【科技】英特尔的处理器存在安全漏洞，修复可能会降低PC的速度

原创翻译：龙腾网 http://www.ltaaa.com 翻译：lhao 转载请注明出处
论坛地址：http://www.ltaaa.com/bbs/thread-466448-1-1.html

A security flaw in Intel processors has led to a redesign of Linux and Windows kernels. Programmers have been busy for the past two months patching the Linux kernel’s virtual memory system to protect against a hardware bug in Intel CPUs that could let attackers exploit security weaknesses and access security keys, passwords, and files cached from a disk. The Register reports that software updates are required for both Windows and Linux systems, and performance of a machine will be affected.

英特尔处理器的一个安全缺陷导致了Linux和Windows内核需要重新设计。 过去两个月，程序员一直忙于修补Linux内核的虚拟内存系统，以防止Intel CPU中的硬件错误。这些错误可能会让攻击者利用安全弱点访问磁盘上缓存的安全密钥，密码和文件。Register报告说，Windows和Linux系统都需要软件更新，并且机器的性能也会受到影响。

Reports suggest information around the specific bug has been kept confidential between software and hardware vendors, and patches for the Linux kernel include comments that have been redacted to prevent attackers discovering the precise weakness. The security bug could be present on Intel processors manufactured over the past 10 years, meaning many systems will require updates. 

相关报导暗示软件和硬件厂商之间对漏洞进行保密，以及Linux内核的补丁和已经编辑过的注释，以防止攻击者发现确切的弱点。英特尔过去10年间生产的处理器都可能存在安全漏洞，这意味着许多系统将需要更新。

The exact bug is related to the way that regular apps and programs can discover the contents of protect kernel memory areas. Kernels in operating systems have complete control over the entire system, and connect applications to the processor, memory, and other hardware inside a computer. There appears to be a flaw in Intel’s processors that lets attackers bypass kernel access protections so that regular apps can read the contents of kernel memory. To protect against this, Linux programmers have been separating the kernel's memory away from user processes in what’s being called “Kernel Page Table Isolation.”

确切的错误与用户应用程序可以发现内核内存保护区域的内容有关。操作系统中的内核可以完全控制整个系统，并将应用程序连接到计算机内的处理器，内存和其他硬件。 英特尔处理器似乎存在一个漏洞，允许攻击者绕过内核内存访问保护，以便用户应用程序可以读取内核内存的内容。为了防止这种情况发生，Linux程序员已经将内核的内存从用户进程中分离出来，称为“内核页表隔离”。
 

The problem with this isolation is that some programmers are reporting performance hits after systems are patched. The Register reports that the slowdowns could be between 5 and 30 percent depending on the exact Intel processor. While Linux patches have been rolling out over the past month, a Windows 10 patch is not yet available. Some are speculating that Microsoft will deliver this in an upcoming Patch Tuesday, as the company started separating the NT kernel memory with Windows 10 beta builds in November. “We have nothing to share at this time,” says a Microsoft spokesperson, in response to a query from The Verge.

这种隔离的问题在于有些程序员在系统修补后的性能损失。Register报告说，性能损失可能在5％到30％之间，这取决于具体的英特尔处理器型号。尽管过去一个月Linux补丁已经推出，但Windows 10补丁尚不可用。有人猜测，微软将在星期二发布补丁，因为该公司在11月份开始将NT内核内存与Windows 10 beta版本分离。微软发言人在回应The Verge的一次询问时表示：“目前我们没有什么可分享的东西。

It’s still unclear how these patches will affect regular Windows, Mac, and Linux machines. AppleInsider reports that Apple has already deployed a partial fix for the security bug in macOS 10.13.2, which was released last month. Citing multiple sources at Apple and developer Alex Ionescu, who publicly identified code that points to the fix, the report says Apple has mitigated the flaw by altering existing programming requirements related to the kernel memory data in macOS. More changes are expected to come with 10.13.3 soon, AppleInsider reports.  

目前还不清楚这些补丁如何影响普通的Windows，Mac和Linux机器。 AppleInsider报道，苹果公司已经部署了上个月发布的macOS 10.13.2中的安全漏洞补丁。苹果和开发商Alex Ionescu引用了多个消息来源，他们公开指出了指向该修补程序的代码，报告称苹果通过改变macOS中与内核内存数据相关的现有编程要求来缓解这个缺陷。AppleInsider报告称，预计10.13.3将会有更多的变化。

Still, one researcher speculates that virtual machines and cloud providers will be most affected by the security problem and resulting performance hits. Microsoft’s Azure cloud will experience maintenance next week, and Amazon Web Services has warned that a big security update is coming on Friday. AMD has confirmed that its own processors are not affected by this security bug. “AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against,” explains Tom Lendacky, an AMD engineer. AMD stocks have soared this morning as a result of Intel’s processor flaw. Intel has not yet publicly commented on the security problem.

不过，一位研究人员推测，虚拟机和云提供商将受到安全问题和性能的影响最大。 微软的Azure云将在下周进行维护，亚马逊网络服务已经警告说，周五将会有一个重大的安全更新。 AMD已经证实，它自己的处理器不受这个安全漏洞的影响。 AMD公司的工程师Tom Lendacky解释说：“AMD处理器不受内核页表隔离功能所抵御的攻击类型的限制。”由于英特尔处理器的缺陷，AMD股价今天早上大涨。 英特尔尚未公开评论安全问题。