31–40 of 137 posts
How does one patch a CPU? Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly? Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: https://suppor…
How does one patch a CPU? Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly? Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: https://suppor…
https://wiki.debian.org/Microcode The real news here is that Intel thinks they can fix this via microcode. This is surprising because initially there were some strong arguments that this wouldn't be possible.
I thought they already provided a microcode update?
Latest version on downloadcenter.intel.com is 20171117; no microcode update has been published since Spectre/Meltdown have been disclosed. edit: see below, not true; they haven't published it on their own site but have pushed microcode updates to redhat.
Seems to be taken from redhat updates. It's floating around unseriously in debian unstable instead of being a security update, I guess Debian's FOSS imperative doesn't mix so well with non-free (intel-microcode) updates.
> Anyway, uploading a partial, unofficial set of updates to unstable to close the bug. Several processors are still missing. I expect an official release from Intel soon, hopefully with updates for everything.
> Implements IBRS and IBPB support via new MSR (Spectre variant 2 mitigation, indirect branches). Support is exposed through cpuid(7).EDX.
> LFENCE terminates all previous instructions (Spectre variant 2 mitigation, conditional branches).
What I'm worried about is that it will be hard to avoid these security patches when you don't need them. Say you have a non-virtualized, non-shared server that only runs your own trusted code. I don't want to be forced to pay the performance penalty but it might be unavoidable without resorting to maintaining your own linux fork.
> Intel has already issued updates for the majority of processor products introduced within the past five years. By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years
It's also unclear what they mean by "introduced within" Does it mean when the product was first developed? First on sale? If I bought a new computer 3 years ago what is the likely-hood that it's CPU was "introduced" much earlier?
Earlier quoted context omitted.
Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho. EDIT: There are microcode updates included in the OS updates: https://access.redhat.com/articles/3311301
I don't think that's the case. They're patching the issue in CPU microcode.
What I'm worried about is that it will be hard to avoid these security patches when you don't need them. Say you have a non-virtualized, non-shared server that only runs your own trusted code. I don't want to be forced to pay the performance penalty but it might be unavoidable without resorting to maintaining your own linux fork.
Not saying that there isn't a scenario where it would be ok to turn that off, but it's the exception.
Any guesses as to which vulnerabilities they're going to patch? Some of them? All of them?
I wonder what will the next big security hole. I'm becoming very pessimistic about how I can trust computers. Computers can do amazing thing, but software seems fragile, unreliable and untrustworthy. I have been keeping notes on paper for years now, and it doesn't look like it's going to change.
This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any OS that isn't Windows, MacOS or mainline Linux), that work is ongoing and will depend on the OS. (Speaking for SmartOS/illumos, that work is reasonably far along and making promising progress -- but we don't yet have a functional prototype.) As for Spectre, thes…
EDIT: thanks for the update (or did I misread earlier?).