4 ms·

This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any

This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any OS that isn't Windows, MacOS or mainline Linux), that work is ongoing and will depend on the OS. (Speaking for SmartOS/illumos, that work is reasonably far along and making promising progress -- but we don't yet have a functional prototype.) As for Spectre, these are just the microcode updates that have the additional MSRs that allow system software to mitigate certain variants of Spectre attack against the system software itself. They are necessary, but emphatically not sufficient -- and it would disingenuous for Intel to pretend that this in any way means that 90% of systems are protected from Meltdown and Spectre.

cryptonector 9y ago
What's the story for Illumos as to Meltdown and Spectre? I expect KPTI for Meltdown and then the same disable-speculation-for-indirect-call-in-kernel fix that everyone else is applying. With KVM the Illumos hypervisor should be free of attack, so maybe Joyent needs nothing more. EDIT: thanks for the update (or did I misread earlier?).
shirian 9y ago
For reference, I received this email before today: By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi... The FreeBSD Security Team was notified of the issue in late December and received a briefing under NDA with the original embargo date of January 9th. Since we received relatively late notice of the issue, our ability to provide fixes is delayed. Meltdown (CVE-2017-5754) ~~~~~~~~~~~~~~~~~~~~~~~~ In terms of priority, the first step is to mitigate against the Meltdown attack (CVE-2017-5754, cited as variant 3 by Project Zero). Work for this is ongoing, but due to the relatively large changes needed, this is going to take a little while. We are currently targeting patches for amd64 being dev complete this week with testing probably running into next week. From there, we hope to give it a short bake time before pushing it into the 11.1-RELEASE branch. Additional work will be required to bring the mitigation to 10.3-RELEASE and 10.4-RELEASE. The code will be selectable via a tunable which will automatically turn on for modern Intel processors and off for AMD processors (since they are reportedly not vulnerable). Since the fix for Meltdown does incur a performance hit for any transition between user space and kernel space, this could be rather impactful depending on the workload. As such, the tunable can also be overridden by the end-user if they are willing to accept the risk. Initial work can be tracked at https://reviews.freebsd.org/D13797 https://reviews.freebsd.org/D13797. Please note this is a work in progress and some stuff is likely to be broken. Spectre (CVE-2017-5753 and CVE-2017-5715) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When it comes to the Spectre vulnerabilities, it is much harder to sort these out. Variant 1 (CVE-2017-5753) is going to require some static analysis to determine vulnerable use cases that will require barriers to stop speculation from disclosing information it shouldn't. While we haven't done the analysis to determine where we are vulnerable, the number of cases here are supposed to be pretty small. Apparently there have been some Coverity rules developed to help look for these, but we are still evaluating what can be done here. The other half of Spectre, variant 2 (CVE-2017-5715) is a bit trickier as it affects both normal processes and bhyve. There is a proposed patch for LLVM (https://reviews.llvm.org/D41723 https://reviews.llvm.org/D41723) that introduces a concept called 'retpoline' which mitigates this issue. We are likely to pull this into HEAD and 11-STABLE once it hits the LLVM tree. Unfortunately, the currently supported FreeBSD releases are using older versions of LLVM for which we are not sure the LLVM project will produce patches. We will be looking at the feasibility to backport these patches to these earlier versions. There are CPU microcode fixes coming out when in concert with OS changes would also help, but that's a bit down the road at the moment. If anything significantly changes I will make additional posts to clarify as the information becomes available. Best regards, Gordon Tetlow with security-officer hat on
- rdtsc 9y ago
  > FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not extend it to a few more projects? Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded.
  - loeg 9y ago
    FreeBSD secteam was only notified — at all — because Netflix (a big FreeBSD user) requested it of Intel. It was a big slap in the face to smaller communities by Intel.
    - Bromskloss 9y ago
      How did Netflix know about it?
      - loeg 9y ago
        I guess, but do not have firsthand knowledge, that Intel disclosed directly to them as a large customer.
  - bogomipz 9y ago
    >"Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me?" Indeed. There seems to be a security oligarchy now consisting of Google, FB, Apple, Amazon et al. and Intel.
  - marcoperaza 9y ago
    The more people you tell, the higher the chance of a leak. "Loose lips sink ships."
8_hours_ago 9y ago
FYI, Ubuntu released updates today for Meltdown: Ubuntu 16.04 LTS: https://usn.ubuntu.com/usn/usn-3522-1/ https://usn.ubuntu.com/usn/usn-3522-1/ Ubuntu 14.04 LTS: https://usn.ubuntu.com/usn/usn-3522-2/ https://usn.ubuntu.com/usn/usn-3522-2/ Ubuntu 17.10: https://usn.ubuntu.com/usn/usn-3523-1/ https://usn.ubuntu.com/usn/usn-3523-1/
- tannhaeuser 9y ago
  Would you know if the patches are or will be included in the mainline kernels which are at 4.4.14 and 4.4.15?
Dylan16807 9y ago
> This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. Why is that? In theory, on a generic CPU, the microcode changes to stop Meltdown are drastically simpler than the mitigations for Spectre. Are Intel chips incapable of implementing them?
- ithkuil 9y ago
  Microcode doesn't control everything the CPU hardware does
  - Dylan16807 9y ago
    I'm aware, that's why I asked. Do you know? Do you have a reference? (And I'll laugh pretty hard if it's confirmed that these super-complex branch buffer adjustments are possible, but simple prefetch filters are just not possible on current Intel hardware.)
    - ithkuil 9y ago
      No I don't have any reference. But I don't find it soon hard to believe that complex things have knobs while simple things don't.

