From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Marusich Subject: Re: Meltdown / Spectre Date: Sat, 06 Jan 2018 18:44:50 -0800 Message-ID: <87lghapeu5.fsf@gmail.com> References: <874lnzcedp.fsf@gmail.com> <20180106174358.GA28436@jasmine.lan> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:53388) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eY0xJ-0004Pz-Mq for guix-devel@gnu.org; Sat, 06 Jan 2018 21:45:02 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eY0xF-0001lO-SF for guix-devel@gnu.org; Sat, 06 Jan 2018 21:45:01 -0500 Received: from mail-pf0-x236.google.com ([2607:f8b0:400e:c00::236]:42551) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1eY0xF-0001ko-L7 for guix-devel@gnu.org; Sat, 06 Jan 2018 21:44:57 -0500 Received: by mail-pf0-x236.google.com with SMTP id d23so3819839pfe.9 for ; Sat, 06 Jan 2018 18:44:57 -0800 (PST) In-Reply-To: <20180106174358.GA28436@jasmine.lan> (Leo Famulari's message of "Sat, 6 Jan 2018 12:43:58 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: development@libreboot.org, guix-devel@gnu.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Leo Famulari writes: > ### Guix status ### > > The CPU makers are issuing microcode updates as a hardware-level > mitigation, but I don't think we'll be providing those in Guix. It seems some (but not all) mitigations may require firmware/microcode updates. For details, see: https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analys= is-of-Speculative-Execution-Side-Channels.pdf https://developer.arm.com/support/security-update I wonder: how easy will it be to install those firmware/microcode updates if you are using GuixSD? In particular, I'm curious about the case of the Lenovo x200 with libreboot, since that's what I use personally. > The first mitigations available in Guix are in the kernel. > > We got the initial mitigation for Meltdown, Linux page table isolation > (KPTI), in linux-libre 4.14.11 on January 3: > > https://git.savannah.gnu.org/cgit/guix.git/commit/?id=3D10db5e98ed7036e87= 3060501462345c37fe2855c > > Last night we got KPTI for the 4.4 and 4.9 kernel series, in 4.4.110 and > 4.9.75, respectively. At the same time, we made 4.14.12 available, which > has some changes to KPTI in that kernel: > > 4.4.110: > https://git.savannah.gnu.org/cgit/guix.git/commit/?id=3D630437d94eeeae525= 86ab2362aa4273e0424cdf3 > 4.9.75: > https://git.savannah.gnu.org/cgit/guix.git/commit/?id=3Df2462bc3662733801= d7df7c532c1d8b0c67b3c18 > 4.14.12: > https://git.savannah.gnu.org/cgit/guix.git/commit/?id=3Daf3f7f22f43fbbdca= 9bdc00afc476dd2ac86c017 That's great! > Mozilla has released an update that is supposed to mitigate the > vulnerability but I don't if they'll be porting it back to the extended > support release that Icecat is based on. My understanding is that those changes just mitigate the known methods for the Spectre attack via Javascript. Surely, other ways will be discovered and abused, until a more holistic fix for Spectre is in place. See also the following paper, which claims to have found alternative ways to mount similar attacks: https://gruss.cc/files/fantastictimers.pdf Probably, the safest thing one can do right now is disable Javascript by default and judiciously enable it only for websites that you trust. =2D-=20 Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEy/WXVcvn5+/vGD+x3UCaFdgiRp0FAlpRiaIACgkQ3UCaFdgi Rp0daxAAkK5sKWvsYYsXJcT4wiBBEygGvv1bL4xo2Jczr76ttqD+6LXhwVj2MmQS OALhFo6Sf7bEH5kL7cyXqKnCHASsJlXUYIt8vK2SeHUZUWw/CR/IPqxxNaMIqqMW UU2uA7/aHCdiiKbbYA26L4FVZbk4FIfGqOWB8ywgFQuL3gEOKDhIhC8HeS7hzwse OCZvvCptjQPUxuwddUJdfAOkOnh591vsWIv/pwNTF4VjcsKMxmVpDAzswWTfOo1+ 9w9gMR9KgysKmmUMc/ZVQHGeCEXYJpr2ZlIR+/vJPLT+CqWKJUtGeFS/FqHv8qBl pWwlY41ECMaASCG9KeDI7DveqzVbZbX+QfY9SbkMaFGRo6oihLJMishBh9INKM8d w3sS2Gm7HQ4avEESNnsOhfI98qKdpjXxODSasLb9NXJ66PCLq2fodNeFxhmk2AEL jRFtWqvCFF8rEeL/qE8ez6Zac8Nvg4zewThQu1gWX+aFeXrH8CTkUvY3eyjpo8Ry G7NN5PGowz47SlrLRRE2R1oOFU191BpdT/63lVeWdwcYkj/WTpXRnCmdX4FtSptq HPY54vqQLZLMPk11smC/MxRsbuYoQz9b+LrB0YpxK6ViNP8xp/BGVViVQT77ZQKG GUqROdD3lAkokwsoMqy1NmpGym+knkX+u8iHICGUrdzfJnlVPVs= =Sz9m -----END PGP SIGNATURE----- --=-=-=--