Like the other GPZ variants, Variant 4 uses speculative execution, a feature common to most modern processor architectures, to potentially expose certain kinds of data through a side channel. In this case, the researchers demonstrated Variant 4 in a language-based runtime environment. While we are not aware of a successful browser exploit, the most common use of runtimes, like JavaScript, is in web browsers.
Starting in January, most leading browser providers deployed mitigations for Variant 1 in their managed runtimes - mitigations that substantially increase the difficulty of exploiting side channels in a web browser. These mitigations are also applicable to Variant 4 and available for consumers to use today. However, to ensure we offer the option for full mitigation and to prevent this method from being used in other ways, we and our industry partners are offering an additional mitigation for Variant 4, which is a combination of microcode and software updates.
We've already delivered the microcode update for Variant 4 in beta form to OEM system manufacturers and system software vendors, and we expect it will be released into production BIOS and software updates over the coming weeks. This mitigation will be set to off-by-default, providing customers the choice of whether to enable it. We expect most industry software partners will likewise use the default-off option. In this configuration, we have observed no performance impact. If enabled, we've observed a performance impact of approximately 2 to 8 percent based on overall scores for benchmarks like SYSmark 2014 SE and SPEC integer rate on client and server test systems.
This same update also includes microcode that addresses Variant 3 (Rogue System Register Read), which was previously documented publicly by Arm in January. We have not observed any meaningful performance impact on client or server benchmarks with the Variant 3 mitigation. We've bundled these two microcode updates together to streamline the process for our industry partners and customers. This is something you will see us continue, as we recognize that a more predictable and consolidated update process will be helpful to the entire ecosystem.
We've provided more information regarding the Intel products that are potentially affected on our product security center page, along with white papers and other resources that provide guidance to help IT professionals assess the risk level in their environment. In addition, we've updated our security first web site with a list of new Frequently Asked Questions to help anyone who needs more information. As before, I continue to encourage everyone to keep their systems up-to-date, as it's one of the easiest ways to ensure you always have the latest protections.
Protecting our customers' data and ensuring the security of our products remain critical priorities for me and everyone at Intel. Research into side-channel security methods will continue and likewise, we will continue to collaborate with industry partners to provide customers the protections they need. Indeed, we are confident that we will be able to develop mitigations for Intel products for any future side-channel issues.
Reply With Quote
Bookmarks