81–90 of 186 posts
> If you rely on any other kernel tree other than 4.4, 4.9, or 4.14 right now, and you do not have a distribution supporting you, you are out of luck. So, if you are running a (still supported) Debian Jessie a simple apt-get upgrade isn't gonna cut it:-(
What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model. Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this…
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip , the so-called microcode , that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW). Firmware update…
I use AWS instances (multi-tenant). I understand that by now AWS hypervisors have been patched. Does that fully protect my unpatched AWS instances from this CPU-level issues? If not, is there any way to protect my AWS instance from a rogue unpatched attacker instance running on the same hypervisor? In other words, with the current CPUs deployed at AWS, will it be possible for an attacker to simply launch an unpatched…
Earlier quoted context omitted.
Thanks. So apparently, my system: Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-104-generic x86_64) is unpatched! Is it because of LTS version? Most servers run this including mine.
Ubuntu say they will release a patch on or before the 9th of January. They got caught out by the embargo being ended early.
From my cursory reading I understand it is a cleverly orchestrated timing attack. In other words, if something would need 500 picoseconds you have bit 1, if it is 250 picoseconds instead it is bit 0 (numbers pulled out of thin air). This is made possible because processors execute the read speculatively even if it is actually forbidden. This read causes a cache hit. Of course the read is never brought into effect bec…
It is also worth understanding the differences between Spectre and Meltdown, since they are distinct. Spectre refers to reading process memory via measuring cache timing after speculative execution. Meltdown, in conjunction, refers to the fact that Intel CPUs do not verify access rights to a virtual address until after the speculative execution (and thus the cache hit) takes place. Meltdown allows bypassing page permissions so you can read any page mapped in your virtual address space. Spectre is 'limited' to only reading addresses you already have access too.
What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model. Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this…
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip , the so-called microcode , that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW). Firmware update…
Of all of my computers only one has been issued a BIOS update so far. I ran the PowerShell script before and after installing the BIOS. Installing the BIOS flipped the status of the fix for CVE-2017-5715 to on.
I also ran the free HwInfo utility that will show the microcode revision before and after installing the Windows update and before and after installing the BIOS. It only ever changed with the BIOS update.
I hope this changes and Windows does start updating CPU microcode. I also have a few older motherboard's that aren't likely to ever see a BIOS update again.
And that made me asking how Red Hat (and the free derivative CentOS) could have already patched their current kernel (on Jan 4th) while the patch was still being discussed on kernel ML the same day?
I don't see how they could come up with new kernel with mitigation for the three variants, excellent KB articles on the CVEs, tunables flag, preliminary performance test, etc. without having already patches implemented and tested for some time.
Do they have internal kernel devs? And so, do Redhat have another implementation?
(This is my first comment on HN, I hope I'm following adequately the guidelines)
Reading between the lines, it seems this is a pretty colossal fuckup by Intel; both in terms of the bug but especially how it was handled.
* http://lists.dragonflybsd.org/pipermail/users/2018-January/3... (https://news.ycombinator.com/item?id=16084641)
* https://medium.com/@frankycaron/this-week-in-words-the-langu... (https://news.ycombinator.com/item?id=16075588)
* http://www.theregister.co.uk/2018/01/04/intel_meltdown_spect...
One of them you might have expected to use the word "fuck", but actually did not. (-:
* https://lkml.org/lkml/2018/1/3/797 (https://news.ycombinator.com/item?id=16066968)
In part, this was down to the cat being let out of the bag early.
I'm not a tech expert at all, could you give an info please?
I've run this test and it's positive : https://repl.it/repls/DeliriousGreenOxpecker
Does it mean that a website with this kind of script can access all of my browser session? For instance, if I log in to my bank account, then I logout and about 10 minutes after I visit an evil website. Could evil website retrieve the URL of my bank account + the credentials?
Also, is there a POC that can display all browser history?
Thanks.
Earlier quoted context omitted.
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip , the so-called microcode , that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW). Firmware update…
Windows, at least for right now, does not seem to be updating CPU microcode during boot. If you run the PowerShell Get-SpeculationControl script that gives you the status of the updates it states that the CVE-2017-5715 fix requires hardware support. If you don't have it you are told to get a BIOS update from your OEM. WIthout it, the status for CVE-2017-5715 is listed as not enabled due to missing hardware support. O…