From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Wingo Subject: Re: What do Meltdown and Spectre mean for libreboot x200 user? Date: Mon, 15 Jan 2018 14:25:41 +0100 Message-ID: <87lggzb6ei.fsf@igalia.com> References: <405e966d-581d-d6f5-e085-ecad532ffcc6@gluglug.org.uk> <87shb8qxl4.fsf@gmail.com> <6e931622-65fc-fe0b-491f-3e94c6acdf0b@gluglug.org.uk> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:46638) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eb4mT-0007Tl-Ky for guix-devel@gnu.org; Mon, 15 Jan 2018 08:26:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eb4mQ-0000uL-G6 for guix-devel@gnu.org; Mon, 15 Jan 2018 08:26:29 -0500 Received: from pb-sasl2.pobox.com ([64.147.108.67]:60792 helo=sasl.smtp.pobox.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eb4mQ-0000PW-C0 for guix-devel@gnu.org; Mon, 15 Jan 2018 08:26:26 -0500 In-Reply-To: <6e931622-65fc-fe0b-491f-3e94c6acdf0b@gluglug.org.uk> (Leah Rowe's message of "Mon, 15 Jan 2018 11:32:40 +0000") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leah Rowe Cc: guix-devel@gnu.org Greets, On Mon 15 Jan 2018 12:32, Leah Rowe writes: > The implications [of Meltdown/Spectre] at firmware level are > non-existent (for instance, these attacks can't, to my knowledge, be > used to actually run/modify malicious code, just read memory, so it's > not as if some evil site could install malicious boot firmware in your > system). I agree that it's unlikely that a site could install boot firmware, but AFAIU it's not out of the realm of possibility. The vector I see would be using Meltdown/Spectre to read authentication/capability tokens which could be used to gain access, either via some other RCE vuln or possibly via remote access. Maybe evil code could find an SSH private key in a mapped page, for example, which the evil server could use to SSH directly to your machine. But I admit that it's a bit farfetched :) Andy