Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The mysterious case of the Linux Page Table Isolation patches

pythonsweetness.tumblr.com

Post reply on HN
Print view View original

41–50 of 264 posts

Re: The mysterious case of the Linux Page Table Isolation patches

#41

Post by mackal »

revelation wrote: post #22
saas_co_de wrote: post #13

Earlier quoted context omitted.

It sounds like Intel, Google and Amazon are hiding something. Wouldn't want customers thinking that cloud computing is fundamentally insecure now would we?

Well Intel for one manufactures the insecure CPUs.. This will be merged for 4.16, when there is no 4.15 release yet. No idea what your cloud computing companies run but it's not 4.15-dirty, and backporting this monster is a great recipe for a nightly emergency when it goes OOPS. edit: it isn't even merged yet.

Some of these patches are already on stable marked kernels. In fact, I'm already running them. There was also an issue where some different default GCC flags hardened gentoo uses was causing the kernel to not be able to boot.

Re: The mysterious case of the Linux Page Table Isolation patches

#42

Post by nobody987 »

chillydawg wrote: post #24
nobody987 wrote: post #12

AWS had scheduled maintenance requiring reboot of all EC2 instances in December. Maybe this is somehow related.

It wasn't all instances. Only one of mine needed a reboot.

In my case the reboot was scheduled for most (if not all) EC2 and RDS instances.

Re: The mysterious case of the Linux Page Table Isolation patches

#43

Post by [deleted] »

hujji wrote: post #40
userbinator wrote: post #20

IMHO, with RowHammer, the hardware is broken and it will continue to be broken until users complain enough --- maybe to the point of absolutely refusing to buy --- that the manufacturers and designers stop thinking "works 99.9999999999% of the time" is good enough: https://news.ycombinator.com/item?id=12410274

The current miniaturization of DRAM circuitry doesn't really allow for a hardware fix for the RowHammer attack. During DRAM manufacturing a test similar to the RowHammer attack exists. This test has certain bounds for passing. If the bounds were tightened up to the level of perfection to prevent the attack it would drop the yield a considerable amount.

[deleted]

Re: The mysterious case of the Linux Page Table Isolation patches

#46

Post by yjh0502 »

john_moscow wrote: post #45

>public NT kernels from as early as November have begun to implement the same technique. Does the author refer to ReactOS, or has Microsoft really open-sourced parts of the NT kernel?

I seems that someone discovered KASLR from NT kernel. https://twitter.com/aionescu/status/930412525111296000

Re: The mysterious case of the Linux Page Table Isolation patches

#47

Post by userbinator »

hujji wrote: post #40
userbinator wrote: post #20

IMHO, with RowHammer, the hardware is broken and it will continue to be broken until users complain enough --- maybe to the point of absolutely refusing to buy --- that the manufacturers and designers stop thinking "works 99.9999999999% of the time" is good enough: https://news.ycombinator.com/item?id=12410274

The current miniaturization of DRAM circuitry doesn't really allow for a hardware fix for the RowHammer attack. During DRAM manufacturing a test similar to the RowHammer attack exists. This test has certain bounds for passing. If the bounds were tightened up to the level of perfection to prevent the attack it would drop the yield a considerable amount.

If the bounds were tightened up to the level of perfection to prevent the attack it would drop the yield a considerable amount.

The fact that DRAM older than a few years is effectively immune to RH suggests it is possible to manufacture such. Yes, it will cost more, but I think many would be willing to pay for it like they used to, for none other than the assurance of having more reliable memory.

Re: The mysterious case of the Linux Page Table Isolation patches

#48

Post by Arainach »

Nano2rad wrote: post #38
saas_co_de wrote: post #13

Earlier quoted context omitted.

It sounds like Intel, Google and Amazon are hiding something. Wouldn't want customers thinking that cloud computing is fundamentally insecure now would we?

If it is hardware Microsoft also will be patching.

They did - the article mentioned it several times.

https://twitter.com/aionescu/status/930412525111296000

Re: The mysterious case of the Linux Page Table Isolation patches

#49

Post by jaccarmac »

The kernels for Gentoo have been all over the place for the past few weeks. I'm running 4.12 at the moment, then the repos updated to 4.14, which wouldn't build for me, so I waited a week for genkernel to modernize. When I came back 4.14 had been marked unstable and 4.12 was masked, making 4.9 the latest supported kernel. Seems that whatever is happening is a Big Deal.

Re: The mysterious case of the Linux Page Table Isolation patches

#50

Post by bloaf »

hujji wrote: post #40
userbinator wrote: post #20

IMHO, with RowHammer, the hardware is broken and it will continue to be broken until users complain enough --- maybe to the point of absolutely refusing to buy --- that the manufacturers and designers stop thinking "works 99.9999999999% of the time" is good enough: https://news.ycombinator.com/item?id=12410274

The current miniaturization of DRAM circuitry doesn't really allow for a hardware fix for the RowHammer attack. During DRAM manufacturing a test similar to the RowHammer attack exists. This test has certain bounds for passing. If the bounds were tightened up to the level of perfection to prevent the attack it would drop the yield a considerable amount.

Aren't some manufacturers better than others, though?

https://arstechnica.com/information-technology/2016/03/once-...

Post reply on HN