4 ms·
If they can fix it in microcode, why did they have to patch the kernel?
by noncoml 9y ago
If they can fix it in microcode, why did they have to patch the kernel?
- ajdlinux 9y agoYou need both. According to https://access.redhat.com/articles/3311301 https://access.redhat.com/articles/3311301: > CVE-2017-5715 (variant #2/Spectre) is an indirect branching poisoning attack that can lead to data leakage. This attack allows for a virtualized guest to read memory from the host system. This issue is corrected with microcode, along with kernel and virtualization updates to both guest and host virtualization software. This vulnerability requires both updated microcode and kernel patches. Variant #2 behavior is controlled by the ibrs and ibpb tunables (noibrs/ibrs_enabled and noibpb/ibpb_enabled), which work in conjunction with the microcode.
- kelnos 9y agoMeltdown/Spectre is actually 3 different, but related, vulnerabilities, each with different mitigations/workarounds.