4 ms·

i heard everyone is calling it AVXECUTIONER > Note that on a vulnerable machine, proper testing of OpenSSL would fail and should be noticed before deployment.

i heard everyone is calling it AVXECUTIONER > Note that on a vulnerable machine, proper testing of OpenSSL would fail and should be noticed before deployment. so is 'proper testing' included in the default build script or..?

cperciva 4y ago
I don't know if it's in the default build script, but it doesn't really matter -- most people install precompiled binaries.
- deleted 4y ago
  [deleted]
- aeyes 4y ago
  So nobody running a precompiled binary of their favorite Linux distribution should be affected because distributors should run the full test suite across all supported architectures when they package the binary? Debian for example shipped vulnerable packages: https://security-tracker.debian.org/tracker/CVE-2022-2274 https://security-tracker.debian.org/tracker/CVE-2022-2274
  - civil_engineer 4y ago
    What the heck, Debian?
    - smegsicle 4y ago
      "openssl security team accuses debian of not performing proper testing"
  - yabones 4y ago
    Should be noted that the only version marked as vulnerable, "Bookworm", is the "testing" version that has not been officially released yet and has no "security policy" other than best-effort. Its purpose is for testing the next stable release, not for everyday use. Vulnerabilities in the stable or even oldstable releases are fixed much faster and tested much more thoroughly.
    - smegsicle 4y ago
      still seems like they should run build testing as part of that 'best-effort' (assuming that's what is meant by the advisory's 'proper testing')
  - cperciva 4y ago
    It's one thing to run the full test suite across all supported architectures. It's quite another to run the full test suite across all supported CPUs. The vast majority of x86-64 CPUs do not trigger this bug.
userbinator 4y ago
It's been a while since I've looked at OpenSSL source, or read its compilation instructions in particular, but I remember it tells you to "make test" or similar to run the tests before installing.
- djbusby 4y ago
  Even on systems like Gentoo which build everything the make test option isn't default.
daenney 4y ago
This statement really rubs me the wrong way. It sounds an awful lot like “you’re responsible for catching our screw-ups” and it’s a bit rich to tell people to do proper testing while the project itself failed to do so before letting this land.
- zgs 4y ago
  Not at all. To be vulnerable, you need to build on a non-vulnerable machine which passes the built in tests, then you need to deploy to a vulnerable one and finally you have to not verify that the deployment works. Absolutely not what you are implying.
  - daenney 4y ago
    I agree about the chain, but it’s incredible easy for this to happen with how most things are distributed as binary packages. Most folks won’t be running the test suites on the end system.
  - enkrs 4y ago
    Wouldn’t building on non-vulnerable system also compile the bibary with non-vulnerable instructions? Does a non AVX512 system really build an executable that calls AVX512?
    - zaarn 4y ago
      OpenSSL does a lot of runtime detection of what a system is capable of, so I would suspect this can happen.
zgs 4y ago
If you build on the machine you will deploy to, the tests won't pass. Problem solved. If you build on an earlier machine where the tests pass and deploy to a later one and then don't check that the deployment works, you are at risk. I think proper testing covers both options.

cperciva 4y ago

I don't know if it's in the default build script, but it doesn't really matter -- most people install precompiled binaries.

deleted 4y ago
[deleted]
aeyes 4y ago
So nobody running a precompiled binary of their favorite Linux distribution should be affected because distributors should run the full test suite across all supported architectures when they package the binary? Debian for example shipped vulnerable packages: https://security-tracker.debian.org/tracker/CVE-2022-2274 https://security-tracker.debian.org/tracker/CVE-2022-2274
- civil_engineer 4y ago
  What the heck, Debian?
  - smegsicle 4y ago
    "openssl security team accuses debian of not performing proper testing"
- yabones 4y ago
  Should be noted that the only version marked as vulnerable, "Bookworm", is the "testing" version that has not been officially released yet and has no "security policy" other than best-effort. Its purpose is for testing the next stable release, not for everyday use. Vulnerabilities in the stable or even oldstable releases are fixed much faster and tested much more thoroughly.
  - smegsicle 4y ago
    still seems like they should run build testing as part of that 'best-effort' (assuming that's what is meant by the advisory's 'proper testing')
- cperciva 4y ago
  It's one thing to run the full test suite across all supported architectures. It's quite another to run the full test suite across all supported CPUs. The vast majority of x86-64 CPUs do not trigger this bug.

userbinator 4y ago

It's been a while since I've looked at OpenSSL source, or read its compilation instructions in particular, but I remember it tells you to "make test" or similar to run the tests before installing.

djbusby 4y ago
Even on systems like Gentoo which build everything the make test option isn't default.

daenney 4y ago

This statement really rubs me the wrong way. It sounds an awful lot like “you’re responsible for catching our screw-ups” and it’s a bit rich to tell people to do proper testing while the project itself failed to do so before letting this land.

zgs 4y ago
Not at all. To be vulnerable, you need to build on a non-vulnerable machine which passes the built in tests, then you need to deploy to a vulnerable one and finally you have to not verify that the deployment works. Absolutely not what you are implying.
- daenney 4y ago
  I agree about the chain, but it’s incredible easy for this to happen with how most things are distributed as binary packages. Most folks won’t be running the test suites on the end system.
- enkrs 4y ago
  Wouldn’t building on non-vulnerable system also compile the bibary with non-vulnerable instructions? Does a non AVX512 system really build an executable that calls AVX512?
  - zaarn 4y ago
    OpenSSL does a lot of runtime detection of what a system is capable of, so I would suspect this can happen.

zgs 4y ago

If you build on the machine you will deploy to, the tests won't pass. Problem solved. If you build on an earlier machine where the tests pass and deploy to a later one and then don't check that the deployment works, you are at risk. I think proper testing covers both options.