Smith v. Intel Corporation

CourtDistrict Court, N.D. California
DecidedAugust 15, 2024
Docket4:23-cv-05761
StatusUnknown

This text of Smith v. Intel Corporation (Smith v. Intel Corporation) is published on Counsel Stack Legal Research, covering District Court, N.D. California primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Smith v. Intel Corporation, (N.D. Cal. 2024).

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 DARQUES SMITH, et al., Case No. 23-cv-05761-HSG

8 Plaintiffs, ORDER GRANTING DEFENDANT’S MOTION TO DISMISS, 9 v. TERMINATING AS MOOT DEFENDANT’S MOTION TO STAY 10 INTEL CORPORATION, DISCOVERY, AND IMPOSING TEMPORARY DISCOVERY STAY 11 Defendant. Re: Dkt. Nos. 30, 33 12

13 14 Pending before the Court are Defendant’s motions to dismiss and to stay discovery 15 pending resolution of the motion to dismiss. Dkt. Nos. 30, 33. The Court finds these matters 16 appropriate for disposition without oral argument and the deems them submitted. See Civil L.R. 17 7-1(b). For the reasons discussed below, the Court GRANTS Defendant’s motion to dismiss, 18 TERMINATES AS MOOT Defendant’s motion to stay discovery, and temporarily STAYS 19 DISCOVERY until Plaintiffs allege an actionable claim. 20 I. BACKGROUND 21 On November 11, 2023, Darques Smith, Renee Waltrip, Brian Cameron, Elizabeth 22 Cordova and Michael Worley, on behalf of themselves and all others similarly situated nationwide 23 (“Plaintiffs”), filed a class action complaint against Intel Corporation (“Defendant”). See Dkt. No. 24 1 (“Compl.”). Plaintiffs – who purchased central processing units (“CPUs”) and computers 25 incorporating CPUs made by Defendant – allege that Defendant knowingly sold CPUs with a 26 security vulnerability. Id. ¶ 1, 5. According to Plaintiffs, Defendant was on notice of a hardware 27 defect that created this security threat, but nevertheless continued to sell CPUs without fixing the 1 the only way to fix a hardware issue of the sort alleged would be to deploy software “patches” that 2 throttled the processing power of the CPUs. 3 At a high level, the security vulnerability that Plaintiffs allege relates to a computer 4 processing technique called “branch prediction.” According to Plaintiffs, branch prediction is a 5 “speculative procedure” developed in the 1990s designed to overcome barriers to speedy 6 computing caused by slow memory retrieval. Id. ¶ 75. Without branch prediction, “a CPU that 7 sequentially executes instructions will encounter a conditional instruction – one dependent on a 8 value stored in memory,” and “must wait until that value is fetched from memory (which is 9 relatively slow to access) to continue execution.” Id. ¶ 76. Branch prediction gets around this 10 time lag by “predict[ing] what a program will likely do when the processor encounters a 11 conditional instruction (i.e., an instruction dependent on some in-memory value).” Id. ¶ 77. A 12 specific technique for implementing branch prediction is called “speculative execution,” which 13 Plaintiffs allege is “an inherent part of a modern CPU’s computation process” on which modern 14 CPU performance depends. Id. ¶ 82. Plaintiffs allege that speculative execution works as follows:

