Linux blames Intel and AMD’s buggy hardware chips crashing the OS

Alex Gizis: Linus Torvalds is "fed up with buggy hardware and completely theoretical attacks. He is lashing out the hardware companies and turning down security patches to Linux. What's going on here, Brian?

Brian Prodoehl: So, hardware keeps adding new features to make things faster and more sophisticated, and every once in a while somebody finds a vulnerability, a way of having one process find out information from another process using, in this case, these advanced CPU features.

Typically the response is, turn that feature off. We saw that with hyper threading, the Spectre attacks, etc. The normal fix for this is once somebody finds a vulnerability, just turn it off. And so, for this latest round, he's saying no.

Alex Gizis: I have to be honest, the whole Spectre attack thing freaked me out because I read about the vulnerability, about if one process does this, then this will get slightly slower for the other process, and so you can find out what the other guy... I read that and I said that would never work. And then people put out JavaScript you could run in the browser that used it. It seemed entirely counterintuitive.

Brian Prodoehl: I think, in his latest round of attacks, he's saying that they're purely theoretical and I don't think they stay theoretical for long. I think people are really smart. They figure out how to use this stuff and so, I think probably a very short jump from kind of proof of concept, or maybe it could work this way.

Alex Gizis: So he's saying he wants the hardware vendors to fix their own stuff. Does that mean crank out new chips that don't have vulnerabilities? Because obviously that's going to take years to not help the people with existing... Or is he talking about in the Linux source code?

Brian Prodoehl: I'm not sure. So they provide microcode and they have maintainers in Linux, so I don't know, it's not quite clear to me what he means by that, but obviously the chips are out there, there may be affected hardware revisions that never have a hardware fix, and so I think at some point, they're maintaining a giant OS that's used in really important data center applications and stuff, so if there's thousands of those chips out there, it should be fixed.

Alex Gizis: But as a customer, this is upsetting stuff, because when they announce how fast the new chip is, Intel or AMD, they mean with all the new features turned on. And then as time goes on, they say, “oh, that one wasn't so secure, turn it off.”; “That one wasn't secure, tell Linux to turn it off.”; “That one wasn't secure, turn it off.” And each time computers really do get slower.

Brian Prodoehl: They do. That's how it goes. What are you going to do?

Alex Gizis: So these machines are not nearly as fast as when you bought them.

Brian Prodoehl: Right. So I think, in that case, if you are sitting at home and playing games on your gaming PC or whatever, you could turn all that stuff on. And so , I think in that way, even with Spectre, you could disable those mitigations and get back that 20%. And so I think if it's you using your thing, it's fine. If it's my bank, I'd rather they turn that off.

Alex Gizis: Yeah, let them buy a couple more computers. Yeah, the cloud now -- And the browser, I mean, it's funny, you're running all this code that other people you've never met -- that’s what Amazon is, right? Anyone can submit stuff and run it on their website. And of course, the big machines, little websites, they'll run a bunch on one machine, there's -- There is some real dangers here.

Brian Prodoehl: Yeah, so I think, know your security model and yeah, if you’re my bank, please turn off these features.

Alex Gizis: But on my gaming PC, turn it back on.

Brian Prodoehl: Exactly, yeah.

Alex Gizis: So, obviously there are a bunch of CPU companies, who's he going after here? Which company?

Brian Prodoehl: I think this latest round, he's going after Intel. Last time it was AMD, and he has a long, long burning feud with NVIDIA.

Alex Gizis: So it's all of them, right?

Brian Prodoehl: Essentially, yes.

Alex Gizis: Different bugs at different times for different companies. What about Apple? I mean, we're talking about Linux, we're talking about Intel and AMD. Does Apple have these problems?

Brian Prodoehl: So, some of these issues affected Apple as well. And obviously with their M line of ARM based chips, people just find kind of different sorts of vulnerabilities that affect their chips. And within 12 hours or so, there's a new update and they fix it, typically. But I think this line of issues that affects Intel, I don't think touches Apple at all.

Alex Gizis: And then the other thing about Apple, their model of secrecy, who knows if their kernel people are yelling at their hardware-- at their chip people. Maybe they are and we would never hear about it. And they're just an integrated front: hardware, software, chips.

Brian Prodoehl: Every once in a while they'll pay a bug bounty and say that “this fixes this CVE in whatever set of chips or something”. So sometimes Apple's clear with that stuff, but typically now it's just, “here's an important security update.” That's it.

Alex Gizis: I've gone through and clicked to see the release notes and they're just, sometimes they're “important security updates.” What about Microsoft?

Brian Prodoehl: So, an issue like this that affects Intel CPUs, I would assume that it affects Microsoft and they probably just already patched it.

Alex Gizis: Yeah, got to move quickly on these things and just push it out on a Patch Tuesday.

Brian Prodoehl: Exactly.