Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

eva2000 · Jan 3, 2018

Update: CentOS 6.x and 7.x have Linux Kernel related updates available for fixing some of these flaws. There maybe further updates later on so keep an eye on this thread or watch/subscribe for updates. After updating Kernels you will need to reboot your server.

January 18, 2018 Update:

Looks like new firmware and microcode updates are available on Redhat/CentOS 6/7 at least Red Hat Customer Portal

Description
The microcode_ctl packages provide microcode updates for Intel and AMD processors.

This update supersedes microcode provided by Red Hat with the CVE-2017-5715 (“Spectre”) CPU branch injection vulnerability mitigation. (Historically, Red Hat has provided updated microcode, developed by our microprocessor partners, as a customer convenience.) Further testing has uncovered problems with the microcode provided along with the “Spectre” mitigation that could lead to system instabilities. As a result, Red Hat is providing an microcode update that reverts to the last known good microcode version dated before 03 January 2018. Red Hat strongly recommends that customers contact their hardware provider for the latest microcode updates.

IMPORTANT: Customers using Intel Skylake-, Broadwell-, and Haswell-based platforms must obtain and install updated microcode from their hardware vendor immediately. The "Spectre" mitigation requires both an updated kernel from Red Hat and updated microcode from your hardware vendor.
Click to expand...
Code (Text):
yum list updates -q
Updated Packages
linux-firmware.noarch                                    20170606-58.gitc990aae.el7_4                                     updates
microcode_ctl.x86_64                                     2:2.1-22.5.el7_4                                                 updates
Yup update
Code (Text):
yum -y update
CentOS 6
Code (Text):
yum list updates -q | tr -s ' '
Updated Packages
kernel.x86_64 2.6.32-696.18.7.el6 updates
kernel-devel.x86_64 2.6.32-696.18.7.el6 updates
kernel-firmware.noarch 2.6.32-696.18.7.el6 updates
kernel-headers.x86_64 2.6.32-696.18.7.el6 updates
CentOS 7
Code (Text):
yum list updates -q | tr -s ' '
Updated Packages
kernel.x86_64 3.10.0-693.11.6.el7 updates
kernel-devel.x86_64 3.10.0-693.11.6.el7 updates
kernel-headers.x86_64 3.10.0-693.11.6.el7 updates
kernel-tools.x86_64 3.10.0-693.11.6.el7 updates
kernel-tools-libs.x86_64 3.10.0-693.11.6.el7 updates
linux-firmware.noarch 20170606-57.gitc990aae.el7 updates
microcode_ctl.x86_64 2:2.1-22.2.el7 updates
python-perf.x86_64 3.10.0-693.11.6.el7 updates
If on dedicated servers instead of VPS, you may have additional yum updates for iwl****-firmware related packages.

To check installed Kernel after reboot
Code (Text):
uname -r
3.10.0-693.11.6.el7.x86_64
Ouch not good for anyone using Intel processors as the fix may slow down Intel cpus by up to 30% Details 'Kernel memory leaking' Intel processor design flaw forces Linux, Windows redesign

A fundamental design flaw in Intel's processor chips has forced a significant redesign of the Linux and Windows kernels to defang the chip-level security bug.

Programmers are scrambling to overhaul the open-source Linux kernel's virtual memory system. Meanwhile, Microsoft is expected to publicly introduce the necessary changes to its Windows operating system in an upcoming Patch Tuesday: these changes were seeded to beta testers running fast-ring Windows Insider builds in November and December.

Crucially, these updates to both Linux and Windows will incur a performance hit on Intel products. The effects are still being benchmarked, however we're looking at a ballpark figure of five to 30 per cent slow down, depending on the task and the processor model. More recent Intel chips have features – such as PCID – to reduce the performance hit.
Click to expand...

he flaw is in the Intel x86 hardware, and it appears a microcode update can't address it. It has to be fixed in software at the OS level, or buy a new processor without the design blunder.
Click to expand...

AMD processors not affected though

In an email to the Linux kernel mailing list over Christmas, AMD said it is not affected. The wording of that message, though, rather gives the game away as to what the underlying cockup is:

AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault.

A key word here is "speculative." Modern processors, like Intel's, perform speculative execution. In order to keep their internal pipelines primed with instructions to perform, the CPU cores try their best to guess what code is going to be run next, fetch it, and execute it.
Click to expand...

