Intel Hit With Three Class-Action Lawsuits Over Meltdown and Spectre Bugs (theguardian.com) 220
An anonymous reader quotes a report from The Guardian: Intel has been hit with at least three class-action lawsuits over the major processor vulnerabilities revealed this week. Three separate class-action lawsuits have been filed by plaintiffs in California, Oregon and Indiana seeking compensation, with more expected. All three cite the security vulnerability and Intel's delay in public disclosure from when it was first notified by researchers of the flaws in June. Intel said in a statement it "can confirm it is aware of the class actions but as these proceedings are ongoing, it would be inappropriate to comment." The plaintiffs also cite the alleged computer slowdown that will be caused by the fixes needed to address the security concerns, which Intel disputes is a major factor. "Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time," Intel said in an earlier statement.
Naturally.. (Score:5, Insightful)
This is an obvious outcome. It's worth keeping in mind that filing a suit does not vindicate or disprove anyone, as there's no way to ascertain whether there will be merit in the suit at this point. All it means is there's enough lawyers willing to make a wager when faced with such a *huge* potential payout.
Re: (Score:2)
Intel are double big time fucked and make no mistake. They were aware of the fault and continued to distribute product without informing the customer of that quite serious fault. Probably because the CIA/NSA were ruthlessly exploiting that fault for all that is was worth, now it comes time to pay the piper, Intel are fucked, globally majorly FUCKED. They are liable for every CPU sold when they were aware of that fault and did not notify the customer. The biggest worry, any hacks that can be attributed to th
Intel ME (Score:2, Interesting)
...while nobody's suing them for their Management Engine garbage. The two bugs may or may not be intentional, but the Intel Management Engine is absolutely intentional and cannot be disabled.
Of course nothing will ever come out of these lawsuits other than the lawyers getting richer.
Re: (Score:3, Funny)
Of course nothing will ever come out of these lawsuits other than the lawyers getting richer.
Shut up! We're all going to get free replacement i5s and i7s with the bug fixed! I want to believe!
Re: (Score:2)
Re: (Score:2)
Don't say that. They'll disable speculative execution completely via a microcode update if we're rude about them.
Re: (Score:2)
<quote><p>Of course nothing will ever come out of these lawsuits other than the lawyers getting richer.</p></quote>
<p>Shut up! We're all going to get free replacement i5s and i7s with the bug fixed! I want to believe!</p></quote>
Can I have some of the substance that inspired that belief? I want it!!!
Re: (Score:2)
Something is up with your formatting, dude.
Re: (Score:2)
Something is up with your formatting, dude.
Thanks for pointing that out. It was set to Extrans for one comment and not set back. Appreciate you telling me!
Re: (Score:2)
That's because their Management Engine, while anti-customer, does work as intended. Their CPUs, on the other hand...
Stop buying Intel chips. (Score:5, Interesting)
If you just look at Intel's legal history, you'll see they have been mired in accusations and convictions of unethical and anti-competitive business practices since the early 1980s. Buying from Intel has always been a devil's bargain, it's just now that you are realizing what you have done because it's directly affecting you.
Re: (Score:3)
"Power tends to corrupt and absolute power corrupts absolutely". - Lord Acton, 1887
A corporation like Intel represents a very great concentration of power. It has enormous wealth, and controls not only the working lives of all its employees but the computing abilities of all its customers, and their customers all the way downstream.
In a near-monoculture of Microsoft-on-Intel, any serious defects such as Meltdown and Spectre are inevitably inflicted on millions of individuals, corporations and governments, a
Re: (Score:2)
Intel didn't get corrupted, they started corrupted and used that corruption to get power.
Re: (Score:2)
nonsense, AMD has protection/separation issues too, as does some of the ARM.
I expect the other big player's chips will have the problem too
Re: (Score:3)
Every chip that has speculative execution has the Spectre problem. The Meltdown problem is because the Intel chips execute code that they could know is invalid rather than detecting that it's invalid before they execute it. AFAIK, nobody but Intel has that problem.
OTOH, the entire family of weaknesses means that EVERYBODY is going to need to redesign their chips. So far Spectre hasn't been shown to be usable in a way that breaks protection, but I think everyone believes it's only a matter of time.
