Earlier quoted context omitted.
What is the expected outcome if its patched vs. not? I am getting: fpu_exception : yes
I was wrong
fpu_excePTIon
Meltdown and Spectre Linux kernel status
31–40 of 186 posts
Re: Meltdown and Spectre Linux kernel status
#32I'm out of the loop but I heard it's the white hat hackers who exposed the flaw (probably they were at Google?).
Is the exposition carefully publicized so the flaw is not exploitable by malicious hackers?
Or does Project Zero expose everything, and a malicious hacker can read it and create code that spreads over the internet to harm computers?
I hope it's not the second case because that should cause global panic.
Re: Meltdown and Spectre Linux kernel status
#33Someone please correct me if I'm wrong, but both spectre and meltdown seem to me to be local root exploits, not remote vulns. They can be used to break out of (say) a VM into the host hypervisor, and thence into other VMs running on the same hardware, but cannot be used to break into a machine from outside its hardware perimeter. Is that right?
Essentially yes, the exploits require code running on the machine that’s attacked. However, for example JavaScript runs on the local machine and is a demonstrated attack vector.
It’s also strictly speaking not a privilege escalation, it’s “see things you’re not supposed to.”, such as all sorts of secrets. The attacker does not gain any write or execution privileges, though.
Re: Meltdown and Spectre Linux kernel status
#34Earlier quoted context omitted.
What is the expected outcome if its patched vs. not? I am getting: fpu_exception : yes
I was wrong
I currently have the following system (up-to-date):
Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-104-generic x86_64)
sudo cat /proc/cpuinfo | grep pti
fpu_exception : yes
Re: Meltdown and Spectre Linux kernel status
#35Earlier quoted context omitted.
You should see "pti" on the "flags" line of /proc/cpuinfo. You apparently don't, so you don't have page table isolation.
No, he shouldn’t be seeing that regardless as it doesn’t match the grep regex. I don’t know what, though. Edit: facepalm. Or should that be foot-in-mouth?
It does match the regex. "pti" is a substring in "exception"
Re: Meltdown and Spectre Linux kernel status
#36What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model.
Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this machine's life?
BTW, my machine is just a normal desktop/laptop, so no server stuff running or expected.
Re: Meltdown and Spectre Linux kernel status
#37Earlier quoted context omitted.
Right - for desktop use though, there are Firefox and Chrome updates with mitigation. JavaScript exploits were the most dangerous desktop scenario. For servers running Ubuntu, what is the risk, as long as my services don't run arbitrary user uploaded executables? As far as I can tell it is that a different remote code execution exploit can now read the entire memory, possibly leaking secrets. Assuming we have a kerne…
I think it's naive to think you're completely protected just because code isn't supposed to ever run. It seems as though the simplest and safest piece of mind is to use some extra layers of protection ala SELinux. This won't stop the memory from being accessed, but it has a better chance of stopping things that can exploit the bug(s) in the first place. Revoking TLS certs is probably a little bit on the side of paran…
It’s naive to assume that your system is perfectly secure in preventing unauthorized code from running. But that’s just in general.
He is right, though. It would take two vulnerabilities to pwn him: one allowing remote code execution and then another (Spectre/Meltdown) to gain access to privileged data that shouldn’t be available in that context.
Too many machines put on too many hats. A single (physical) “secure” server should do as little as possible and run as small a codebase as possible. And never run - sandboxes or otherwise - code that isn’t authorized.
We seem to be forgetting that in all this. If you only run code you trust, you are safe. This can only happen if you run in trusted code on your machine. We’ve taken running untrustworthy code in a “sandboxed” environment to mean “not running untrusted code, when it’s totally not the case.
Re: Meltdown and Spectre Linux kernel status
#38With so much going on - is there a way in linux to know whether my system is patched or not? Similar to the powershell script for Windows?
A number of ways are listed here [1] 1. With dmesg dmesg -wH | grep 'page tables isolation' 2. With /proc/cpuinfo grep cpu_insecure /proc/cpuinfo && echo "Patched" || echo "Unpatched!" [1] https://askubuntu.com/questions/992137/how-to-check-that-kpt...
Thanks. So apparently, my system:
Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-104-generic x86_64)
Re: Meltdown and Spectre Linux kernel status
#39Earlier quoted context omitted.
HTTPS should be expected by now - ISPs keep messing with my unencrypted traffic.
Then you should get yourself a different ISP or a VPN.
This is an extremely easy thing to say for many people around the world.
But for a large number of people - Americans, folks in countries with monopolies or state manipulation of internet traffic - it is not.
Not everyone has a different ISP to choose from. VPNs are a risky proposition and can significantly reduce bandwidth and increase latency.
Re: Meltdown and Spectre Linux kernel status
#40With so much going on - is there a way in linux to know whether my system is patched or not? Similar to the powershell script for Windows?
A number of ways are listed here [1] 1. With dmesg dmesg -wH | grep 'page tables isolation' 2. With /proc/cpuinfo grep cpu_insecure /proc/cpuinfo && echo "Patched" || echo "Unpatched!" [1] https://askubuntu.com/questions/992137/how-to-check-that-kpt...
I like
dmesg -H | grep 'page tables isolation'