New x86 micro-op vulnerability breaks all known Spectre defenses
I&#x27;ve been saying this from the start: the well of issues is infinitely deep as soon as you decide that multiple tenants running on the same physical hardware inferring something about another is a vulnerability. I assert, but cannot rigorously prove, that it is <i>not possible</i> to design a CPU such that execution of arbitrary instructions has no observable side-effects, <i>especially</i> if the CPU is speculating.<p>I don&#x27;t know what that spells for cloud hosting providers - maybe they have to buy a lot more CPUs so every client can have their own, or commission a special &quot;shared&quot; SKU of CPU that doesn&#x27;t have any speculative execution - but I know for me, if I have untrusted code running on my CPU, I&#x27;ve already lost. I could then care less about information leakage between threads.<p>We&#x27;re going to wind up undoing the last 20 years of performance gains in the name of &#x27;security&#x27;, and it scares me.