Re: (Score:2)
no, it would be possible to have speculative execution without this problem by hardware dedicated to clearing caches. Power8 might not have this problem, have to wait for reports
Re: (Score:2)
update power7 and power8 have this problem as do the IBM Z series processors which are related. Itanium claimed not to have problem.
Re: (Score:2)
He almost got it right, and he would have gotten it right if he hadn't needed to fit it into the storyline.
All positions of power have the tendency to attract those who are more interested in the power than in doing the job those positions were (sometimes only ostensibly) created to fulfill.
And that is an oversimplified version, e.g. even those who are more interested in the job are also tempted to exercise the power for personal ends, and *that* becomes addictive.
And the ability to exercise violence withou
Re: (Score:2)
uh, more than Intel's chips have similar vulnerabilities.
Re: (Score:2)
Sure. As soon as Final Fantasy XIV can run on either of those.
Re: (Score:2)
I saw an arena of some kind where people were fighting, but really if you want PvP go play WoW on a PvP server. Or, you know, an actual first-person shooter game.
FF XIV is first and foremost a RPG game to play with friends.
This Will Go Nowhere (Score:5, Insightful)
Court: "OK, so your chip turned out to have a flaw, the company took extra time to investigate, and now your computer is slower sometimes. How is that different than the average Microsoft or Apple update?"
Intel's lawyers will delay this until the hype is forgotten, and either kill it in court or settle for some absurdly low sum, so that all of the plaintiffs get checks for $0.64 if they remember to sign up at IntelProcessorSlowdownLawsuit.com before December 31, 2019.
Re: (Score:3)
Re: (Score:2)
Well linux provides a toggle for the fix. AFAIK, windows does not.
Re: (Score:2)
It does not. It was originally claimed that the memory protection was complete. It is obviously not.
Re: (Score:2)
That's a bit different IMHO. But TBH IANAL.
Re: (Score:2)
"How is that different than the average Microsoft or Apple update?"
If the update referred to really slows down the computer's execution speed, why would that be so? It can hardly be explained as a necessary or desirable improvement, can it? If it slows down the computer in exchange for some very desirable new feature, then customers should be given the option of accepting or declining it.
If it slows down the computer in order to fix a catastrophic security weakness that should never have been there in the first place, that is unacceptable.
It's like a car manufacturer selli
Depends on what happens during discovery (Score:3)
Re:This Will Go Nowhere (Score:5, Interesting)
As I understand it, it's not the cheating, it's sloppy cheating that's the problem. If they did a privilege check like AMD claims to then speculation in a user process couldn't lead to fetching kernel data into the cache. Zeroing the unnecessarily fetched data after speculation would mean it wasn't left sitting in the cache. Intel could have done either of these things, probably with no real performance penalty but they didn't think to.
If you want a CPU that doesn't 'cheat', go get yourself a 2011 Intel Atom. They run like ass. Have fun.
Re: (Score:2, Funny)
They run like ass.
Buddy, there's a pill for that.
Re:This Will Go Nowhere (Score:5, Insightful)
It's not sloppy cheating, it's following the machine model. The way we all understood this 3 weeks ago is that speculative execution can have no visible side effects on the program-observable state of registers/memory. Now we've changed the model to extend the idea that speculative execution across privilege boundaries must also not have any observable side-channels.
This really is a change to the x86 machine model.
Re: (Score:2)
User code cannot read the content of protected kernel memory. If it does, the chip will raise the appropriate signal as defined by the ISA. Neither Spectre nor Meltdown change that. What they do is show that user code can create measurable effects on the state of the L2 cache based on the state of arbitrary memory. Those are two very different statements.
Finally, the Intel documentation is about what's guarantee by the chip -- specifically, that if speculative execution takes a 'wrong path', then the result
Re:This Will Go Nowhere (Score:5, Funny)
Well, there's always the quad-core Atom, which runs like four asses.
Re: (Score:2)
Exactly this. The "cheating" is fine as long as the ultimate machine state is truly indistinguishable from what it would be without cheating from the viewpoint of the executing code. Meltdown is a case where that does not hold true, and even worse, can be forced reliably.
