May 21, 2018

Details and Mitigation Information for Variant 4

By Leslie Culbertson

Following Google Project Zero’s (GPZ)* disclosure of speculative execution-based side-channel analysis methods in January, Intel has continued working with researchers across the industry to understand whether similar methods could be used in other areas. We know that new categories of security exploits often follow a predictable lifecycle, which can include new derivatives of the original exploit.

Expecting that this category of side-channel exploits would be no different, one of the steps we took earlier this year was expanding our bug bounty program to support and accelerate the identification of new methods. The response to that program has been encouraging, and we are thankful for the continued partnership we have with the research community.

As part of this ongoing work, today Intel and other industry partners are providing details and mitigation information for a new derivative of the original vulnerabilities impacting us and other chipmakers. This new derivative is called Variant 4, and it’s being disclosed jointly by GPZ and Microsoft’s Security Response Center (MSRC).*

In the spirit of Intel’s security first pledge, I want to explain what this new variant is and how customers can protect themselves. As I do this, let me start by saying that we have not seen any reports of this method being used in real-world exploits. Moreover, there are multiple ways for consumers and IT professionals to safeguard their systems against potential exploits, including browser-based mitigations that have already been deployed and are available for use today.

About Variant 4

Like the other GPZ variants, Variant 4 uses speculative execution, a feature common to most modern processor architectures, to potentially expose certain kinds of data through a side channel. In this case, the researchers demonstrated Variant 4 in a language-based runtime environment. While we are not aware of a successful browser exploit, the most common use of runtimes, like JavaScript, is in web browsers.

Starting in January, most leading browser providers deployed mitigations for Variant 1 in their managed runtimes – mitigations that substantially increase the difficulty of exploiting side channels in a web browser. These mitigations are also applicable to Variant 4 and available for consumers to use today. However, to ensure we offer the option for full mitigation and to prevent this method from being used in other ways, we and our industry partners are offering an additional mitigation for Variant 4, which is a combination of microcode and software updates.

We’ve already delivered the microcode update for Variant 4 in beta form to OEM system manufacturers and system software vendors, and we expect it will be released into production BIOS and software updates over the coming weeks. This mitigation will be set to off-by-default, providing customers the choice of whether to enable it. We expect most industry software partners will likewise use the default-off option. In this configuration, we have observed no performance impact. If enabled, we’ve observed a performance impact of approximately 2 to 8 percent based on overall scores for benchmarks like SYSmark® 2014 SE and SPEC integer rate on client¹ and server² test systems.

This same update also includes microcode that addresses Variant 3a (Rogue System Register Read), which was previously documented publicly by Arm* in January. We have not observed any meaningful performance impact on client or server benchmarks with the Variant 3a mitigation.³ We’ve bundled these two microcode updates together to streamline the process for our industry partners and customers. This is something you will see us continue, as we recognize that a more predictable and consolidated update process will be helpful to the entire ecosystem.

We’ve provided more information regarding the Intel products that are potentially affected on our product security center page, along with white papers and other resources that provide guidance to help IT professionals assess the risk level in their environment. In addition, we’ve updated our security first web site with a list of new Frequently Asked Questions to help anyone who needs more information. As before, I continue to encourage everyone to keep their systems up-to-date, as it’s one of the easiest ways to ensure you always have the latest protections.

Protecting our customers’ data and ensuring the security of our products remain critical priorities for me and everyone at Intel. Research into side-channel security methods will continue and likewise, we will continue to collaborate with industry partners to provide customers the protections they need. Indeed, we are confident that we will be able to develop mitigations for Intel products for any future side-channel issues.

On behalf of the entire Intel team, I thank our industry partners and customers for their ongoing support.

Leslie Culbertson is executive vice president and general manager of Product Assurance and Security at Intel Corporation.

¹ Client measurements are based on Intel internal reference platform and an 8th Generation Intel® Core™ desktop microprocessor. Specifically, observed performance impact was 4% as measured by SYSmark 2014 SE overall score, 2 % as measured by SPECint_rate_base2006 (n copy) total score, and 8% impact as measured by SPECint_rate_base2006 (1 copy) total score.

² Server measurements are based on Intel internal reference platforms and an Intel® Xeon® Processor Scalable Family (formerly Skylake) microprocessor. Specifically, observed performance impact was 3% as measured by SPECint_rate_base2006 (n copy) total score, and 8% as measured by SPECint_rate_base2006 (1 copy) total score.

³ Performance impact of 0-1%

Benchmark results reported by Intel may need to be revised as additional testing is conducted. The results depend on the specific platform configurations and workloads utilized in the testing, and may not be applicable to any particular user’s components, computer system or workloads. The results are not necessarily representative of other benchmarks and other benchmark results may show greater or lesser impact from mitigations.

Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors.

Performance tests, such as SYSmark and MobileMark, are measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products.