Update: officially called Meltdown and Spectre

Spectre CVE-2017-5753 and CVE-2017-5715

Meltdown CVE-2017-5754

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider's infrastructure, it might be possible to steal data from other customers.
Click to expand...

Which systems are affected by Meltdown?
Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?
Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Which cloud providers are affected by Meltdown?
Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.
Click to expand...

pamamolf · Jan 3, 2018

Intel x86 hardware
Click to expand...

So a 64bit Cpu ( i think that most servers are using them) will be ok?

Is there any list of the affected cpus?

eva2000 · Jan 3, 2018

no Intel x86 refers to architecture so 32bit/64bit

looks like all Intel cpus are affected.

checked my i7 4790K OVH server has PCID look for pcid in flags line

Code (Text):

cat /proc/cpuinfo

processor       : 7
vendor_id       : GenuineIntel
cpu family      : 6
model           : 60
model name      : Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
stepping        : 3
microcode       : 0x17
cpu MHz         : 4342.812
cache size      : 8192 KB
physical id     : 0
siblings        : 8
core id         : 3
cpu cores       : 4
apicid          : 7
initial apicid  : 7
fpu             : yes
fpu_exception   : yes
cpuid level     : 13
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm epb tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm xsaveopt dtherm ida arat pln pts
bogomips        : 7981.54
clflush size    : 64
cache_alignment : 64
address sizes   : 39 bits physical, 48 bits virtual
power management:

Code (Text):

lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                8
On-line CPU(s) list:   0-7
Thread(s) per core:    2
Core(s) per socket:    4
Socket(s):             1
NUMA node(s):          1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 60
Model name:            Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Stepping:              3
CPU MHz:               4271.875
CPU max MHz:           4400.0000
CPU min MHz:           800.0000
BogoMIPS:              7981.54
Virtualization:        VT-x
L1d cache:             32K
L1i cache:             32K
L2 cache:              256K
L3 cache:              8192K
NUMA node0 CPU(s):     0-7
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm epb tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm xsaveopt dtherm ida arat pln pts

eva2000 · Jan 3, 2018

what PCID is explained in old article which also touched on the security issues were faced with on Intel cpus now SIMPLE IS BETTER: Improve Performance for Separating Kernel and User Address Space with Process-Context Identifiers (PCIDs)

Before hardware PCID (Process-Context Identifiers) feature was introduced, TLB flush due to user/kernel page table switch through syscall or interrupt/exception will cause significant performance cost.
Click to expand...

So what is PCID? see text below from Intel SDM.

Process-context identifiers (PCIDs) are a facility by which a logical processor may cache information for multiple linear-address spaces. The processor may retain cached information when software switches to a different linear address space with a different PCID.When a logical processor creates entries in the TLBs and paging-structure caches, it associates those entries with the current PCID. When using entries in the TLBs and paging-structure caches to translate a linear address, a logical processor uses only those entries associated with the current PCID.

However, the PCID feature is only available on x64 mode (Intel IA-32e mode), which means only 64bit OS can use it.
Click to expand...

pamamolf · Jan 3, 2018

So a cpu that has PCID will not affected at all by this performance problem or it will but less?

eva2000 · Jan 3, 2018

pamamolf said: ↑

So a cpu that has PCID will not affected at all by this performance problem or it will but less?
Click to expand...

In theory PCID should reduce/lessen the performance drop but who knows.

from kernel github repo commit for PCID x86/mm: Use/Fix PCID to optimize user/kernel switches · torvalds/linux@6fd166a · GitHub

x86/mm: Use/Fix PCID to optimize user/kernel switches

We can use PCID to retain the TLBs across CR3 switches; including those now
part of the user/kernel switch. This increases performance of kernel
entry/exit at the cost of more expensive/complicated TLB flushing.

Now that we have two address spaces, one for kernel and one for user space,
we need two PCIDs per mm. We use the top PCID bit to indicate a user PCID
(just like we use the PFN LSB for the PGD). Since we do TLB invalidation
from kernel space, the existing code will only invalidate the kernel PCID,
we augment that by marking the corresponding user PCID invalid, and upon
switching back to userspace, use a flushing CR3 write for the switch.

In order to access the user_pcid_flush_mask we use PER_CPU storage, which
means the previously established SWAPGS vs CR3 ordering is now mandatory
and required.

Having to do this memory access does require additional registers, most
sites have a functioning stack and we can spill one (RAX), sites without
functional stack need to otherwise provide the second scratch register.

