I'm done. Please... Can someone tell me what the hell is going on? I completely overwhelmed, as I don't claim to properly understand what's happening.
Can someone explain for an idiot? Am I safer just leaving my PC turned off for now?
Ok I cannot even remotely claim to be certain but here is how I understand it.
Intel's cpu has a technique for speed reading tasks, and executing almost pre-emptively and this bypasses safety checks that it really shouldn't.
Sort of like it get's a list of tasks, to a minute level, like when clearing a breakfast table.
The list could go:
Open fridge.
Pick up milk.
Put milk in frigde.
etc etc.
I open the fridge door with my left hand, and the right hand is already holding the milk carton.
But instead of 'pre-fetching' the milk carton some clever gits has figured they could interject a command to instead open the gun vault, or coded jewellery box.
So someone could make a java or other application or something that would trick the CPU into revealing memory to the application, from a segment of memory that has no business of having access to, like where OS passwords and access tokens etc are stored.
The patch is so far mostly to enforce security checks and this probable costs a bit of overhead, on top of the drop in efficiency from the pre-fetching of tasks.
For us at home users I'm sure it will be rather small impact, games are a rather tailored and well defined task for cpu's anyways so I don't expect them to even use the pre-fetch a lot.
More heavy data center type activities like databases etc will probably be where we see the 30% jump and honestly this could be a disaster for such services.
They will most likely have to scale back server utilisation and add hardware later, but as all things this is not our problem.
Industry wise this is easily comparative if not worse than the VW mileage\fuel consumption fiasco.
Also.
- The research described was performed in a controlled, dedicated lab environment by a highly knowledgeable team with detailed, non-public information about the processors targeted.
- The described threat has not been seen in the public domain.
I would as a layman not consider this something to worry about, it is important it was discovered and important it is patched but nothing really bad hasn't happened yet.