Re:This Will Go Nowhere (Score:5, Interesting)
The current approach is to do any bounds checking *after* the speculative execution in the event that the branch is to be executed, which is what enables the kernel memory to be leaked to userspace programmes. The secure way of doing it would be to do the bounds checking *during* the speculative execution, just as you would with normal execution, and in the event of a page fault fall back to the non-speculative execution approach. That would still be slightly slower, but not as bad as forcing the non-speculative execution approach every time, which is what the patches have now enforced.
It's a deliberate design decision, they should have known what the risks were, and there are a growing number of real world instances of applications showing repeatable ~30% performance hits directly attributable to the "fixes" (I've seen one myself firsthand that resulting in a public transport time tabling system failing). It might not work out so lucrative for an individual John Q. Public in a class action lawsuit, but it's starting to look quite likely that Intel is going to get reamed in the courts over this if they can't come up with a better workaround P.D.Q.
Re:This Will Go Nowhere (Score:5, Informative)
They did do bounds tests. That generates exceptions, but a thread or process can catch those exceptions and ignore them, Because the CPU is pipelined, and different instruction sub-tasks take different amounts of time, it's more efficient to assume reads will be successful and to start those sub-tasks that take the longest time first. A memory fetch from off-CPU memory chips takes way longer than a bounds check. So it's better off sending out the request to load that memory location into cache on the chance that it will be a valid address, then do the bounds test to generate an exception, then roll back the speculative state if an error occurs. But the state of the cache wasn't rolled back. So some data values were evicted to make way for the new data. Those could be read back.
Re: (Score:2)
Thank you for the more thoughtful analysis. This wasn't a subtlety that would be apparent to an analyst focused on a particular task: it took a broader view of the flow of data, one that would not show up for a developer or tester focused on one specific task or feature. It's part of a class of flaws that can occur when developers and designers focus on one very particular task without being encouraged, or permitted, to examine related behavior.
It's also a firm reminder of various principles. One is that se
Re: (Score:2)
Re: This Will Go Nowhere (Score:2)
Even with the privilege check they would still be susceptible to Spectre, so what in your opinion should they have known and done for that? There is an industry wide debate still by the way as to how to solve that. "They should have known" is such a Monday night quarterback thing to say. Cache timing attack is very close to a side channel attack, and sadly those are a cat and mouse game, as more clever people find side channel attacks those and closed and then new one get found - lather, rinse, repeat...
Re: (Score:2)
The current approach is to do any bounds checking *after* the speculative execution in the event that the branch is to be executed, which is what enables the kernel memory to be leaked to userspace programmes. The secure way of doing it would be to do the bounds checking *during* the speculative execution, just as you would with normal execution, and in the event of a page fault fall back to the non-speculative execution approach. That would still be slightly slower, but not as bad as forcing the non-speculative execution approach every time, which is what the patches have now enforced.
Since visible faults must be generated at instruction retirement, the option is not to check at the start of speculation or at retirement but to check at retirement or at both. So checking during speculation is extra work that Intel elected not to perform but as it ends up, doing so is very important to prevent side channel attacks.
Re: (Score:2)
Funny how cheating... always comes back to bite you in the ass.
Only in this case it hasn't bitten Intel in the ass. It's bitten Intel's loyal customers in the ass... hard. And they are being told to shut up and bite on it.
Bloody idiots (Score:5, Insightful)
Re:Bloody idiots (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Potentially Intel were aware of the situation through the side-effects of the actions of the various national intelligence agencies but were prohibited from saying anything or
Re: (Score:2)
Weelllll..... I don't think it's that simple going forwards. Meltdown can be ameliorated by OS patches, but it can't be fixed. Spectre, though, that's a different beast. All the systems that do speculative execution are vulnerable to Spectre. So the basic underlying design needs to be addressed.
My favorite choice would be to go for a bunch of simpler processors that didn't do hyperthreading, but using less die space so you could get more CPUs on each die, but I'm sure not expert in the field. Actually,
Re: (Score:2)
All the systems that do speculative execution are vulnerable to Spectre. So the basic underlying design needs to be addressed.
