually isolated and only accessible to the applications using it. Security researchers previously reported that this vulnerability is present in most Intel chips and can be exploited on Windows, MacOS, and Linux.
Intel, for its part, disagrees with how serious the risk of ZombieLoad is assessed. The company even opted to give ZombieLoad a different name — Microarchitectural Data Sampling (MDS). Admittedly, this sounds much less ominous than a reference to some zombies.
"The MDS vulnerability is based on data sampling leaking from small structures in the CPU when using locally executed speculative execution side channels," the company explains. "Exploiting MDS in practice is quite a complicated affair. The vulnerability itself does not provide an attacker with a way to choose the specific data they wish to obtain."
"MDS has already been mitigated at the hardware level in many of our latest Intel Core 8th and 9th generation processors, as well as in the second generation Intel Xeon Scalable processor family," the company's statement says. "For other affected products, risk mitigation measures are available through microcode updates in conjunction with appropriate operating system and hypervisor software updates available starting today. We have provided on our website and continue to urge everyone to keep their systems up to date, as this is one of the best ways to ensure security."
Intel representatives also indicated that the ZombieLoad research group collaborated with the company and other professionals in the PC industry to address the vulnerability before it became publicly known. "We would like to express our gratitude to the researchers who worked with us and our industry partners for their contributions to the coordinated resolution of this issue."
So, what about Hyper-Threading?
Intel stated that disabling Hyper-Threading is not mandatory and not the only option for PC users. In fact, according to Intel, each customer decides what to do for themselves. If you cannot guarantee the security of your installed software, then yes, disabling Hyper-Threading may be a good idea. However, if the software is from the Microsoft Store, from your IT department, or simply installed from trusted sources in your opinion, you can probably leave Hyper-Threading enabled. It really depends on how concerned you are about your security.
"Since the factors vary significantly for different clients, Intel does not recommend disabling Hyper-Threading, as it is important to understand that this is not the only way to ensure protection against MDS and does not provide protection by itself," the company stated.
At the same time, the reactions of operating system manufacturers vary.
Google released a fix for Chrome OS that disables Hyper-Threading by default for Chromebooks. People who want to enable multi-threading technology back can do so themselves, the company believes.
Apple released an update for MacOS Mojave and stated that the company’s customers, especially those with high security needs, can disable Hyper-Threading on their own.
Microsoft stated that it has released patches for its software to reduce the risk of MDS exploitation, but also noted that clients should further obtain firmware updates from their PC manufacturers.
Given that most operating system providers have decided to keep Hyper-Threading enabled, the ZombieLoad threat is evidently not as serious as it seemed just a day ago. Moreover, there is still no known case of the vulnerability being exploited in a real attack.
However, using patches without disabling Hyper-Threading hardly reduces the performance of Intel processors.
But you won't believe it if you look at Intel's impact of security patches on performance when Hyper-Threading is disabled. The company claims that security fixes combined with disabling Hyper-Threading have a suspiciously small impact on performance.
The portal strongly disagrees with Intel's opinion that disabling Hyper-Threading is not a significant issue, even though Intel shows in its document that performance has hardly changed. The problem lies in the artificiality of Intel's tests when Hyper-Threading is turned off, as the company did not test specific multithreaded workloads. If Intel had conducted tests with Blender, Cinebench, or others designed for multicore and multithreaded processors, we would have immediately seen a significant drop in performance.
To emphasize how important Hyper-Threading technology is, one can simply look at the Intel i9-9900K priced at $500 and the i7-9700K priced at $375, whose main distinction lies precisely in support for Hyper-Threading. Disabling Hyper-Threading on Intel processors deals a tremendous blow to anyone who values multithreaded performance.
But there is good news for those using the latest Intel processors. As the company stated, many of its latest 8th and 9th generation processors already have hardware microcode fixes, so owners of the i9-9900K have no reason to disable Hyper-Threading. The danger of ZombieLoad is evidently higher for older processors. Owners of these systems will need to rely on operating system and software updates, as well as the functionality of their antivirus solutions, to reduce the risk of malware. We also remind you that there is still no known attack exploiting ZombieLoad.
Source: 3dnews.ru
