Linux creator Linus Torvalds has had some harsh words for Intel in the course of a discussion about patches for two bugs that were found to affect most of the company's processors.
Two flaws — dubbed Meltdown and Spectre — were revealed this week in Intel processors made since 1995 and companies have been hustling to offer fixes and workarounds.
Meltdown removes the barrier between user applications and sensitive parts of the operating system while Spectre, which is also reportedly found in some AMD and ARM processors, can trick vulnerable applications into leaking the contents of their memory.
{loadposition sam08}Torvalds was clearly unimpressed by Intel's bid to play down the crisis through its media statements, saying: "I think somebody inside of Intel needs to really take a long hard look at their CPUs, and actually admit that they have issues instead of writing PR blurbs that say that everything works as designed."
The Finn, who is known for never beating about the bush where technical issues are concerned, questioned what Intel was actually trying to say.
"Or is Intel basically saying 'we are committed to selling you shit forever and ever, and never fixing anything'?" he asked. "Because if that's the case, maybe we should start looking towards the ARM64 people more."
— Justin Cormack (@justincormack) 5 January 2018
Meanwhile, an Australian who was part of the team that released advice about the bugs, said: "These bugs in the hardware can enable hackers using malicious programs to steal sensitive data which is currently processed on the computer. Such programs can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs."
Dr Yuval Yarom, of the University of Adelaide's School of Computer Science, and Data 61, added: "They do this because the processor leaves behind traces of the information that it's processing, and these traces could lead a hacker to discover important information."
But he said there was a positive to the findings too. "Ultimately, I think our discovery will help to change the way processors are designed, to help prevent such cyber security concerns."
The organisations involved in finding the bugs included Google's Project Zero, the University of Adelaide and CSIRO's Data61 in Australia, Graz University of Technology in Austria, Cyberus Technology GmbH in Germany, and the University of Pennsylvania, University of Maryland and Rambus in the US.
Commenting on the bugs, Ryan Kalember, vice-president of Cyber Security Strategy at security outfit Proofpoint, said: "Like most organisations, chip manufacturers have long prioritised speed over security – and that has led to a tremendous amount of sensitive data (being) placed at risk of unauthorised access via Meltdown and Spectre.
Meltdown and Spectre https://t.co/W76ta4VrSs https://t.co/EtLeEes1hA pic.twitter.com/vqQ3FgkTIH
— XKCD Comic (@xkcdComic) 5 January 2018
"While the vast majority of computing devices are impacted by these flaws, the sky is not falling. Both vulnerabilities require an attacker to be able to run their code on the device they are attacking. The typical consumer is still vastly more likely to be targeted by something like a phishing email than a targeted attack exploiting Meltdown or Spectre.
"However, these vulnerabilities break down some of the most fundamental barriers computers use to keep data safe, so cloud providers need to act quickly to ensure that unauthorised access, which would be very difficult to detect, does not occur."
Kalember said that if there was some good news, it was fortunate that these vulnerabilities were discovered and responsibly disclosed by respected researchers as opposed to being exploited in a large-scale, potentially-damaging global attack.
"Organisations worldwide need to immediately implement the Kaiser patch to address the Meltdown threat and we applaud the quick action by companies such as Amazon, Google, and Microsoft to do so. While there is no immediate fix for Spectre, we would hope the chip manufacturers learn from these vulnerabilities and weigh the security implications of their new product features," he added.