Kernel memory leak in Intel processor due to a fundamental design flaw has forced major operating system (OS) vendors such as Windows, Linux and macOS to redesign their kernel software. This redesign will result a performance hit on Intel products and is estimated to slowdown from 5% to 30%, depending on the task and the processor model. More recent Intel chips have features – such as PCID – to reduce the performance hit, The Register reports.
To perform any write, execute or network related tasks, any program needs to temporarily handover the processor control to the kernel to complete the task. Such requests between user to kernel and vice versa requires the kernel to be present in the virtual memory address space of all processes. When the kernel is needed, the program makes a system call, the processor switches to kernel mode and enters the kernel. Post completion of the requested task, the CPU is told to switch back to user mode, and reenter the process. While in user mode, the kernel’s code and data remains out of sight but present in the process’s page tables.
- Easily exploitable by malware and hackers to exploit other security bugs
- Programs and logged-in users can gain access to kernel’s memory to read all secrets including, passwords, cached disk files, login key and so on
- A shared public cloud server, may even sniff sensitive kernel-protected data
- Possible the bug could be abused to defeat KASLR: kernel address space layout randomization
- A malicious program can block executing an instruction and reads the kernel memory before switching back to the user mode. In turn allow ring-3-level user code to read ring-0-level kernel data
- Impact on cloud:
- The bug will impact big-name cloud computing environments including Amazon EC2, Microsoft Azure, and Google Compute Engine, said a software developer blogging as Python Sweetness
Another version of the same story:
There were rumors of a severe hypervisor bug – possibly in Xen – doing the rounds at the end of 2017. It may be that this hardware flaw is that rumored bug: that hypervisors can be attacked via this kernel memory access cockup, and thus need to be patched, forcing a mass restart of guest virtual machines.
Affected Intel product:
The fix is to separate the kernel’s memory completely from user processes using what’s called Kernel Page Table Isolation, or KPTI. These KPTI patches move the kernel into a completely separate address space, so it’s not just invisible to a running process, it’s not even there at all. Really, this shouldn’t be needed, but clearly there is a flaw in Intel’s silicon that allows kernel access protections to be bypassed in some way.
- PostgreSQL has shared fix for intel hardware bug which will lead to performance regressions
- Microsoft’s Azure cloud to undergo maintenance on January 10
- Amazon has warned customers via email to expect a major security update to land on Friday this week, without going into details
- Post updates from respective Vendors, your Intel-powered machine will run slower as a result