Meltdown Update Kernel doesnt boot • Hacker News Board

Re: Meltdown Update Kernel doesnt boot

#151

Post by taivare » Thu, Jan 11, 2018, 5:03 AM UTC

JonRB wrote: post #5

ask098 wrote: post #2

it's the fault of Intel, why don't they recall all the CPU? just like vehicle company

Doesn't this affect all of their CPUs going a long way back? And how do you recall embedded or laptop CPUs, which are often soldered in-place? A recall would be great, but there's no way they'd be able to do it. Vehicle recalls are a bit different because they impact physical safety. Digital safety doesn't get the same priority.

Someone on Twitter had the last safe cpu that Intel made it was date stamped 92'-93' he was asking a Bitcoin for it!

Re: Meltdown Update Kernel doesnt boot

#152

Post by jnordwick » Thu, Jan 11, 2018, 5:20 AM UTC

nykolasz wrote: post #130

Waiting a few days to patch my own servers... Not sure what is more dangerous right now: applying these rushed patches or the vuln itself.

Unless you are running remote code there is no reason to patch.

Re: Meltdown Update Kernel doesnt boot

#153

Post by chrisper » Thu, Jan 11, 2018, 5:48 AM UTC

jnordwick wrote: post #152

nykolasz wrote: post #130

Waiting a few days to patch my own servers... Not sure what is more dangerous right now: applying these rushed patches or the vuln itself.

Unless you are running remote code there is no reason to patch.

This is wrong and bad advice. All you need is a remote code execution vulnerability in PHP or so.

Only don't patch if your server is isolated and not connected to the internet.

Re: Meltdown Update Kernel doesnt boot

#154

Post by topmonk » Thu, Jan 11, 2018, 5:49 AM UTC

gkya wrote: post #20

Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks.

I would think it would be. The strange thing is the markets didn't react at all. They actually went up on January 4th.

Re: Meltdown Update Kernel doesnt boot

#155

Post by Santosh83 » Thu, Jan 11, 2018, 5:59 AM UTC

topmonk wrote: post #154

gkya wrote: post #20

Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks.

I would think it would be. The strange thing is the markets didn't react at all. They actually went up on January 4th.

Because this has largely remained theoretical, unlike Maersk or Equifax.

Re: Meltdown Update Kernel doesnt boot

#156

Post by semi-extrinsic » Thu, Jan 11, 2018, 6:00 AM UTC

ggm wrote: post #58

gkya wrote: post #20

Would this entire Meltdown/Spectre thing count as the biggest mess-up of computing history? When yesterday the PoC repo was posted here, the spy.mp4 demo video gave me some chills. And now I can't update my OS before making an installation USB because Canonical can't just follow Linus' releases. Thanks.

"biggest" by number of affected CPUs? very possibly, yes. the march of time has that effect: there are more cpus potentially and actually affected, worldwide, than at any other time in history. "biggest" by net financial loss to a single entity? I dunno. How much did that failed NSA launch cost the state again?

It's unclear whether it failed or if Northrop Grumman want us to think it failed; since the second stage actually did one full orbit with nominal performance, they might be trying to slip one past us. We'll know in a few weeks time I suppose, every satellite tracking enthusiast will be looking for it.

Re: Meltdown Update Kernel doesnt boot

#157

Post by nitrogen » Thu, Jan 11, 2018, 6:10 AM UTC

chrisper wrote: post #153

jnordwick wrote: post #152

Earlier quoted context omitted.

Unless you are running remote code there is no reason to patch.

This is wrong and bad advice. All you need is a remote code execution vulnerability in PHP or so. Only don't patch if your server is isolated and not connected to the internet.

RCE is already kind of game over though. If you have RCE on the server, you can probably get to everything interesting without having to go through a slow side channel.

Re: Meltdown Update Kernel doesnt boot

#158

Post by gphreak » Thu, Jan 11, 2018, 6:21 AM UTC

lathiat wrote: post #145

trendia wrote: post #61

(Copying my instructions from another post). If kernel 4.4 doesn't work, I recommend compiling the 4.15 kernel. (Note, however, that you may need to apply a patch to NVIDIA drivers). I've done this on Ubuntu 16.04 LTS, 17.10, and Debian 8 so far this week. To compile, set CONFIG_PAGE_TABLE_ISOLATION=y. That is: sudo apt-get build-dep linux sudo apt-get install gcc-6-plugin-dev libelf-dev libncurses5-dev cd /usr/src w…

I wouldn't really recommend doing this, but if you really want to do this, it would probably be easier just to use the pre-spun mainline kernels: https://wiki.ubuntu.com/Kernel/MainlineBuilds

Exactly, and use 4.14. According to a recent comment from a kernel dev both kernels use the same patch approach. 4.4 and 4.9 are using a different approach that’s less ideal, less complete and apparently less tested.

Re: Meltdown Update Kernel doesnt boot

#159

Post by jnordwick » Thu, Jan 11, 2018, 6:25 AM UTC

chrisper wrote: post #153

jnordwick wrote: post #152

Earlier quoted context omitted.

Unless you are running remote code there is no reason to patch.

This is wrong and bad advice. All you need is a remote code execution vulnerability in PHP or so. Only don't patch if your server is isolated and not connected to the internet.

If you have a remote exploit, there are much bigger issues to worry about. And since this is a timing issue, I'm not even sure that would be enough.

Re: Meltdown Update Kernel doesnt boot

#160

Post by gphreak » Thu, Jan 11, 2018, 6:27 AM UTC

snuxoll wrote: post #149

nykolasz wrote: post #130

Waiting a few days to patch my own servers... Not sure what is more dangerous right now: applying these rushed patches or the vuln itself.

What distro are you running? I trust Red Hat to get kernel updates right the first time, I just patched externally facing servers and systems that handle PHI tonight with no issues (outside of one of my PostgreSQL servers showing a non-neglible increase in CPU usage, damnit Intel). Of course, I also go into any updates with a rollback plan. ITIL sucks, but one thing it taught me was the value of well documented plans…

Same. RHEL/CentOS went without a hitch. The age of the kernel start’s to concern me, though.

According to the top comment in one of the posts in HN even 4.9 and 4.4 use a less ideal patch: https://news.ycombinator.com/item?id=16085672

I can’t really judge how much RH engineers are capable of fixing that kind of stuff in a kernel that’s officially out of support upstream.

Based on the general quality of RHEL/RHV I trust them to do the right thing, but I have no insight whatsoever in how kernel development actually works.