Meltdown/Spectre: Unauthorized Disclosure of Kernel Memory

[PrSo]

[Aiken]

[eccerr0r]

[Hu]

Regarding the lack of older microcode, there are several plausible innocuous explanations:

• Perhaps some of the affected systems do so much of the work in pure hardware that a microcode fix is impossible
• Perhaps the CPU's storage for microcode is too limited to accept the size increase that would come from augmenting the microcode with the fix. Since microcode is the dumping ground for all such fixes, it tends to grow over time, and rarely if ever shrink for a given CPU.
• Perhaps the environment to build the microcode has bitrotted, and the vendor is no longer able to produce microcode for that chip
• Perhaps the vendor has other projects that they consider higher priority (possibly even rightly so), so the people qualified to write the microcode fix are busy doing other work

[saboya]

[Aiken]

At least as far as meltdown goes even with the 32 bit user space I had expected meltdown to be dealt with using the an updated 64 bit kernel. I have one such system left. The checking tools not compiling under 32 bit does not help. This is a Prescott P4 and most of the checking I have done with it has been in a 64 bit chroot. I am getting mixed results. So far the Am-I-affected-by-Meltdown tool someone posted in this thread earlier has said it is safe no matter what kernel I have tried. Another tool looks for pti in the cpu cflags listed in /proc/cpuinfo. For me it is becoming academic as I am thinking time to retire that computer.

The core2 test box Am-I-affected-by-Meltdown gives the expected results depending on whether is booted with pti=on or pti=off.

Those sound like plausible reasons for no microcode update. I had taken the cynical approach and wondered how much of the decision was marketing with an arbitrary cut off date.
_________________
Beware the grue.

[PrSo]

New Intel microcodes:
https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File

and:

https://bugs.gentoo.org/show_bug.cgi?id=643794

[fedeliallalinea]

[fedeliallalinea]

[Spargeltarzan]

So in the microcode upgrade 2017-01-08 we can excpect microcodes as of 2017-11-16 in v2.2? Shouldn't it be 2017-01-08 as shown here? (When I click on my CPU it still shows 2017-01-08, but with the upgrade from today my microcodes become firstly upgraded to 2017-11-16. Crazy?

ADD: I have got an i7-6500U, Skylake, so I guess currently the 2017-11-16 is the latest in Gentoo Repos, but on Intel Page the 2018-01-08 is available. Hope it becomes available soon.

ADD: Output from spectre-meltdown-checker

[mike155]

[krinn]

Here are results on my testing:
the variant 1 : i don't have the fix for that yet.
the variant 2 : microcode has fix it
the variant 3 : KPTI should fix it (i have KPTI, but nothing to test it).

the spectre and update spectre-thread spoke earlier are variant1 (and yes, they do work flawlessly)
the meltdown earlier is variant2 : (with the microcode update it fail, without it, it work)
on my core2 using x86: variant1 test fail, variant2 test fail (i even cannot build them, but my corei2 as done the job with -m32)
i also prefer those two tools, because they don't check your security, they just try to abuse you : no need for a script telling me: ok your microcode is update if anyone could still fuck me with that microcode.

expect variant1 virus incoming
guys: i suppose we have to find those IBRS LFENCE ready kernel.

[blopsalot]

FYI : I''ve been testing Gentoo Hardened Profile devices using the following the projects and I don't see it working on processors reported as vulnerable on other distros, kernels predate the Page Table/Kaiser inclusion.

https://github.com/paboldin/meltdown-exploit
reports not vulnerable on all tested

https://github.com/IAIK/meltdown
this one says it finds the offset of KASLR (its wrong). inputting correct offset, the reliability test is .4% and I still cannot read values from ./secret

https://github.com/Eugnis/spectre-attack
this one works at default but i don't see it sucessfully reading anything else

[Aiken]

The 2 newer desktops (i7 700k) got microcode updates from both 20171117_p20171215-r1 and 20180108. Everything else is outside that 5 year limit.

Anyone been trying kvm on older hardware? On the core2 having kpti enabled in the guest is a killer. Timing a kernel compile I am getting

Host 11 1/2 - 12 minutes depending on booting with pti=on/pti=off
Host pti=off, guest pti=off 21 - 25 min
Host pti=on, guest pti=off 27 min
Host pti=on, guest pti=on 41 - 53 min

This is hw old enough to not have the pcid instruction. At least on the older hw can not say I am happy if kpti gets enabled in the guest.
_________________
Beware the grue.

[blopsalot]

[PrSo]

Hi krinn,

as for Spectre v1 IMHO it is to early to adapt those patches, this is still a WIP and not even in linus git tree yet.

Lately Fedora has adopted them and I suppose that RHEL too as mike155 sad, but from the mailing list - those patches have problems i.e. during build on arm:

https://www.spinics.net/lists/netdev/msg477230.html

As the first commit says this series can be found on github:

https://git.kernel.org/pub/scm/linux/kernel/git/djbw/linux.git/?h=nospec

[queen]

Hi Guys

With all the mess of the latest vulnerabilities, I decided not to upgrade the kernel and install all the new firmware, microcode etc. It's a totally waste of time, because the problem won't be solved anyway until they develop a new CPU(which will take around 5 years as a person from Intel told me). And definitely the performance will be affected. My question is how other packages will be affected?
What other packages might be affected (gcc)? emerge world? Normal programs will be affected?

[Spargeltarzan]

@ queen:

At least you can protect against Meltdown.

Further, I believe a Spectre upgrade which close this issue is possible. There are some performance test comparisons which differ from almost no hit to significant hit, let's wait a bit here. Desktop PCs might be less affected anyway.

All in all, do you have an alternative to upgrade currently, do you prefer abuse of your data?
_________________
___________________
Regards

Spargeltarzan

Notebook: Lenovo YOGA 900-13ISK: Gentoo stable amd64, GNOME systemd, KVM/QEMU
Desktop-PC: Intel Core i7-4770K, 8GB Ram, AMD Radeon R9 280X, ZFS Storage, GNOME openrc, Dantrell, Xen

[queen]

Well, I heard the lecture of Daniel Genkin (one of the authors of the paper) this week. He said spectre will haunt us for years. Furthermore, one of the greatest cpu architests that worked until recently at intel said that it needs a new design of cpu which will take 5 years. So don't be naive about spectre. I might consider applying kaiser. Unfortunately, our data is abused all over.

BTW, the person who worked at intel, told me that they designed about 10 years ago a cpu that would have resolved some of the issues that were presented now, but intel refused it because the performance was only 10% and intel wanted only performance. The guy is a genius.

[The Main Man]

Spectre and Meltdown aside, who knows what else is there that we don't know about.

[Myu]

Intel CPU's older than 5 years should get microcode security fixes : https://newsroom.intel.com/news-releases/security-first-pledge/

[eccerr0r]

[PrSo]

@ eccerr0r

[mike155]

The important word is "introduced" - and it was carefully chosen. It does not mean: "delivered" or "sold".

[Tony0945]