4 ms·

Addendum for anyone still reading: - Intel issued a press release saying they planned to announce this next week after more vendors had patched their shit, whi

Addendum for anyone still reading: - Intel issued a press release saying they planned to announce this next week after more vendors had patched their shit, which lends me more cause to believe that the Xen bug might be the same one [1] - Intel claims in the same PR that "many types of computing devices — with many different vendors’ processors" are affected, so I'll be curious to see whether non-Intel platforms fall into the umbrella soon - macOS implemented partial mitigations in 10.13.2 and apparently has some novel ones coming up in 10.13.3 [2] - someone reasonably respected claims to have a private PoC of this bug leaking kernel memory [3] - ARM64 has KPTI patches that aren't in Linus's tree yet [4] [6] ([6] is just a link showing the patches from 4 aren't in Linus's tree as of this writing) - all the other free operating systems appear to have been left out of the embargoed party (until recently, in FBSD's case), so who knows when they'll have mitigations ready [5] - So far, Microsoft appears to have only patched Windows 10, so it's unknown whether they intend to backport fixes to 7 or possibly attempt to use this as another crowbar to get people off of XP 2.0 - Update: Microsoft is pushing an OOB update later today that will auto-apply to Win10 but not be forced to auto-apply on 7 and 8 until Tuesday, so that's nice [7] [1] - https://newsroom.intel.com/news/intel-responds-to-security-research-findings/ https://newsroom.intel.com/news/intel-responds-to-security-r... [2] - https://twitter.com/aionescu/status/948609809540046849 https://twitter.com/aionescu/status/948609809540046849 [3] - https://twitter.com/brainsmoke/status/948561799875502080 https://twitter.com/brainsmoke/status/948561799875502080 [4] - https://patchwork.kernel.org/patch/10095827/ https://patchwork.kernel.org/patch/10095827/ [5] - https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009651.html https://lists.freebsd.org/pipermail/freebsd-security/2018-Ja... [6] - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/arch/arm64?h=v4.15-rc6&qt=grep&q=kpti https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... [7] - https://www.theverge.com/2018/1/3/16846784/microsoft-processor-bug-windows-10-fix https://www.theverge.com/2018/1/3/16846784/microsoft-process...

johncalvinyoung 9y ago
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi... https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi... Seems that Google/Project Zero felt the need to go ahead and break embargo. Worth adding to the above list of news sources.
- victorhooi 9y ago
  No, that's not accurate. If you read the article you quoted: > We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation. The full Project Zero report is forthcoming (update: this has been published; see above). Just from public Gooogling, I believe it may have been the Register who tried to get in on the scoop, and broke the embargo: https://www.theregister.co.uk/2018/01/04/intels_spin_the_registers_annotations/ https://www.theregister.co.uk/2018/01/04/intels_spin_the_reg...
  - lmm 9y ago
    No-one necessarily broke the embargo. A blogger noticed unusual activity around a certain linux patchset and put two and two together, and the register mostly sourced from his article ( http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table http://pythonsweetness.tumblr.com/post/169166980422/the-myst... )
johncalvinyoung 9y ago
Also from the P0 blog post: Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch target injection (CVE-2017-5715) Variant 3: rogue data cache load (CVE-2017-5754) My checking doesn't show any of those three explicitly listed in Apple's security updates up through 10.13.2/2017-002 Sierra. https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222

johncalvinyoung 9y ago

https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi... https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi... Seems that Google/Project Zero felt the need to go ahead and break embargo. Worth adding to the above list of news sources.

victorhooi 9y ago
No, that's not accurate. If you read the article you quoted: > We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation. The full Project Zero report is forthcoming (update: this has been published; see above). Just from public Gooogling, I believe it may have been the Register who tried to get in on the scoop, and broke the embargo: https://www.theregister.co.uk/2018/01/04/intels_spin_the_registers_annotations/ https://www.theregister.co.uk/2018/01/04/intels_spin_the_reg...
- lmm 9y ago
  No-one necessarily broke the embargo. A blogger noticed unusual activity around a certain linux patchset and put two and two together, and the register mostly sourced from his article ( http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table http://pythonsweetness.tumblr.com/post/169166980422/the-myst... )

johncalvinyoung 9y ago

Also from the P0 blog post: Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch target injection (CVE-2017-5715) Variant 3: rogue data cache load (CVE-2017-5754) My checking doesn't show any of those three explicitly listed in Apple's security updates up through 10.13.2/2017-002 Sierra. https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222