I think it's not the speculative execution. It's the fact that speculative execution made it possible to have detectable side effects. For example, if you stopped the processor clock when mis-prediction costs time, that could fix the problem or at least part of it. (So even though it takes more time in the real world, that wouldn't be detectable by any code running).
Re:Bloody idiots (Score:4, Insightful)
What makes you think Intel knew that a year ago?
All Intel CPUs with speculative execution are affected by Meltdown, and all CPUs with speculative execution, including those by AMD and ARM are vulnerable to Spectre. Intel discovering that a year before Google would be a coincidence. It is not just a bug, it is a fundamental issue in the way all modern CPUs are designed.
Re: (Score:2)
All Intel CPUs with speculative execution are affected by Meltdown, and all CPUs with speculative execution, including those by AMD and ARM are vulnerable to Spectre. Intel discovering that a year before Google would be a coincidence. It is not just a bug, it is a fundamental issue in the way all modern CPUs are designed.
So why were AMD's CPUs designed in such a way as to be immune to Meltdown? Did they notice this problem years ago?
Re: (Score:2)
Intel has been aware for quite a long time, a year or more probably.
That just doesn't ring true to me. Intel's last round of processors it released in October were vulnerable. Had they known for a year or more, that would have been plenty of time to roll out a permanent fix in those models before shipment, and they certainly could have done that silently, without breaking the embargo. If you're saying they continued to roll out new flawed chips they had time to fix before release, that's a level of conspiracy theory that's hard to buy into without some concrete evidence.
Re: (Score:2)
I don't think you understand just how much of a redesign is needed. And Intel had no reason to believe that others would know until Google told them. So that's not evidence as to when Intel learned about it...at least it doesn't pin things down very strongly. I'll grant that if they'd known about it back wen they were designing the latest round of chips they would have altered the design, but after the masks were cut and the factories readied for manufacture....that's a lot of sunk cost to just write off
Re: (Score:2)
Of course companies have done massively stupid coverups of flawed designs, or even deliberately engineered them (I'm looking at you, Volkswagen). But that's not the default, or anywhere close. We don't know yet which bucket this one falls in, but Occam's Razor counsels for incompetence over maliciousness until the evidence says otherwise.
Re: (Score:2)
Yeah, I'm pretty mad (Score:2)
Re: (Score:2)
Um, that makes the class action not make sense. According to your reasoning, the threat of a class action caused the very behavior (Intel not informing vendors) the class action is purportedly trying to discourage.
Anyhow, more than
Re: (Score:3)
Class action lawsuits are about lawyers getting paid. In order for lawyers to get paid more, they have to say Intel did the wrong thing. Therefore, Intel did the wrong thing, regardless. If they waited, it's wrong. If they didn't wait, it's wrong. If they both waited and didn't wait, it's doubly wrong. Because money for lawyers.
Computer? (Score:2)
And what about servers?
Computers are undecidable (Score:2)
Computers have sense because they are general usage (i.e. universal) machines.
Then, it is possible to do many things with them, even more than the original designers visualized. This is why we have Windows, Linux, MacOS, Virtualization and many embedded applications using exactly the same chips, making the effort to create complex solutions extremely cheap and in timely fasion.
But this means that the undecidable nature of what can be done with the computer brain, the CPU, tends to create some undesire
Suits may be dismissed (Score:5, Insightful)
Since there are zero cases where the flaw has been exploited to cause any problems, no one has suffered any economic harm. You need to have been harmed in some way to have standing to sue.
And Intel will also argue that they never promised any different chip behavior. They are not issuing any errata. The chips work correctly as designers intended, just like other vendors’ chips.
I expect at least a couple of these lawsuits to be thrown out by judges. Maybe all of them will be dismissed.
Re: (Score:2)
If you really get a 5%-30% decrease in performance, it wouldn't be crazy for users to expect some kind of compensation for this. I got a shiny new 8700 processor on black friday and definitely don't want the performance decline for my offline gaming rig.