Note: PCID is generally available on Intel Sandybridge and later CPUs.
Note: Up until this point TLB flushing was broken in this series.
Click to expand...

So PCID available from Intel Sandybridge onwards i.e. Intel E3-1200v1, E5-1600v1, E5-2600v1 series etc outlined at Sandy Bridge - Wikipedia

eva2000 · Jan 3, 2018

More info and benchmarks from folks at Phoronix.com

Initial Benchmarks Of The Performance Impact Resulting From Linux's x86 Security Changes

Linux Gaming Performance Doesn't Appear Affected By The x86 PTI Work

For Now At Least AMD CPUs Are Also Reported As "Insecure"

AMD cpus don't have the bug but the Kernel fixes are treating AMD like Intel as having the bug !

Right now with the big mysterious security vulnerability causing the rush of the x86 Page Table Isolation work that landed in the Linux kernel days ago, it's believed to be a problem only affecting Intel CPUs. But at least for now the mainline kernel is still treating AMD CPUs as "insecure" and is too taking a performance hit.
Click to expand...

But over one week later, that patch has yet to be merged to the mainline kernel. When booting the Linux 4.15 kernel on an AMD EPYC box, indeed, for now the AMD CPU is still treated with a bug of "insecure_cpu."
Click to expand...

Performance penalties from single to double digits are expected on patched kernels. The penalty depends upon how much interaction the application/workload deals with the kernel if there's a lot of context switching and other activity. If it's a simple user-space application not doing much, the x86 PTI additions shouldn't cause much of an impact. Newer Intel CPUs with PCID should also help in ensuring less of a performance impact.
Click to expand...

redis before and after kernel level fixes

eva2000 · Jan 3, 2018

oh from For Now At Least AMD CPUs Are Also Reported As "Insecure" - Phoronix

you can disable kernel fixes too if you want to revert to previous performance at expense of security

An immediate workaround at least until the AMD patch lands where PTI isn't applied to AMD CPUs is by booting the kernel with the nopti kernel command-line parameter. This can also be applied to Intel systems too on a patched kernel if wanting to regain the performance and are not too concerned about this vulnerability.
Click to expand...

pamamolf · Jan 4, 2018

A bit more details for the exact command to use to disable it?

Thank you

eva2000 · Jan 4, 2018

pamamolf said: ↑

A bit more details for the exact command to use to disable it?

Thank you
Click to expand...

not a command to run but you need to edit the kernel command-line parameter. Only do this if you know what you're doing !

Revenge · Jan 4, 2018

It seems ARM Cpu's are also affected by this.

eva2000 · Jan 4, 2018

Revenge said: ↑

It seems ARM Cpu's are also affected by this.
Click to expand...

woah that's alot of cpus !

From Cloudlinux folks and KernelCare Intel CPU Bug - Meltdown and Spectre - KernelCare and CloudLinux

Update [Jan 3, 2017 6:54pm PT]

PoC for Spectre attack is publicly available. This is the attack that has no patches yet from any vendor, and might not be even possible to protect against

https://pastebin.com/A58h8N7y

Update [Jan 3, 2017 6:10pm PT]

We are mostlydone with CloudLinux 7 patches (full kernel, not KernelCare), but there are still several hours of work left before we can start testing them.

We also identified the areas that need to be modified for patches to be applicable by KernelCare and started to work on those areas.

We hope to release some CloudLinux kernels into beta tomorrow. We are yet to have ETA for KernelCare patches due to large size of the needed patch, and some critical areas that the patch affects.

Update [Jan 3, 2017 3:40pm PT]

We have succesfuly downloaded the sources for the patch for RHEL7, and started to work on them. Yet, please, don't expect any KC patches today. The patchset is complex, and it will take time to addopt it.
Click to expand...

eva2000 · Jan 4, 2018

Here is the problem Meltdown and Spectre

Spectre CVE-2017-5753 and CVE-2017-5715

Meltdown CVE-2017-5754

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider's infrastructure, it might be possible to steal data from other customers.
Click to expand...

Which systems are affected by Meltdown?
Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?
Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Which cloud providers are affected by Meltdown?
Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.

What is the difference between Meltdown and Spectre?
Meltdown breaks the mechanism that keeps applications from accessing arbitrary system memory. Consequently, applications can access system memory. Spectre tricks other applications into accessing arbitrary locations in their memory. Both attacks use side channels to obtain the information from the accessed memory location. For a more technical discussion we refer to the papers ( Meltdown and Spectre)

Why is it called Meltdown?
The bug basically melts security boundaries which are normally enforced by the hardware.

