5 ms·

Ubuntu anouncement on Spectre/Meltdown

93 points by theptip 9y ago

theptip 9y ago
> The original coordinated disclosure date was planned for January 9 and we have been driving toward that date to release fixes. Due to the early disclosure, we are trying to accelerate the release, but we don't yet have an earlier ETA when the updates will be released.
- iagooar 9y ago
  What happened that the disclosure was too early?
  - th0br0 9y ago
    Given that the CRD/NDA came from Intel and that spectreattack.com is hosted by the University of Graz, I'd assume that that was a one-sided CRD.
  - Deimorz 9y ago
    People started figuring out some details about the vulnerability from various public sources (Linux kernel development, previously published security research), and it was getting a lot of media/internet attention. The Google blog post from yesterday (https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...) says: > We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation.
  - deleted 9y ago
    [deleted]
  - JdeBP 9y ago
    See my answer at https://news.ycombinator.com/item?id=16068510 https://news.ycombinator.com/item?id=16068510 .
Deimorz 9y ago
One interesting piece of information from this post is that Intel notified Ubuntu about the issue on November 9. Project Zero notified Intel on June 1, so it took over 5 months before they passed it on to Ubuntu (and even longer for the other vendors). That seems like an extremely long time to me, when it (I assume) was pretty obvious that it was going to require OS changes to mitigate.
- eximius 9y ago
  Why would Ubuntu need to be notified? Fixes for this are going to be at the Linux Kernel level or (at most) Debian upstream. Canonical shouldn't need to do anything?
  - pritambaral 9y ago
    If some fixes can be applied via microcode, then the distros will have to be provided the updated microcode. The kernel (mostly) does not handle CPU microcode distribution.
  - hd4 9y ago
    Pretty sure Ubuntu are the largest Linux vendor right now, and have their distro on the largest number of servers worldwide.
  - crtasm 9y ago
    From TFA >To address the issue, updates to the Ubuntu kernel and processor microcode will be needed. These updates will be announced in future Ubuntu Security Notices once they are available.
  - Thaxll 9y ago
    Ubuntu kernel don't rely on Debian. Have you seen how Debian lags behind the rest in terms of versions.
    - subsection1h 9y ago
      Lags behind? Linux kernel version 4.14 is available for Debian Stretch: https://packages.debian.org/stretch-backports/linux-image-amd64 https://packages.debian.org/stretch-backports/linux-image-am...
deleted 9y ago
[deleted]
MollyR 9y ago
Truly disappointing they are behind on this. This should be lighting a fire under all tech leaders.

93 points by theptip 9y ago

> The original coordinated disclosure date was planned for January 9 and we have been driving toward that date to release fixes. Due to the early disclosure, we are trying to accelerate the release, but we don't yet have an earlier ETA when the updates will be released.

iagooar 9y ago
What happened that the disclosure was too early?
- th0br0 9y ago
  Given that the CRD/NDA came from Intel and that spectreattack.com is hosted by the University of Graz, I'd assume that that was a one-sided CRD.
- Deimorz 9y ago
  People started figuring out some details about the vulnerability from various public sources (Linux kernel development, previously published security research), and it was getting a lot of media/internet attention. The Google blog post from yesterday (https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://security.googleblog.com/2018/01/todays-cpu-vulnerabi...) says: > We are posting before an originally coordinated disclosure date of January 9, 2018 because of existing public reports and growing speculation in the press and security research community about the issue, which raises the risk of exploitation.
- deleted 9y ago
  [deleted]
- JdeBP 9y ago
  See my answer at https://news.ycombinator.com/item?id=16068510 https://news.ycombinator.com/item?id=16068510 .

Deimorz 9y ago

One interesting piece of information from this post is that Intel notified Ubuntu about the issue on November 9. Project Zero notified Intel on June 1, so it took over 5 months before they passed it on to Ubuntu (and even longer for the other vendors). That seems like an extremely long time to me, when it (I assume) was pretty obvious that it was going to require OS changes to mitigate.

eximius 9y ago
Why would Ubuntu need to be notified? Fixes for this are going to be at the Linux Kernel level or (at most) Debian upstream. Canonical shouldn't need to do anything?
- pritambaral 9y ago
  If some fixes can be applied via microcode, then the distros will have to be provided the updated microcode. The kernel (mostly) does not handle CPU microcode distribution.
- hd4 9y ago
  Pretty sure Ubuntu are the largest Linux vendor right now, and have their distro on the largest number of servers worldwide.
- crtasm 9y ago
  From TFA >To address the issue, updates to the Ubuntu kernel and processor microcode will be needed. These updates will be announced in future Ubuntu Security Notices once they are available.
- Thaxll 9y ago
  Ubuntu kernel don't rely on Debian. Have you seen how Debian lags behind the rest in terms of versions.
  - subsection1h 9y ago
    Lags behind? Linux kernel version 4.14 is available for Debian Stretch: https://packages.debian.org/stretch-backports/linux-image-amd64 https://packages.debian.org/stretch-backports/linux-image-am...

deleted 9y ago

[deleted]

MollyR 9y ago

Truly disappointing they are behind on this. This should be lighting a fire under all tech leaders.