cryptonector 9y ago

What's the story for Illumos as to Meltdown and Spectre? I expect KPTI for Meltdown and then the same disable-speculation-for-indirect-call-in-kernel fix that everyone else is applying. With KVM the Illumos hypervisor should be free of attack, so maybe Joyent needs nothing more. EDIT: thanks for the update (or did I misread earlier?).

shirian 9y ago

For reference, I received this email before today: By now, we're sure most everyone have heard of the Meltdown and Spectre attacks. If not, head over to https://meltdownattack.com/ https://meltdownattack.com/ and get an overview. Additional technical details are available from Google Project Zero. https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.com/2018/01/reading-privi... The FreeBSD Security Team was notified of the issue in late December and received a briefing under NDA with the original embargo date of January 9th. Since we received relatively late notice of the issue, our ability to provide fixes is delayed. Meltdown (CVE-2017-5754) ~~~~~~~~~~~~~~~~~~~~~~~~ In terms of priority, the first step is to mitigate against the Meltdown attack (CVE-2017-5754, cited as variant 3 by Project Zero). Work for this is ongoing, but due to the relatively large changes needed, this is going to take a little while. We are currently targeting patches for amd64 being dev complete this week with testing probably running into next week. From there, we hope to give it a short bake time before pushing it into the 11.1-RELEASE branch. Additional work will be required to bring the mitigation to 10.3-RELEASE and 10.4-RELEASE. The code will be selectable via a tunable which will automatically turn on for modern Intel processors and off for AMD processors (since they are reportedly not vulnerable). Since the fix for Meltdown does incur a performance hit for any transition between user space and kernel space, this could be rather impactful depending on the workload. As such, the tunable can also be overridden by the end-user if they are willing to accept the risk. Initial work can be tracked at https://reviews.freebsd.org/D13797 https://reviews.freebsd.org/D13797. Please note this is a work in progress and some stuff is likely to be broken. Spectre (CVE-2017-5753 and CVE-2017-5715) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ When it comes to the Spectre vulnerabilities, it is much harder to sort these out. Variant 1 (CVE-2017-5753) is going to require some static analysis to determine vulnerable use cases that will require barriers to stop speculation from disclosing information it shouldn't. While we haven't done the analysis to determine where we are vulnerable, the number of cases here are supposed to be pretty small. Apparently there have been some Coverity rules developed to help look for these, but we are still evaluating what can be done here. The other half of Spectre, variant 2 (CVE-2017-5715) is a bit trickier as it affects both normal processes and bhyve. There is a proposed patch for LLVM (https://reviews.llvm.org/D41723 https://reviews.llvm.org/D41723) that introduces a concept called 'retpoline' which mitigates this issue. We are likely to pull this into HEAD and 11-STABLE once it hits the LLVM tree. Unfortunately, the currently supported FreeBSD releases are using older versions of LLVM for which we are not sure the LLVM project will produce patches. We will be looking at the feasibility to backport these patches to these earlier versions. There are CPU microcode fixes coming out when in concert with OS changes would also help, but that's a bit down the road at the moment. If anything significantly changes I will make additional posts to clarify as the information becomes available. Best regards, Gordon Tetlow with security-officer hat on

rdtsc 9y ago
> FreeBSD Security Team was notified of the issue in late December Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me? They were notified in late December, right before the holidays, so that's basically only 2-3 weeks of work. Obviously nobody _had_ to notify anyone, could have just released it right away, so it was a professional courtesy, but why not extend it to a few more projects? Before anyone says "but OpenBSD broke an embargo before", this is a different project and besides having BSD in the name don't see why they were excluded.
- loeg 9y ago
  FreeBSD secteam was only notified — at all — because Netflix (a big FreeBSD user) requested it of Intel. It was a big slap in the face to smaller communities by Intel.
  - Bromskloss 9y ago
    How did Netflix know about it?
    - loeg 9y ago
      I guess, but do not have firsthand knowledge, that Intel disclosed directly to them as a large customer.
- bogomipz 9y ago
  >"Anyone else thinks this was kind of a slap in the face to the smaller communities and companies or is it just me?" Indeed. There seems to be a security oligarchy now consisting of Google, FB, Apple, Amazon et al. and Intel.
- marcoperaza 9y ago
  The more people you tell, the higher the chance of a leak. "Loose lips sink ships."

8_hours_ago 9y ago

FYI, Ubuntu released updates today for Meltdown: Ubuntu 16.04 LTS: https://usn.ubuntu.com/usn/usn-3522-1/ https://usn.ubuntu.com/usn/usn-3522-1/ Ubuntu 14.04 LTS: https://usn.ubuntu.com/usn/usn-3522-2/ https://usn.ubuntu.com/usn/usn-3522-2/ Ubuntu 17.10: https://usn.ubuntu.com/usn/usn-3523-1/ https://usn.ubuntu.com/usn/usn-3523-1/

tannhaeuser 9y ago
Would you know if the patches are or will be included in the mainline kernels which are at 4.4.14 and 4.4.15?

Dylan16807 9y ago

> This is only Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. Why is that? In theory, on a generic CPU, the microcode changes to stop Meltdown are drastically simpler than the mitigations for Spectre. Are Intel chips incapable of implementing them?

ithkuil 9y ago
Microcode doesn't control everything the CPU hardware does
- Dylan16807 9y ago
  I'm aware, that's why I asked. Do you know? Do you have a reference? (And I'll laugh pretty hard if it's confirmed that these super-complex branch buffer adjustments are possible, but simple prefetch filters are just not possible on current Intel hardware.)
  - ithkuil 9y ago
    No I don't have any reference. But I don't find it soon hard to believe that complex things have knobs while simple things don't.