.neversaynever wrote:...
Ubuntu backported PCID support along with PTI to their patched 4.4 and 4.13 kernels
.smurphos wrote:...
Note, still timing based, and as such as effectively mitigated through current browsers/JavaScript engines denying high-resolution timer access to "active content" as the original exploits are: those of us not in the habit of explicitly downloading and running exploits may remain unconcerned.
... whom in the context of my reply one up makes the point that by simply repeating the timing-based inferral for a given memory location enough times you can get past any timer resolution limit that's been set; that as such disallowing access to high-resolution timers is not a fundamental or even necessarily practically effective solution. Hadn't noticed but that's obviously true. Personally I still postpone running around screaming but, well, yes, certainly that point means the issue's not fully removed from the "malicious active content" context simply by using current browsers.
Nor should anyone. Meltdown is first of all fully solved by KPTI: if you are running a current kernel (or have an AMD processor) you are not affected by Meltdown.
Actually, the 14-28 year old segment (I thought Facebook had a 14 year old limitation...rene wrote: ⤴Fri Feb 16, 2018 4:01 pmNor should anyone. Meltdown is first of all fully solved by KPTI: if you are running a current kernel (or have an AMD processor) you are not affected by Meltdown.
By Spectre you are in theory but the actually important part of that is as far as I'm aware as fully solved by either retpoline or CPU microcode updates (both of which may still need to make it down to you) in the sense of restoring full privilege separation of user- and kernel addressspace. What fundamentally remains concerns multiple untrusted VM situations and the like: very applicable to hosting providers but not so much to you or me.
This, moreover, is while Spectre exploits are quite involved to begin with; proof of concept code is out there but as far as I know no actual exploits or even attempts at exploit have been observed in the wild. If they were they, moremoreover, would be unlikely to target Linux rather than Windows. And certainly given that, moremoremoreover, getting an exploit delivered to you on Linux is itself quite involved: full-blown Linux malware is for all intents and purposes non-existent and while not solved as per above, current browser vigilance mitigates dynamic content worries.
"Friends don't let friends do Facebook" or whichever other primary source of malicious content is popular among 14 year olds this month but other than that I'd advise anyone here to not worry about any of it.
) is abandoning FaceBook in droves. Code: Select all
Spectre and Meltdown mitigation detection tool v0.35
Checking for vulnerabilities on current system
Kernel is Linux 4.13.0-36-generic #40~16.04.1-Ubuntu SMP Fri Feb 16 23:25:58 UTC 2018 x86_64
CPU is Intel(R) Core(TM) i5-2430M CPU @ 2.40GHz
Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: NO
* CPU indicates IBRS capability: NO
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: NO
* CPU indicates IBPB capability: NO
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: NO
* CPU indicates STIBP capability: NO
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: NO
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): NO
* CPU microcode is known to cause stability problems: NO (model 42 stepping 7 ucode 0x29)
* CPU vulnerability to the three speculative execution attacks variants
* Vulnerable to Variant 1: YES
* Vulnerable to Variant 2: YES
* Vulnerable to Variant 3: YES
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel has array_index_mask_nospec: NO
* Kernel has the Red Hat/Ubuntu patch: YES
> STATUS: NOT VULNERABLE (Mitigation: OSB (observable speculation barrier, Intel v6))
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Mitigation 1
* Kernel is compiled with IBRS/IBPB support: YES
* Currently enabled features
* IBRS enabled for Kernel space: NO
* IBRS enabled for User space: NO
* IBPB enabled: NO
* Mitigation 2
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
> STATUS: NOT VULNERABLE (Mitigation: Full generic retpoline)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)
A false sense of security is worse than no security at all, see --disclaimer
I hope not. It's grown into a monster thread.
michael louwe wrote: ⤴Wed Feb 07, 2018 5:50 am
... 32bit systems are only patched for Spectre 1, ie not yet patched for Meltdown and Spectre 2.
Hi Michael. Today I've found this: http://news.softpedia.com/news/canonica ... 9909.shtmlmichael louwe wrote: ⤴Fri Feb 09, 2018 5:20 pm @ neversaynever, .......
About Spectre 1 being pulled, please refer to ... https://lists.ubuntu.com/archives/kerne ... 89971.html = to implement the Retpoline feature for Spectre 2 in a new kernel, the Spectre 1 patch has to be pulled, modified and later re-released.
You'll have to wait; KPTI(-equivalent) has not been released into the wild for 32-bit yet. Won't take very long at this point: https://lkml.org/lkml/2018/2/9/98.neversaynever wrote: ⤴Thu Feb 22, 2018 1:10 pmIs there something else I can do to enable PTI and mitigate Meltdown on my 32-bit installation or do I have to wait for a new kernel update?
Thankyou very much rene. So it seems I have some hope ...rene wrote: ⤴Thu Feb 22, 2018 3:39 pmYou'll have to wait; KPTI(-equivalent) has not been released into the wild for 32-bit yet. Won't take very long at this point: https://lkml.org/lkml/2018/2/9/98.neversaynever wrote: ⤴Thu Feb 22, 2018 1:10 pmIs there something else I can do to enable PTI and mitigate Meltdown on my 32-bit installation or do I have to wait for a new kernel update?