15 [F]aced with a conditional instruction – i.e., an instruction based on a 16 value that must be retrieved – a CPU guesses what the value will be instead of waiting for its retrieval from memory, and executes code 17 based on that guess. If, when the memory contents are fetched, the guess is incorrect, the CPU discards the “speculative” code. If the 18 guess was right, the CPU has already executed past the conditional instruction (e.g., conditional branch) without waiting, obviating the 19 need to wait for memory or system input/output to continue executing. 20 21 Id. ¶ 80. In short, speculative execution allows processors to “speculate on future instruction 22 directions and proactively execute instructions along these paths before knowing if the instructions 23 are correct,” and to deliver performance gains when the speculative instruction correctly matches 24 the value ultimately retrieved from the CPU memory. Id. ¶ 84. 25 But the guessed instructions – referred to as “transient instructions” – apparently must be 26 “completely cleared” from the CPU’s short-term memory after execution. Id. ¶ 83. A CPU’s 27 failure to flush transient instructions leaves “side effects” (i.e. lingering data) that can cause 1 fact that the privileged data retrieved from the CPU’s memory to facilitate instruction execution 2 can become accessible to and exploitable by other parts of the computer which should not have 3 that access to that privileged data if retained by the CPU. Id. ¶¶ 90, 95. 4 Plaintiffs allege that Defendant’s hardware design is defective in that “it fails to ensure that 5 side effects of [transient] instructions do not linger in various parts of the CPU accessible to the 6 running program.” Id. ¶ 89. Instead of properly flushing these instructions, Defendant’s CPUs 7 allegedly “cause the CPU’s cache to store memory information previously required by 8 speculatively executed code, meaning that even if the transient code is discarded, some data 9 remains in the CPU’s cache.” Id. ¶ 90. Additionally, Defendant’s CPUs supposedly also use 10 “instruction buffers, where transient code may store information associated with particular 11 instructions. Id. ¶ 91. Plaintiffs allege that Intel’s failure to “ensure that transient code is 12 prevented from making lingering changes to shared CPU resources” makes its CPUs vulnerable to 13 a class of attacks called transient execution attacks. Id. ¶ 92. 14 According to Plaintiffs, the CPUs’ susceptibility to this novel class of attacks was publicly 15 revealed in 2018, after researchers at Google identified vulnerabilities they dubbed “Spectre” and 16 “Meltdown.” Id. ¶ 97. Spectre and Meltdown are ‘“transient execution’ attacks, meaning that they 17 exploit the side effects of speculative code generated during speculative execution like branch 18 prediction.” Id. ¶ 101. Importantly, these vulnerabilities “can be exploited to steal sensitive data 19 present in a computer system’s memory.” Id. ¶ 98. And according to Plaintiffs, Spectre and 20 Meltdown were but two of a “larger class of vulnerabilities” arising from Defendant’s hardware 21 design of its branch prediction and segmentation systems. Id. ¶¶ 109, 115. 22 In response to the discovery of the Spectre and Meltdown attacks, Defendant deployed 23 software updates (or “patches”) to address the security vulnerability supposedly endemic to the 24 hardware. But according to Plaintiffs, Defendant’s mitigation “essentially handicapped the 25 functionality in Intel CPUs used to predict branches, to speculatively execute code, and to execute 26 code out of order.” Id. ¶ 120. Plaintiffs allege that Wired reported in March 2018 that “attempts to 27 disable [the vulnerability] at the software level can have a marked performance cost” – namely, 1 execution attacks, according to Wired, was to “physically replace all the chips, a change which will 2 take at least a full hardware generation to propagate.” Id. ¶ 119. Plaintiffs allege that Intel said it 3 would do just that: in a March 15, 2018 press release, Intel CEO Brian Krzanich allegedly 4 promised “a new hardware design in future chips to finally deal with the Spectre/Meltdown class 5 of vulnerability, including Spectre and Meltdown variants,” and indicated that design would be 6 incorporated into 8th generation chips by late 2018. Id. ¶ 126.1 7 Plaintiffs allege that “Intel’s 2018 hardware redesign to overcome Spectre and Meltdown 8 vulnerabilities would need to secure its [Advanced Vector Extension] instructions, along with 9 other attack vectors,” and that Intel knew that. Id. ¶¶ 134. As Plaintiffs explain, “[a] vector 10 instruction is a CPU instruction that can perform the same type of operations on multiple data 11 samples in a particularly efficient manner,” and is “central to the performance and function of any 12 high-end CPU.” Id. ¶¶ 131, 132.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Rutman Wine Company v. E. & J. Gallo Winery
829 F.2d 729 (Ninth Circuit, 1987)
United States v. Francisco Tello
9 F.3d 1119 (Fifth Circuit, 1993)
Manzarek v. St. Paul Fire & Marine Insurance
519 F.3d 1025 (Ninth Circuit, 2008)
Clemens v. DaimlerChrysler Corp.
534 F.3d 1017 (Ninth Circuit, 2008)
Kearns v. Ford Motor Co.
567 F.3d 1120 (Ninth Circuit, 2009)
Mendiondo v. Centinela Hospital Medical Center
521 F.3d 1097 (Ninth Circuit, 2008)
In Re Gilead Sciences Securities Litigation
536 F.3d 1049 (Ninth Circuit, 2008)
Birdsong v. Apple, Inc.
590 F.3d 955 (Ninth Circuit, 2009)
Sacramento Regional Transit District v. Grumman Flxible
158 Cal. App. 3d 289 (California Court of Appeal, 1984)
LiMandri v. Judkins
52 Cal. App. 4th 326 (California Court of Appeal, 1997)
Daugherty v. American Honda Motor Co., Inc.
51 Cal. Rptr. 3d 118 (California Court of Appeal, 2006)
Mocek v. Alfa Leisure, Inc.
7 Cal. Rptr. 3d 546 (California Court of Appeal, 2003)
American Suzuki Motor Corp. v. Superior Court
37 Cal. App. 4th 1291 (California Court of Appeal, 1995)
Merrill v. Navegar, Inc.
28 P.3d 116 (California Supreme Court, 2001)
Jimenez v. Superior Court
58 P.3d 450 (California Supreme Court, 2002)
Skye Astiana v. the Hain Celestial Group
783 F.3d 753 (Ninth Circuit, 2015)

Cite This Page — Counsel Stack

Bluebook (online)
Smith v. Intel Corporation, Counsel Stack Legal Research, https://law.counselstack.com/opinion/smith-v-intel-corporation-cand-2024.