Why is it called Spectre?
The name is based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time.
Click to expand...

What are CVE-2017-5753 and CVE-2017-5715?
CVE-2017-5753 and CVE-2017-5715 are the official references to Spectre. CVE is the Standard for Information Security Vulnerability Names maintained by MITRE.

What is the CVE-2017-5754?
CVE-2017-5754 is the official reference to Meltdown. CVE is the Standard for Information Security Vulnerability Names maintained by MITRE.
Click to expand...

Where can I find official security advisories of involved/affected companies?

Link
Intel Security Advisory / Newsroom
Microsoft Security Guidance
Amazon Security Bulletin
ARM Security Update
Google Project Zero Blog
MITRE CVE-2017-5715 / CVE-2017-5753 / CVE-2017-5754
Red Hat Vulnerability Response
Click to expand...

eva2000 · Jan 4, 2018

Project Zero: Reading privileged memory with a side-channel

Reading privileged memory with a side-channel

Posted by Jann Horn, Project Zero

We have discovered that CPU data cache timing can be abused to efficiently leak information out of mis-speculated execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.

Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, we have exploits that work against real software. We reported this issue to Intel, AMD and ARM on 2017-06-01 [1].

So far, there are three known variants of the issue:

Variant 1: bounds check bypass (CVE-2017-5753)

Variant 2: branch target injection (CVE-2017-5715)

Variant 3: rogue data cache load (CVE-2017-5754)

Before the issues described here were publicly disclosed, Daniel Gruss, Moritz Lipp, Yuval Yarom, Paul Kocher, Daniel Genkin, Michael Schwarz, Mike Hamburg, Stefan Mangard, Thomas Prescher and Werner Haas also reported them; their [writeups/blogposts/paper drafts] are at:

Spectre (variants 1 and 2)

Meltdown (variant 3)

Click to expand...

Vendor statements
The following statement were provided to us regarding this issue from the vendors to whom Project Zero disclosed this vulnerability:
Intel
No current statement provided at this time.
AMD
AMD provided the following link: An Update on AMD Processor Security | AMD
ARM
Arm recognises that the speculation functionality of many modern high-performance processors, despite working as intended, can be used in conjunction with the timing of cache operations to leak some information as described in this blog. Correspondingly, Arm has developed software mitigations that we recommend be deployed.

Specific details regarding the affected processors and mitigations can be found at this website:Arm Processor Security Update – Arm Developer

Arm has included a detailed technical whitepaper as well as links to information from some of Arm’s architecture partners regarding their specific implementations and mitigations.
Click to expand...

From AMD An Update on AMD Processor Security | AMD

eva2000 · Jan 4, 2018

Redhat and thus CentOS Kernel Side-Channel Attacks - CVE-2017-5754 CVE-2017-5753 CVE-2017-5715 - Red Hat Customer Portal

Red Hat has been made aware of multiple microarchitectural (hardware) implementation issues affecting many modern microprocessors, requiring updates to the Linux kernel, virtualization-related components, and/or in combination with a microcode update. An unprivileged attacker can use these flaws to bypass conventional memory security restrictions in order to gain read access to privileged memory that would otherwise be inaccessible. There are 3 known CVEs related to this issue in combination with Intel, AMD, and ARM architectures. Additional exploits for other architectures are also known to exist. These include IBM System Z, POWER8 (Big Endian and Little Endian), and POWER9 (Little Endian).
Click to expand...

Impacted Products
Red Hat Product Security has rated this update as having a security impact of Important.

The following Red Hat product versions are impacted:

Red Hat Enterprise Linux 5

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Atomic Host

Red Hat Enterprise MRG 2

Red Hat OpenShift Online v2

Red Hat OpenShift Online v3

Red Hat Virtualization (RHEV-H/RHV-H)

Red Hat OpenStack (OSP) 6

Red Hat OpenStack (OSP) 7

Red Hat OpenStack (OSP) 8

Red Hat OpenStack (OSP) 9

Red Hat OpenStack (OSP) 10

Red Hat OpenStack (OSP) 11

Red Hat OpenStack (OSP) 12

While Red Hat's Linux Containers are not directly impacted by kernel issues, their security relies upon the integrity of the host kernel environment. Red Hat recommends that you use the most recent versions of your container images. The Container Health Index, part of the Red Hat Container Catalog, can always be used to verify the security status of Red Hat containers. To protect the privacy of the containers in use, you will need to ensure that the Container host has been updated against these attacks. Red Hat has released an updated Atomic Host for this use case.
Click to expand...

