Intel Memory Access Design Flaw Already Addressed by Apple in macOS 10.13.2

[MacRumors]

A serious design flaw and security vulnerability discovered in Intel CPUs has reportedly already been partially addressed by Apple in the recent macOS 10.13.2 update, which was released to the public on December 6.

According to developer Alex Ionescu, Apple introduced a fix in macOS 10.13.2, with additional tweaks set to be introduced in macOS 10.13.3, currently in beta testing. AppleInsider also says that it has heard from "multiple sources within Apple" that updates made in macOS 10.13.2 have mitigated "most" security concerns associated with the KPTI vulnerability.

The question on everyone's minds: Does MacOS fix the Intel #KPTI Issue? Why yes, yes it does. Say hello to the "Double Map" since 10.13.2 -- and with some surprises in 10.13.3 (under Developer NDA so can't talk/show you). cc @i0n1c @s1guza @patrickwardle pic.twitter.com/S1YJ9tMS63 - Alex Ionescu (@aionescu) January 3, 2018

Publicized yesterday, the design flaw in Intel chips allows normal user programs to see some of the contents of the protected kernel memory, potentially giving hackers and malicious programs access to sensitive information like passwords, login keys, and more.

Full details on the vulnerability continue to be unavailable and under embargo, so it's not yet clear just how serious it is, but fixing it involves isolating the kernel's memory from user processes using Kernel Page Table Isolation at the OS level. Implementing Kernel Page Table Isolation could cause a performance hit on some machines.

According to The Register, which first shared details on the vulnerability, Windows and Linux machines will see a 5 to 30 percent slowdown once a fix is in place. It appears Macs may not be hit as heavily, as no noticeable performance slowdowns have been reported since the launch of macOS 10.13.2.

Ionescu also says that performance drop on a system with PCID (Process-Context Identifiers), available on most modern Macs, is "minimal," so most users may not see an impact on day-to-day Mac usage.

Article Link: Intel Memory Access Design Flaw Already Addressed by Apple in macOS 10.13.2

 

[tzm41]

Hmmmm, good news I guess?

 

[justperry]

Didn't see any performance drop on my Macs.

 

[MysteryMii215]

Well that was quick.

 

[Rudy69]

It will be interesting to see the benchmarks from 10.13.1 and 10.13.2/10.13.3 to see the real impact on performance

 

[radiology]

I wonder what will be the downstream effect in the release of new chips and new Apple laptops and desktops. When should we expect to see a new MacBook Pro? is this the excuse Apple wanted to delay the release of Macs?

 

[justperry]

Well that was quick.

Erm...no, 10.13.2 has been out for quite a bit, almost a month ago.

Might have even been in earlier beta's as well.

 

[pier]

What about El Capitan and Sierra?

 

[alex00100]

I'd still replace my battery just to be sure

 

[sublunar]

Pre-Haswell CPUs will be hit worse apparently - that appears to include Ivy Bridge as used in 2012 Retina MacBook Pros, 2012 Mac Minis, and even - I think - the 2013 nMP.

Another reason for Apple to quietly retire the nMP as soon as possible because future benchmarks could potentially not look good for it. Good thing they already released something in 10.13.2 and have more fixes coming in 10.13.3.

 

[noxivs]

What do we make of this really? I think someone should do a comparative test on handbrake or anything that solely uses CPU and only then we can tell the difference between 10.13.2 and any previous versions of macOS

 

[RoobyRoobyRoo]

Erm...no, 10.13.2 has been out for quite a bit, almost a month ago.

Might have even been in earlier beta's as well.

So quick that it happened in the past! I like this new time-bending Apple.

 

[Mike MA]

In my opinion Apple is having some issue with transparency. Why not addressing fixes like this or actions like the battery management more openly? Many things might be good decisions or actions from a content perspective, but not well explained in the first place.

 

[SecuritySteve]

Anyone know if this applies to security-patches for Sierra / El Capitan?

 

[justperry]

Pre-Haswell CPUs will be hit worse apparently - that appears to include Ivy Bridge as used in 2012 Retina MacBook Pros, 2012 Mac Minis, and even - I think - the 2013 nMP.

Another reason for Apple to quietly retire the nMP as soon as possible because future benchmarks could potentially not look good for it. Good thing they already released something in 10.13.2 and have more fixes coming in 10.13.3.

Didn't see any performance drop on my Macs.

My MBP and Mac Mini are both 2012 models.

 

[Frederik on MacRumors]

What about my MacBook Pro mid 2009? Is it not affected?

 

[bbfc]

In my opinion Apple is having some issue with transparency. Why not addressing fixes like this or actions like the battery management more openly? Many things might be good decisions or actions from a content perspective, but not well explained in the first place.

I don't believe they could talk about this issue as its under an NDA.

What I find even more less-transparent, is the fact that this issue is not mentioned on the Intel website, or if it is its buried deep. This should be the first thing you see! Not mentioned on any of their social media accounts too!

 

[Mascots]

Ah how nice to hear Apple is ahead of this one. Would be refreshing if this was a turn around of a pretty rocky 2017 as far as software hardness goes.

 

[Mike MA]

I don't believe they could talk about this issue as its under an NDA.

We‘re on the same page here. I also emphasized the need on many of the decisions taken. Yet, some explanations could avoid a lot of discussions or controversy.

 

[Darmok N Jalad]

I’m also curious how this affects Sierra. I’m currently on it to dual boot Windows with a non-EFI card, but I may just ditch the Windows partition for this one or try the HS upgrade without the APFS conversion.

 

[juanmj93]

Just saw some Linux benchmarks and some workloads that make lots of syscalls such as virtualization and compiling take a huge hit, while things like gaming are seemingly unaffected, I haven't felt any difference in my Macs, But I guess comprehensive benchmarking needs to be done given that it affects differently older processor families like Sandy and Ivy Bridge.

 

[RyanXM]

https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

 

[juanmj93]

Has anyone noticed slowdowns in Xcode workflows for example?

 

[Double-Slit]

Is this 'Intel-bug' security-update also implemented in macOS 10.11.6 (El Capitan) software-update?

 

[matjamca]

This article seems to suggest ARM processors may be vulnerable too ...

https://arstechnica.com/gadgets/2018/01/whats-behind-the-intel-design-flaw-forcing-numerous-patches/