Give me a way to turn the new security features off, or give me a 5%-30% refund.
Re: (Score:2)
If you really get a 5%-30% decrease in performance, it wouldn't be crazy for users to expect some kind of compensation for this.
How can a court let the lawsuits go forward without evidence that it's 1% or 30%? If these lawsuits were about just compensation rather than about lawyers getting paychecks, you'd already know whether you were harmed and by how much.
Give me a way to turn the new security features off, or give me a 5%-30% refund.
No one is forcing you to download the fixes.
Re: (Score:2)
If plaintiffs don’t have any claim they were harmed, the judge should dismiss. It doesn’t have to be proven that no harm occurred. If it's an open question with evidence and argument on both sides, then judge won't dismiss.
Re: (Score:2)
Since there are zero cases that we know of where the flaw has been exploited
There, fixed that for you.
Re: (Score:2)
Since there are zero cases where the flaw has been exploited to cause any problems, no one has suffered any economic harm. You need to have been harmed in some way to have standing to sue.
Having their CPU lose a significant amount of performance is economic harm.
Re: (Score:2)
Lawsuits are for harm, not for worries about harm that might happen someday.
Re: (Score:3, Insightful)
Since there are zero cases where the flaw has been exploited to cause any problems, no one has suffered any economic harm. You need to have been harmed in some way to have standing to sue.
If your processor performs even 1% slower because of a bug in the hardware itself, you can easily call that being harmed, especially if you're a business that relies on that performance in any way.
Intel is not making your existing processor run 1% (or any percentage) slower. Your processor runs the same speed as the day you purchased it. If you or on your behalf Microsoft or some other operating system vendor plan on changing / patching your operating system with a version that runs slower than a previous version, how is this Intel's fault? Machines will only run slower if you change the software that runs on them.
The computing industry makes security vs. performance and usability design decision
Re: (Score:2)
false. costs associated with mitigation of risk incurred after being misled by false claims about chip's security are legally actionable.
Re: (Score:2, Informative)
You are always wrong [lawinfo.com]
Re: (Score:2)
false. lawsuits can be for false claims (regarding protection and separation of memory), increased risk, possible future harm, and mitigation costs.
Look it up.
Re: (Score:2)
false. lawsuits can be for false claims (regarding protection and separation of memory)
I'm sure Intel will argue they made no false claims of perfect, unhackable security.
increased risk
Increased from what? Computers have always worked this way, going back to 1995. The risks are no different today than a year ago.
mitigation costs
Google and Amazon might have mitigation costs. But Google and Amazon aren't a plaintiff class for a class action.
Don't worry though. I'm sure the lawyers will get paid. That's why we have a court system for class action lawsuits: so lawyers can get paychecks.
Re: (Score:2)
intel not only made claim but specifications of memory separation and protection.
This discovered violation of their claim of memory protection vulnerability means valuable information is at risk and must be mitigated with costly measures.
Google and Amazon can be plaintiffs by themselves, yes.
Re: (Score:2)
That would be a defective door, not a door that works as intended.
A closer analogy: You bought a door with 50 security features, but then someone found a very clever way to break in anyway. (But they didn't actually break in, they just wrote a white paper describing the method.). All 50 security features still work correctly, and your door still works correctly. But you want to sue because the door company didn't provide the 51st security feature that no one in the world ever thought was needed when your
Re: (Score:2)
So skip the patch download then.
Re: (Score:2)
Why are you installing the slowdown patch on your Oracle server? It's a dedicated box only for Oracle, not a box for web browsing or running untrusted code. You don't need the extra security.
this kind of class action is useless (Score:2)
This kind of class action is useless as it gives nothing to people affected by this issue. The only ones to profit here are the lawyers and there isn't even the nebulous "correct their behavior" part as Intel will fix it next time anyway regardless of the suit.
Re: (Score:2)
not true, people in the class can make a claim. Of course, that may require proactive behavior on your part
Re: (Score:2)
If you intend to make a serious claim you will have to exclude yourself from the inevitable settlement for lots of money to lawyers and 10$ off coupon for new intel cpu for the masses as the lawyers have no interest in pushing this past their payout. You can as well skip the class action part and sue yourself as its exactly where it will end anyway.