Take Action
Red Hat customers running affected versions of the Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the appropriate updates immediately. All impacted products should apply fixes to mitigate CVE-2017-5753 (variant 1) and CVE-2017-5754 (variant 3). CVE-2017-5715 (variant 2) can be exploited both locally and through the virtualization guest boundary.
Click to expand...

Mitigation
There is no known mitigation. All Red Hat customers should apply vendor solutions to patch their CPUs, and update the kernel as soon as patches are available.

Customers are advised to take a risk-based approach in mitigating this issue. Systems that require high degrees of security and trust should be addressed first, and should be isolated from untrusted systems until such time as treatments can be applied to those systems to reduce the risk of exploit.

Customers running Xen hypervisors should be aware of technical limitations of that software that cannot completely eliminate the variant 2 exploit, and cannot eliminate the variant 3 exploit on paravirtualized guests. Red Hat has prepared a Knowledgebase article detailing the Xen situation and options available to Xen hypervisor users.
Click to expand...

alot of the recommended actions/fixes are listed as just pending.

eva2000 · Jan 4, 2018

Linode official response for Spectre and Meltdown vulnerabilities Linode Blog » CPU Vulnerabilities: Meltdown & Spectre

A number of serious security vulnerabilities affecting many CPU architectures were disclosed this week (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754) by Google’s Project Zero team and others. Our team is working with vendors and our own engineers to determine the implications for our platform, but the expectation is that a fleet-wide reboot will be necessary to protect against these issues.

While we work through our response plan, please understand that due to the nature and seriousness of these issues a rapid response may be necessary. As always, we will provide as much advance notice as possible. We will communicate directly to you, with scheduling information, if a reboot of your Linodes is necessary.

We will continue to keep you updated here as more information becomes available.

More information regarding these security vulnerabilities can be found on the following sites:

Intel’s response

Google’s Project Zero post

meltdownattack.com

Documentation/x86/kaiser.txt

LWN: KAISER: hiding the kernel from user space

Click to expand...

eva2000 · Jan 4, 2018

Cloud infrastructure vendors including AWS, Microsoft, Google, DigitalOcean and Rackspace begin responding to chip kernel vulnerability
Cloud infrastructure vendors begin responding to chip kernel vulnerability

for DigitalOcean

DigitalOcean
“DigitalOcean has been actively investigating the Intel chip issue which was disclosed earlier today. We’ve been working to gather as much information as we can to ensure our customers remain protected. Intel unfortunately has not made it easy to get a full picture of the issue due to their information embargo.

At this time we are working under the assumption that this flaw will impact all of our customers and we’re presuming that rebooting Droplets (a DigitalOcean cloud server) will be necessary. We will be providing advanced notification to any and all customers impacted as we learn more.

This is a developing issue and we are unable to forecast timeframes for implementing a fix at this time.”

(See DigitalOcean’s blog post for additional details.)
Click to expand...

A Message About Intel Security Findings

Based on our investigation and the information we have received thus far, we believe that it may be necessary to reboot impacted customer Droplets. If reboots are determined to be the correct course of action for DigitalOcean users, we will schedule the urgent maintenance and notify impacted customers in advance.

We are continuing to monitor this situation and work with Intel to obtain more details. We’ll share updates in this blog post as additional information becomes available to us.
Click to expand...

eva2000 · Jan 4, 2018

Kernel panic! What are Meltdown and Spectre, the bugs affecting nearly every computer and device?

In modern architectures, there are inviolable spaces where data passes through in raw, unencrypted form, such as inside the kernel, the most central software unit in the architecture, or in system memory carefully set aside from other applications. This data has powerful protections to prevent it from being interfered with or even observed by other processes and applications.

Meltdown and Spectre are two techniques researchers have discovered that circumvent those protections, exposing nearly any data the computer processes, such as passwords, proprietary information, or encrypted communications.

Meltdown affects Intel processors, and works by breaking through the barrier that prevents applications from accessing arbitrary locations in kernel memory. Segregating and protecting memory spaces prevents applications from accidentally interfering with one another’s data, or malicious software from being able to see and modify it at will. Meltdown makes this fundamental process fundamentally unreliable.

