Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meltdown and Spectre Linux kernel status

kroah.com

Post reply on HN
Print view View original

51–60 of 186 posts

Re: Meltdown and Spectre Linux kernel status

#51

Post by chomp »

Santosh83 wrote: post #36

What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model. Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this…

Only kinda effective. Retpoline on Skylake and later isn't completely reliable as a mitigation for one of the spectre variants, and IBRS is one of the processor features that will supposedly correct that.

You'll still be vulnerable, it'll just add another layer of difficulty to the exploit.

Re: Meltdown and Spectre Linux kernel status

#52

Post by bonzini »

fizixer wrote: post #32

I'm out of the loop but I heard it's the white hat hackers who exposed the flaw (probably they were at Google?). Is the exposition carefully publicized so the flaw is not exploitable by malicious hackers? Or does Project Zero expose everything, and a malicious hacker can read it and create code that spreads over the internet to harm computers? I hope it's not the second case because that should cause global panic.

It's closer to the second, but:

1) the vulnerability is local, not directly tied to spreading as malware (but these days placing JavaScript in an ad is easier and possibly more effective than a virus...)

2) there is no such thing as "exposition carefully publicized so the flaw is not exploitable by malicious hackers". Just assume that black hats are as smart as white hats or smarter.

Re: Meltdown and Spectre Linux kernel status

#53

Post by cthalupa »

bhauer wrote: post #49
Santosh83 wrote: post #36

What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model. Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this…

I share your concern. Based on my admittedly loose understanding, although the Spectre vulnerability is "more difficult" to exploit, I suspect it's a matter of time before exploits become more common. And the Spectre vulnerability is the one that requires a BIOS/firmware update. So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironical…

>And the Spectre vulnerability is the one that requires a BIOS/firmware update.

One of the Spectre variants. The other isn't mitigated by it and will require an lfence on your sensitive areas of apps.

Re: Meltdown and Spectre Linux kernel status

#54

Post by Tuna-Fish »

lisper wrote: post #48
Xylakant wrote: post #33

Earlier quoted context omitted.

Essentially yes, the exploits require code running on the machine that’s attacked. However, for example JavaScript runs on the local machine and is a demonstrated attack vector. It’s also strictly speaking not a privilege escalation, it’s “see things you’re not supposed to.”, such as all sorts of secrets. The attacker does not gain any write or execution privileges, though.

> JavaScript ... is a demonstrated attack vector OMG, I didn't know that. Thanks.

JS as an attack vector can be effectively mitigated by denying access to high-precision timers (and a few features that can be used to construct high-precision timers). At least Chrome and Firefox are doing this, so just make sure that you are keeping your browser up to date.

If you feel paranoid, you might also want to disable JS by default and only enable by whitelist on any machines that hold particularly sensitive or valuable data.

Re: Meltdown and Spectre Linux kernel status

#55

Post by sigmar »

AaronFriel wrote: post #39
lisper wrote: post #23

Earlier quoted context omitted.

Then you should get yourself a different ISP or a VPN.

This is an extremely easy thing to say for many people around the world. But for a large number of people - Americans, folks in countries with monopolies or state manipulation of internet traffic - it is not. Not everyone has a different ISP to choose from. VPNs are a risky proposition and can significantly reduce bandwidth and increase latency.

Anyone that thinks ISPs don't mess with traffic, should check out this malware research

https://www.virusbulletin.com/conference/vb2017/abstracts/la...

Re: Meltdown and Spectre Linux kernel status

#56

Post by ihattendorf »

koenigdavidmj wrote: post #47
ComputerGuru wrote: post #41

This just reminded me: when will Ubuntu (and Debian?) fix apt’s broken kernel update process? I have never seen a kernel update - security or otherwise - installed via a normal “apt update; apt upgrade” on any of our machines, it’s always “the following updates have been held back” and then it’s time to manually use dpkg to install the relevant updates.

“apt full-upgrade” will upgrade everything. It may also remove packages to fix higher priority dependencies, though I’ve never seen this happen in real life.

Happened to me yesterday with my Proxmox host. It wanted to install firmware-linux-free, which conflicted with pve-firmware. It decided it wanted to remove pve-firmware which would also completely remove proxmox-ve... Had to upgrade with --no-recommends.

Re: Meltdown and Spectre Linux kernel status

#57

Post by weinzierl »

> If you rely on any other kernel tree other than 4.4, 4.9, or 4.14 right now, and you do not have a distribution supporting you, you are out of luck.

So, if you are running a (still supported) Debian Jessie a simple apt-get upgrade isn't gonna cut it:-(

Re: Meltdown and Spectre Linux kernel status

#58

Post by proginthebox »

xroche wrote: post #7
proginthebox wrote: post #2

The website serves JS and does not serve it over https, and discusses Spectre bug and how to patch it. I know he is the second most important guy on linux, but the irony.

And you probably know much better than the second most important guy on linux what security means on the Internet: securing some javascript script on a random blog.

It's not about that guy's blog. This causes desensitization to non-HTTPS traffic and when people then actually visit non-HTTPS malicious blog, they get infected. If all "trusted" websites were HTTPS, then whenever there was untrusted access, people will notice it and raise alarm.

Re: Meltdown and Spectre Linux kernel status

#59

Post by proginthebox »

dasil003 wrote: post #27
proginthebox wrote: post #2

The website serves JS and does not serve it over https, and discusses Spectre bug and how to patch it. I know he is the second most important guy on linux, but the irony.

I get the irony, but if you could magically visualize the entire internet security threat matrix, this would fall so far down the list and his other work is so high in terms of impact, that it would absolutely no sense for him to take even one minute away from his other activities to address this.

Yes, hence my question. I have tried to setup a HTTPS service and it seems incredibly complicated if you have your own domain name. Even with lets encrypt, if you are using github pages for hosting but your own custom domain, you are out of luck. The point is not that he is not serious about security, point is, it is too hard to get normal security correct. And I am not talking about "cryptography is hard". I am talking about tools which should be easy and standardized. Those are hard.

Re: Meltdown and Spectre Linux kernel status

#60

Post by rhizome »

bhauer wrote: post #49
Santosh83 wrote: post #36

What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model. Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this…

I share your concern. Based on my admittedly loose understanding, although the Spectre vulnerability is "more difficult" to exploit, I suspect it's a matter of time before exploits become more common. And the Spectre vulnerability is the one that requires a BIOS/firmware update. So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironical…

So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page

Buy stock in Gigabyte, MSI, etc.

Post reply on HN