Dev1 Galaxy Forum / The importance of Microcode

Re: The importance of Microcode

dummy@example.com (bilhook) — Sun, 17 Mar 2024 19:12:27 +0000

On my computers, I forget what it is that does not work with microcode installed, alsa line-out|hdmi I think.
Shady.

Re: The importance of Microcode

dummy@example.com (czeekaj) — Sat, 16 Mar 2024 16:24:33 +0000

of course. I have been using an old x200 thinkpad with 0 microcode just fine there is that whole memory sinkhole thing because the APIC register can move I believe you can partially disable it though? My laptop ever a dell e6410 I installed the oldest bios available and it doesn't include microcode either. I just advise what I read skylake and onwards SGX is present and continues to be a thing on todays Xeon processors. So microcode helps mitigate issues.
Most people recommend it, as CPUs come with baked in microcode anyway. My concern is when loading microcode can flip some CPU registers.

Re: The importance of Microcode

dummy@example.com (stopAI) — Sat, 16 Mar 2024 15:27:41 +0000

I don't know about others, but my old machine works fine even without the microcode...

Re: The importance of Microcode

dummy@example.com (czeekaj) — Sat, 16 Mar 2024 15:25:38 +0000

yeah on a Q9550 I could see you just leave the old microcode packages. It's not something you update often! But I was deliberately removing it, depends on the hardware honestly. some UEFI systems have quite a few features that may expose the user to more attack vectors than other systems. It all depends I am sure. I'm sure there are realtek micro controllers that play much nicer than others for instance.

Re: The importance of Microcode

dummy@example.com (Altoid) — Fri, 15 Mar 2024 18:39:31 +0000

Hello:

czeekaj wrote:

... will be utilizing microcode updates to protect myself ...

As far as I know, it is enough to keep your system up to date.

In the last nine years, have seen intel-microcode packages updated once every blue moon, probably because my box runs on a legacy (EOL 03/2013) Intel Yorkfield (Core™2 Quad Q9550) processor.

The intel-microcode package is/has been there as part of the installation/upgrades from the start:

~$ apt list | grep installed | grep -i microcode
--- snip ---
intel-microcode/oldoldstable-security,now 3.20231114.1~deb10u1 amd64 [installed]
~$

And then there is what you can see here.
Microcode for Intel and amd64 CPUs all the way from up Jesse down to Ceres.

So any time a microcode package gets upgraded, it is made available for you in the Devuan repositories.

You would have to take intentional steps to keep your system apt from actually downloading and installing it.

I may be missing something in your particular case, but in my opinion, keeping your system up-to-date is not an option to consider.
It is something you do.

Best,

The importance of Microcode

dummy@example.com (czeekaj) — Fri, 15 Mar 2024 16:49:18 +0000

Hi guys,

I used to never really use microcode updates. However, recently I was exposed to some kind of low level rootkit like malware on my UEFI bios or within the Intel NIC PXE like system.

see:
https://platypusattack.com/

An attacker can use intel rapl to potentially find encryption keys and other secrets. I noticed this when intel_rapl kernel module was not able to be disabled and other conditions where they were trying to maintain persistance. It could effect every linux OS on intel platform post Sandybridge with SGX enclaves built in.

So from now on, I will be utilizing microcode updates to protect myself going forward from these kinds of attacks where SGX instructions are present. I thought I should share with others so they can evaluate their choice in keeping their microcode up to date depending on their hardware and the presence of intel SGX enclaves instructions.