Tech Support
Documentation
Login
Contact Us
TuxCare BlogNew Intel Downfall AVX2/AVX-512 Vulnerability & Its Huge Performance Impact
by Wajahat Raja
August 15, 2023 - TuxCare expert team
A new speculative execution vulnerability called Downfall, also known as GDS (Gather Data Sampling)- that affects multiple generations of Intel processors, has been discovered recently. The scope of Intel Downfall AVX2/AVX-512 Vulnerability involves AVX2 and AVX-512 instruction set processors. This microarchitectural security flaw in Intel CPUs affects a variety of CPUs from Skylake through Tiger Lake/Ice Lake. Although the most recent Intel CPU generations are unaffected, the vulnerability is a source of worry and concern for many users.
How It Works
As a memory minimization feature, Downfall unintentionally makes internal hardware registers accessible to software. The AVX GATHER instruction, which accidentally leaks data from the internal vector register file during speculative execution, is the source of the vulnerability. Potential data breaches are made possible by this exposure. This makes it possible for untrusted software to access data that should ideally stay inaccessible. The real-world ramifications of Daniel Moghimi’s discovery of Downfall include the extraction of private data from the Linux kernel and sensitive information like AES keys.
Affected Processors and Mitigation
The impact of Intel Downfall AVX2/AVX-512 vulnerability revolves around server-side Xeon Scalable Ice Lake processors and client-side processors from Tiger Lake to Skylake. Alder Lake, Raptor Lake, and Sapphire Rapids were exempt from Downfall’s reach, but Intel quickly provided microcode mitigations in response. These mitigations do, however, come with a warning. Mitigating AVX-512 vulnerability impact can result in performance deterioration, especially when gather instructions are frequently used in an application’s hot path.
Consequences
The potential performance consequences of microcode mitigation are what really matter. Workloads that require a lot of vectorization, like those that use AVX2/AVX-512, may see significant performance drops. Artificial intelligence (AI), high-performance computing (HPC), video encoding, and, not to forget, transcoding may be particularly affected. Although Intel has refrained from making specific performance promises, partners have reported possible implications of up to 50%. Intel has also acknowledged this issue of the AVX-512 vulnerability patch and performance.
If the users think their systems are unaffected, they have the option to turn off the microcode change as part of Intel’s response to Downfall. Although Intel highlights the difficulty of carrying out a Downfall assault outside of controlled circumstances, there is still disagreement on the viability of such attacks in actual situations. Daniel Moghimi’s viewpoint, in contrast, emphasizes the usefulness of the vulnerability in light of the current shared computer infrastructure.
Alarmingly, Daniel Moghimi informed Intel of Downfall’s existence in August 2022. But the public information didn’t surface until a year later. The delay highlights how difficult it is to address these vulnerabilities and the difficulties in rapid mitigation.
<h2=”path”>
The Path Forward
A recovery to Downfall is provided by the next Intel CPU microcode update and the related Linux kernel fixes. Due to the microcode’s potential performance impact, extensive benchmarking has been conducted to evaluate its effects. Although Intel has been aggressive in resolving the vulnerability, there is still cause for concern, especially given the potential performance costs in the AVX2 and AVX-512 instruction sets vulnerability.
Conclusion
Due to this data security risk from AVX-512 vulnerability, Downfall occupies a crucial position in the landscape of developing processor vulnerabilities. Tux Care is still dedicated to informing you of significant changes in the Linux ecosystem. We are prepared to offer the assistance and solutions required to manage the constantly shifting technological landscape as the situation develops.
Keep an eye out for updates, and get in touch with an expert in case of any queries!
The sources for this piece include an article in Phoronix.
