11–20 of 64 posts
Whether they were last to be in the know or not, i applaud them for being one of the first to have patches out for their latest two stable releases (7.2 and 7.3).
OpenBSD only implemented loading AMD firmware two days after AMD published updated microcode to fix Zenbleed. Which makes me believe they were not among the "major kernels", vendors or other entities that got a heads up of this vulnerability which happened over two month prior. Whether they were last to be in the know or not, i applaud them for being one of the first to have patches out for their latest two stable re…
Worth re-posting Theo's 2007 note about CPU security bugs again: https://marc.info/?l=openbsd-misc&m=118296441702631&w=2 My hunch is that as they suspected these types of issues is what guided them away from things like AVX and other optimizations.
Earlier quoted context omitted.
OpenBSD is not a fast system.
Nor does it needs to. Safety is better than performance anyway
They've shipped several RCEs over the years, in software included in base, but because the software is not enabled by default they don't update their security slogan.
It gives the impression of an OS that is free of vulns which is not true. The "default install" is not useful for much as IIRC it only has ssh enabled which means their claim of only two remote holes in $time_period is really just a claim against their TCP/IP stack and OpenSSH, not the entire OS.
It's deliberately misleading.
My understanding was that Zenbleed code runs in userspace therefore it doesn't matter if kernel/libraries use AVX optimizations or not. That jab against Linux sounds like blame shifting and moving discussion away from the fact that OpenBSD did not offer microcode update at all.
For data to be exfiltrated through this exploit, the sensitive data must first be loaded into an AVX register. On GNU/Linux this happens all the time, because strcmp et al use AVX. On OpenBSD this is not the case, so only applications that themselves are loading sensitive data into AVX registers would be vulnerable.
Anyway, OpenBSD users have the new microcode now, while most Linux users don't (I checked Arch, Fedora and Ubuntu, none of them has updated their packaging yet).
OpenBSD only implemented loading AMD firmware two days after AMD published updated microcode to fix Zenbleed. Which makes me believe they were not among the "major kernels", vendors or other entities that got a heads up of this vulnerability which happened over two month prior. Whether they were last to be in the know or not, i applaud them for being one of the first to have patches out for their latest two stable re…
Don't know if it was still the case, but OpenBSD would not get early vuln info because they wouldn't sit on embargoes and would patch right away.