Spectre affects Intel, AMD, and ARM processors, broadening its reach to include mobile phones, embedded devices, and pretty much anything with a chip in it. Which, of course, is everything from thermostats to baby monitors now.

It works differently from Meltdown; Spectre essentially tricks applications into accidentally disclosing information that would normally be inaccessible, safe inside their protected memory area. This is a trickier one to pull off, but because it’s based on an established practice in multiple chip architectures, it’s going to be even trickier to fix.
Click to expand...

Chips going back to 2011 were tested and found vulnerable, and theoretically it could affect processors as far back as those released in 1995. One would hope there aren’t too many of those in use, but we may be unpleasantly surprised on that count.

Because Meltdown and Spectre are flaws at the architecture level, it doesn’t matter whether a computer or device is running Windows, OS X, Android, or something else — all software platforms are equally vulnerable.

A huge variety of devices, from laptops to smartphones to servers, are therefore theoretically affected. The assumption going forward should be that any untested device should be considered vulnerable.

Not only that, but Meltdown in particular could conceivably be applied to and across cloud platforms, where huge numbers of networked computers routinely share and transfer data among thousands or millions of users and instances.

The good news is that the attack is easiest to perform by code being run by the machine itself — it’s not easy to pull this off remotely. So there’s that, at least.
Click to expand...

eva2000 · Jan 4, 2018

Microsoft update

Microsoft pushing out emergency fix for newly disclosed processor exploit

https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892

Improvements and fixes

This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include:

Addresses issue where event logs stop receiving events when a maximum file size policy is applied to the channel.

Addresses issue where printing an Office Online document in Microsoft Edge fails.

Addresses issue where the touch keyboard doesn’t support the standard layout for 109 keyboards.

Addresses video playback issues in applications such as Microsoft Edge that affect some devices when playing back video on a monitor and a secondary, duplicated display.

Addresses issue where Microsoft Edge stops responding for up to 3 seconds while displaying content from a software rendering path.

Addresses issue where only 4 TB of memory is shown as available in Task Manager in Windows Server version 1709 when more memory is actually installed, configured, and available.

Security updates to Windows SMB Server, the Windows Subsystem for Linux, Windows Kernel, Windows Datacenter Networking, Windows Graphics, Microsoft Edge, Internet Explorer, and the Microsoft Scripting Engine.

If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

For more information about the resolved security vulnerabilities, see the Security Update Guide.
Click to expand...

eva2000 · Jan 4, 2018

A more frank assessment of Meltdown and Spectre particularly in relation to Intel cpus We translated Intel's crap attempt to spin its way out of CPU security bug PR nightmare

By the way, here's what Linux kernel supremo Linus Torvalds had to sayabout this: "I think somebody inside of Intel needs to really take a long hard look at their CPUs, and actually admit that they have issues instead of writing PR blurbs that say that everything works as designed.

"Is Intel basically saying 'we are committed to selling you shit forever and ever, and never fixing anything'?"

What Intel described as "software analysis methods," security researchers describe thus: "Meltdown breaks all security assumptions given by the CPU’s memory isolation capabilities."
Click to expand...

on the kernel fixes and Kernel Page Table Isolation performance impact

The performance hit is due to implementing Kernel Page Table Isolation, or KPTI (previously called KAISER) to close the security hole. This pushes the kernel into a separate address space so it cannot be accessed at all by the running processes. The downside is that whenever an application needs the kernel to do something useful, such as read a file or send some network traffic, the CPU has to switch over to the kernel's virtual address space. This takes time, and doing it a lot will slow down the machine.
Click to expand...

It's a given for this particular issue that any slowdown is dependent upon the kind of work the affected system is being asked to do. Gamers will maintain their frame rates, but that's not what this is about. It's about enterprise workloads and data centers. With reports of SQL database slowdowns of up to 20 or so per cent, it seems premature to say the impact should not be significant. If a company's AWS, Microsoft Azure, or Google Cloud bill ends up being, say, three, five or eight per cent higher as a consequence of prolonged compute times, that's significant.

No doubt the patches will be benchmarked, and we'll write about them.
Click to expand...

Log in / Register

Forums

Learn about Centmin Mod LEMP Stack today

Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Learn about Centmin Mod LEMP Stack today

Security Intel Processor Flaw 'kernel memory leaking' [Spectre & Meltdown]

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.