Intel’s Downfall: A Security Vulnerability Causing Performance Concerns

Intel has recently disclosed a security vulnerability termed ‘Downfall’, which impacts multiple generations of their processors. This flaw could potentially lead to a performance impact of up to 50% on AVX2 and AVX-512 workloads using the Gather instruction. Discovered by Google researcher Daniel Moghimi, this vulnerability has stirred concerns in the tech community regarding both security and performance implications.

The Mechanics of Downfall

Downfall (CVE-2022-40982) targets the memory optimization feature within Intel processors. The Gather instruction, an integral part of this feature, aims to accelerate data fetching scattered throughout different memory locations. However, an inadvertent outcome of this function is the exposure of internal hardware registers to software. This flaw allows untrusted software to access data retained by other applications, which should be inaccessible in a well-secured system.

Intel’s processors, ranging from Skylake to Rocket Lake microarchitectures, are vulnerable to Downfall. However, more recent processors like Alder Lake, Raptor Lake, or Sapphire Rapids remain unaffected. For a comprehensive list of affected chips, Intel has provided a detailed index.

Performance Impact

Phoronix’s Evaluation

Renowned Linux publication, Phoronix, undertook the task of assessing the real-world implications of Downfall. The team benchmarked various chips, including:

• Xeon Platinum 8380 (Ice Lake)
• Xeon Gold 6226R (Cascade Lake)
• Core i7-1165G7 (Tiger Lake)

Key findings from Phoronix’s assessment:

• Xeon Platinum 8380 exhibited a performance reduction of 6% in OpenVKL 1.3.1 and up to 34% in OSPRay 2.12.
• AI workloads on the same chip witnessed up to 17% decreases, evident in Neural Magic DeepSparse 1.5, Tencent NCNN, and QMCPACK.
• Xeon Gold 6226R saw performance drops of up to 33% in OSPRay 2.12 and 20% in Neural Magic DeepSparse 1.5.
• Core i7-1165G7’s performance was curtailed by 11% in OpenVLK 1.3.1, and OSPRay 2.12 mitigations resulted in a 19-39% decrease.

What this means for Intel Users

While the observed performance decline did not match Intel’s projected 50% reduction, the penalty remains substantial. AVX instructions span beyond just AI or HPC workload tests and are present in functions like video encoding. From preliminary evaluations, it’s evident that HPC workloads bear the brunt of the impact.

Intel has given users the choice to opt out of the microcode update, allowing them to bypass the mitigation for performance retention. But this brings forward the debate of security vs. performance. While executing a Downfall attack may present complexities, users must decide between prioritizing security or performance.

Researcher’s Insight and Intel’s Response

Daniel Moghimi, the researcher who unearthed Downfall, found the vulnerability embedded in the memory optimization traits of Intel processors. His research indicated that during speculative execution, the Gather instruction leaked the content of internal vector register files. Data from a different process and gather execution running on the same core was transiently forwarded to subsequent dependent instructions.

Moghimi made public a detailed report on his research along with the complete source code for Downfall. Intel reciprocated by releasing a technical manual on Gather Data Sampling, its reference name for Downfall.

This vulnerability was first intimated to Intel in August 2022, but it was kept under wraps following the coordinated vulnerability disclosure practice. Only after a fix was available was the issue made public.

Conclusion

Downfall has highlighted the persistent challenges in chip design and the balance between performance and security. While Phoronix’s tests indicate that regular consumers, particularly those focused on gaming and entertainment, might not be gravely impacted, the vulnerability’s repercussions on data-sensitive sectors, such as corporations and data centers, are more significant. Intel’s decision to allow opt-out from the microcode update is an acknowledgment of these diverse user needs, but the broader question remains: At what cost does performance come?