Dnia Wednesday, January 3, 2018 1:27:38 PM CET 'awokd' via qubes-users pisze: > On Wed, January 3, 2018 11:55 am, stephenatve...@gmail.com wrote: > > https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/ > > > > > > http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-o > > f-the-linux-page-table > > > > It seems as if Linux countermeasures will involve a significant rewrite > > aka. FUCKWIT. > > > > Is this perhaps why there is no final 4.0 release? > > Believe PCI passthrough had been the major holdup for 4.0 release but I > could be wrong. I'm curious to see if Xen/Qubes is impacted as well. One > article says there was a rumor Xen was, another says there are comments in > the code that Xen PV/HVM is not. Embargo lifts on the 4th, so there should > be more facts then. Wouldn't want to engage in making speculative > assumptions (cough).
And here we are: https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html https://googleprojectzero.blogspot.pt/2018/01/reading-privileged-memory-with-side.html https://meltdownattack.com/meltdown.pdf https://spectreattack.com/spectre.pdf " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " During the course of our research, we developed the following proofs of concept (PoCs): A PoC that demonstrates the basic principles behind variant 1 in userspace on the tested Intel Haswell Xeon CPU, the AMD FX CPU, the AMD PRO CPU and an ARM Cortex A57 [2]. This PoC only tests for the ability to read data inside mis-speculated execution within the same process, without crossing any privilege boundaries. A PoC for variant 1 that, when running with normal user privileges under a modern Linux kernel with a distro-standard config, can perform arbitrary reads in a 4GiB range [3] in kernel virtual memory on the Intel Haswell Xeon CPU. If the kernel's BPF JIT is enabled (non-default configuration), it also works on the AMD PRO CPU. On the Intel Haswell Xeon CPU, kernel virtual memory can be read at a rate of around 2000 bytes per second after around 4 seconds of startup time. [4] A PoC for variant 2 that, when running with root privileges inside a KVM guest created using virt-manager on the Intel Haswell Xeon CPU, with a specific (now outdated) version of Debian's distro kernel [5] running on the host, can read host kernel memory at a rate of around 1500 bytes/second, with room for optimization. Before the attack can be performed, some initialization has to be performed that takes roughly between 10 and 30 minutes for a machine with 64GiB of RAM; the needed time should scale roughly linearly with the amount of host RAM. (If 2MB hugepages are available to the guest, the initialization should be much faster, but that hasn't been tested.) A PoC for variant 3 that, when running with normal user privileges, can read kernel memory on the Intel Haswell Xeon CPU under some precondition. We believe that this precondition is that the targeted kernel memory is present in the L1D cache. " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " -- Pozdrawiam, Michał "rysiek" Woźniak Zmieniam klucz GPG :: http://rys.io/pl/147 GPG Key Transition :: http://rys.io/en/147 -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to qubes-users@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/40959822.UoTSMkEhtd%40lapuntu. For more options, visit https://groups.google.com/d/optout.
signature.asc
Description: This is a digitally signed message part.