Expect a coupon (Score:2)
Expect to receive a coupon worth $0.99 off a shiny new Intel Inside(tm) computer in the US mail sometime around 2028
He's essentially saying... (Score:2)
That most of us were not benefiting from the technological blunder that puts us at such risk.
Comment removed (Score:3)
It's not only Intel (Score:2)
Re: (Score:2)
Citation needed for SPARC and ibm power professors.
Ditto for AMD.
Let's recap: Meltdown is Intel only. There's another attack called Spectre that affects a wider class of CPUs, including AMD, but that doesn't mean all CPUs are equally bad. Meltdown is the embarrassing one where software fixes cause slowdowns, and did I mention it's Intel only?
(Apparently, there are some non-Intel processors also affected by Meltdown, but I'm mainly talking about Intel vs. AMD as a whole.)
"hit"? (Score:2)
Re: "hit"? (Score:2)
Re: (Score:2)
Re: (Score:1)
Most operating systems after NT 3.5 are still based on it. NT 4.0, NT 5.0 (2000), NT 5.1 (Vista), and it continued through 7, 8, 10. We're all still using NT.
Re: (Score:1)
Speak for yourself, you insensitive clod!
UNIX!
Live Free Or Die!
Re: (Score:2)
Yeah! macOS [opengroup.org] forever!
Re: (Score:2)
Re: (Score:2)
I don't think any code was copied but Microsoft did hire the principal architect and 20 former VMS engineers to get the NT code into shape...
Re: (Score:2)
5.1 was XP, and 5.2 is 64-bit XP/Server 2003.
Vista was 6.0, 7 - 6.1, 8 - 6.2, 8.1 - 6.3
Then 10 was 10.0, of course, it's pretty much just 6.4 though.
https://en.wikipedia.org/wiki/Windows_nt [wikipedia.org]
Re: (Score:2)
Interesting article. Dave Cutler is a genius - even if NT never managed to beat Unix on big iron hardware I think the idea of designing from the ground up to run well on SMP and non x86 was a very foresighted one given it was made in 1993.
Re: God bless America!! (Score:5, Insightful)
You seem to have a design fault: an extra inverter somewhere.
Socialism is concerned with other people and how a community can be run in the interests of all its members. In practice, there is no other way for humans to live decently. Among others, it was warmly recommended by Jesus Christ.
The people who cry "Me me me!!! It's all about ME!" are rabid ultra-capitalists - as represented, I take it, by the Republican Party. Unfortunately, the Democratic Party has chosen to be a carbon copy of the Republicans rather than an alternative.
Re: (Score:2)
I don't have an answer, but the problem with Socialism is the concentration of power, so that someone gets to decide what is best for everyone else. Unfortunately, every other form of government seems to have the same flaw. And anarchy leads to war-lordism, which has the same problem.
An ideal situation would be a Socialist dictatorship of some variety where the entity controlling it was guaranteed to not be an over-controlling interfering busy-body. But that lets out every human controlled government, an
Re: (Score:2)
Of course socialism is obviously a form of capitalism. For the record - Capitalism is where people pool their capital in order to do projects they can't do on their own. The same pooling of capital happens with socialism. The difference between socialism and capitalism is one is FORCED to participate under socialism - one has the freedom not to take part under capitalism - at least in free countries.
The biblical form of cooperation was also voluntary.
Both systems can be corrupt. And neither of them works
Re: (Score:2)
yes private ownership and wealth with the choice of what to do with it is in the Bible; if you don't like that find another religion.
of course, mythical person who didn't exist in history isn't a god nor will find path to anyone's heart.
Re: God bless America!! (Score:2)
Paul was a conman who hijacked the nascent communal Jesus social movement. This is why New Testament doctrinal inconsistencies are generally between Jesus and Paul. Apologists try to harmonize them, but too many are flat-out contradictions.
Re: (Score:2)
ME! ME! ME! [youtube.com] (probably NSFW, unless you do drugs)
Re: (Score:2)
Then I hope you enjoyed the video!
Re: (Score:2)
They won't