4 ms·

I'm trying to understand the timeline of everything that is going on. https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/ https:

I'm trying to understand the timeline of everything that is going on. https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/ https://cyber.wtf/2017/07/28/negative-result-reading-kernel-... was published on 2017-07-28. The pythonsweetness.tumblr.com post talks about patches being first posted in October (anyone have a link to the first public patch?). https://lwn.net/Articles/738975/ https://lwn.net/Articles/738975/ was published on 2017-11-15. https://lwn.net/SubscriberLink/741878/5c019c71457e0da6/ https://lwn.net/SubscriberLink/741878/5c019c71457e0da6/ was published on 2017-12-20. https://lkml.org/lkml/2017/12/27/2 https://lkml.org/lkml/2017/12/27/2 was published on 2017-12-27. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5aa90a84589282b87666f92b6c3c917c8080a9bf https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... shows that Linus merged the patches on 2017-12-30. https://lwn.net/Articles/742404/ https://lwn.net/Articles/742404/ was published on 2017-12-30. http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table http://pythonsweetness.tumblr.com/post/169166980422/the-myst..., which was the post that grabbed everyone's attention, was published on 2018-01-01. Was the blog post on 2017-07-28 talking about the same vulnerability that has the world on fire today, or are there multiple issues going on?

dmitrygr 9y ago
It was probably embargoed for a while, given how much fixing everyone need to do. Embargo has still not been lifted, but someone noticed and spilled the beans :)
blattimwind 9y ago
There's Xen XSA-253 with an embargo lift of 2018-01-04 12:00 (UTC) which some said might be related. edit: XSA-254 is about this, XSA-253 is still embargoed, so probably unrelated.
testplzignore 9y ago
https://twitter.com/lavados/status/948700783259811847 https://twitter.com/lavados/status/948700783259811847 gives credit to the cyber.wtf blog post for the "start of all this", though the replies to that tweet note that Jann Horn reported the vulnerabilities on 2017-06-01. So first private disclosure was on 2017-06-01, and first public disclosure was on 2017-07-28 as far as I can see. I'd love to someday see a book written about the history of this, starting from when the idea of speculative execution was first conceived decades ago.

dmitrygr 9y ago

It was probably embargoed for a while, given how much fixing everyone need to do. Embargo has still not been lifted, but someone noticed and spilled the beans :)

blattimwind 9y ago

There's Xen XSA-253 with an embargo lift of 2018-01-04 12:00 (UTC) which some said might be related. edit: XSA-254 is about this, XSA-253 is still embargoed, so probably unrelated.

testplzignore 9y ago

https://twitter.com/lavados/status/948700783259811847 https://twitter.com/lavados/status/948700783259811847 gives credit to the cyber.wtf blog post for the "start of all this", though the replies to that tweet note that Jann Horn reported the vulnerabilities on 2017-06-01. So first private disclosure was on 2017-06-01, and first public disclosure was on 2017-07-28 as far as I can see. I'd love to someday see a book written about the history of this, starting from when the idea of speculative execution was first conceived decades ago.