Skip to main content

Massive Vulnerability Resulting In Meltdown and Specter Attacks

I planned to update Arch every 10 days but since updating some 3 days ago, news of a massive vulnerability in the chip processor all computers use came out. There are two demonstrated attacks called Meltdown and Specter. So let me use the language of the OpenSuse security patch email here to explain what these are.


CVE-2017-5753 / "SpecŧreAttack": Local attackers on systems with modern

     CPUs featuring deep instruction pipelining could use attacker
     controllable speculative execution over code patterns in the Linux
     Kernel to leak content from otherwise not readable memory in the same
     address space, allowing retrieval of passwords, cryptographic keys and
     other secrets.

     This problem is mitigated by adding speculative fencing on affected code
   paths throughout the Linux kernel.


   - CVE-2017-5715 / "SpectreAttack": Local attackers on systems with modern
     CPUs featuring branch prediction could use mispredicted branches to
     speculatively execute code patterns that in turn could be made to leak
     other non-readable content in the same address space, an attack similar
     to CVE-2017-5753.

     This problem is mitigated by disabling predictive branches, depending
     on CPU architecture either by firmware updates and/or fixes in the
      user-kernel privilege boundaries.

     Please also check with your CPU / Hardware vendor on updated firmware
     or BIOS images regarding this issue.

     As this feature can have a performance impact, it can be disabled using
   the "nospec" kernel commandline option.


   - CVE-2017-5754 / "MeltdownAttack": Local attackers on systems with modern
     CPUs featuring deep instruction pipelining could use code patterns in
     userspace to speculative executive code that would read
     otherwise read protected memory, an attack similar to CVE-2017-5753.

     This problem is mitigated by unmapping the Linux Kernel from the user
   address space during user code execution, following a approach called
   "KAISER". The terms used here are "KAISER" / "Kernel Address Isolation"
   and "PTI" / "Page Table Isolation".

     Note that this is only done on affected platforms.

     This feature can be enabled / disabled by the "pti=[on|off|auto]" or
   "nopti" commandline options.

Linux distros have pushed patches so I'm doing an update today. I'm updating my mirrors first with.

$ reflector --latest 8 --protocol https --sort rate --save /etc/pacman.d/mirrorlist

Then I update my system with --

$ pacman -Syu

I should be receiving the same patch that OpenSuse pushed to their users.

Comments

Post a Comment

Popular posts from this blog

Mailvelope, Encryption for Webmail

Encryption is the topic of week. I wrote about it in a related post here. While encryption is a very good idea, doing it and doing it every day as part of your work flow is another thing. My view is that if you're already using an email client then it is easier, simpler and more convenient to adopt encryption. That is not the case if you're using a webmail service. If you are using the browser to check, compose and send your email, what are your options? The answer is: it's complicated. Looking for a way to do encryption with Google Chrome and Gmail, I found this. I also read that Google just released code for email encryption as open source. But it's a long way to being used by end users. The extension for Google Chrome works fine if the recipient also uses Google Chrome. But I went ahead and check this on Evolution.
Post a Comment
Read more

Donald Trump Is The 45th President of the United States

     and he is preparing to move with his transition team into the Oval Office. His election is a shock to many political observers and the world in general. Donald Trump, the president-elect, ran against Hillary Clinton, former Secretary of State and for many the most qualified candidate for the presidency in many years. This has led to many post election analysis of how this upset happened. The numbers of votes for each candidate and the comparisons with previous presidential elections point to the fact that the white vote for Mr. Trump is solid all throughout but the minority and black votes did not come for Mrs. Clinton. This is what happened in crucial States like Michigan and Florida. The Republicans kept Congress and the Senate. It is quite notable that Russia and in particular, Vladimir Putin, is happy that they are going to talk to Mr. Trump rather than Mrs. Clinton. It is also a ...
Post a Comment
Read more

Webapps in Unity

So it has been 4 months since Ubuntu 14.04 came out. This is LTS and supported for 6 years by Canonical. The first mobile device with Ubuntu pre-installed is promised to come out later this year, 2014. It's time to check out how the apps perform so far. It is a good idea. I use Gmail and Twitter and Facebook. Why not a webapp in a desktop? So I start the Twitter and Gmail webapp. So far it has crashed my computer 6 times. Not a very good sign. On the other hand it does work but not as stable as opening them in Firefox. -- Use my PGP key if you want to encrypt your replies/messages to me. You are invited to also send me your PGP keys so we can communicate in private.
Post a Comment
Read more