Meltdown/Spectre: Unauthorized Disclosure of Kernel Memory

[PrSo]

[greyspoke]

So if AMD and ARM are affected by spectre, does that mean it exposes a flaw in the instruction set they are implementing? Or is there some shared code with a flaw in it?

[gengreen]

I was informed on this in freenode #musl

As far I understand, there is 2 vulnerability :


https://meltdownattack.com

Metldown : a security patch is available at https://github.com/IAIK/KAISER/tree/master/KAISER
Spectre : There is nothing available to prevent this vulnerability.

I had a hard feeling against intel since the story with Grsecurity, now I definitively ban intel (and all thing associated with this garbage corporate) from any future purchase.

Happy new year

Edit :

[Tsigorf]

[Myu]

[gengreen]

[yamabiko]

Is it possible to provide a patch for the current stable gentoo-sources? Manually patching it on 4.9.72 gives me an hunk fail.

[limn]

Monocultures are always bad.

[sligo]

While i understand the problem, i am still a little confused. Is there something that can be done already?

[Tsigorf]

There is a kernel patch for Linux you can apply to avoid Meltdown (the Kaiser patch set you can find here: https://lwn.net/Articles/738975/).

However for Spectre, that's an hardware issue. I don't even know if there's a way to patch our CPUs. That's why they're telling us to replace hardware.

[1clue]

[The Main Man]

Smells like a ploy to buy new hardware which will then have serious backdoors and kill switches.

[Watcom]

Spectre needs:

• A "victim" program which accepts input provided by the attacker (i.e. from the network or file). This input tricks the program to fetch cache lines based on data that is "secret".
  
  
• A program running in the same processor, devised by the attacker, to collect the "secret" data by measuring the time it takes to fetch data from its own addressing space that uses the same cache lines. Fast access means the data was cached, slow means it wasn't. From this alone the secret data can be inferred by seeing which bytes of an array are fast and which are slow (e.g. first byte being fast means 'A', second byte fast means 'B' and so on. Not exactly this simple but it's the basic idea).
  

So as you can see not running untrusted code goes a long way in preventing Spectre attacks.

[EasterParade]

(?)

[PrSo]

This is ridiculous.
I have also QNAP NAS with intel celeron on-board - (ts-251), and waiting to upgrade a firmware.

Maybe it is an exception narrowed to Ivy Bridge but KAISER patch (PTI) BRAKES kernel.

https://lkml.org/lkml/2018/1/3/864,

and

https://lkml.org/lkml/2018/1/3/105

Should I turn it off, cut of from internet and let it work only locally??

[Tony0945]

[sligo]

[Naib]

[Myu]

[gengreen]

[pjp]

[Watcom]

[toofied]

[Myu]

[Naib]