Intel sued for knowingly selling defective processors

According to Tom's Guide , the vulnerability is exploited by AVX2 and AVX-512 instructions through an attack Intel calls Gather Data Sampling (GDS). Information about the upcoming lawsuit first emerged in August 2023. The vulnerability affects Intel processors from the 6th generation (Skylake) to 11th (Rocket Lake), including Xeon chips based on the same architecture, potentially affecting billions of processors.

Intel is said to have known about the existence of the Downfall vulnerability but 'stood by and watched'

Intel admitted that for some workloads, the performance drop after installing the patch can be as high as 50%. A series of tests conducted shortly after the incident was discovered showed a performance drop of up to 39%, with applications that rely heavily on AVX2 and AVX-512 instructions being hit the hardest.

In 2018, when the Downfall vulnerability was discovered, a series of news sites reported that the Spectre and Meltdown vulnerabilities, which targeted the speculative execution process that many modern processors use to speed up calculations, had been widely publicized. This led security researchers to start looking into similar attack vectors. In June 2018, researcher Alexander Yee reported a new variant of the Spectre vulnerability for Intel processors that focused on AVX and AVX512. This information was kept strictly confidential for two months to give Intel a chance to act to fix the situation.

In fact, according to the lawsuit, Yee wasn't the only one to warn Intel about the AVX vulnerabilities. Specifically, the plaintiffs say: "In the summer of 2018, as Intel grappled with the fallout from Spectre and Meltdown and promised hardware fixes for future generations of processors, the company received two separate third-party vulnerability reports that mentioned several AVX-related vulnerabilities for its processors." The plaintiffs note that Intel acknowledged reading these reports.

The main complaint in the court documents demanding a jury trial in the U.S. District Court in San Jose, focuses not on the existence of the Downfall vulnerability or the performance penalty for the patches, but on Intel's actions. The plaintiffs allege that the company has known about the flaw behind Downfall since 2018, but has knowingly sold billions of processors since the glitch was discovered. This leaves users with two (both unacceptable) options: buy vulnerable processors or install a performance-destroying patch to protect them. That's why the plaintiffs are asking for Intel's compensation.

Source link: https://thanhnien.vn/intel-bi-kien-vi-co-tinh-ban-bo-xu-ly-co-loi-185231111152148353.htm