Groups > linux.debian.user > #191772

Re: Kernel for Spectre and Meltdown

From	"tv.debian@googlemail.com" <tv.debian@googlemail.com>
Newsgroups	linux.debian.user
Subject	Re: Kernel for Spectre and Meltdown
Date	2018-01-30 16:40 +0100
Message-ID	<vdGaR-3HO-1@gated-at.bofh.it> (permalink)
References	(3 earlier) <vdeRk-2XQ-1@gated-at.bofh.it> <vdhma-4Fi-7@gated-at.bofh.it> <vdAI9-8u-1@gated-at.bofh.it> <vdC7f-1cY-5@gated-at.bofh.it> <vdE93-2sX-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 30/01/2018 18:52, Greg Wooledge wrote:
> On Tue, Jan 30, 2018 at 12:13:47PM +0100, Michael Lange wrote:
>> Michael Fothergill <michael.fothergill@gmail.com> wrote:
>>> The response from Greg was the following:
>>>
>>> On Thu, Jan 25, 2018 at 12:36:46PM +0000, Michael Fothergill wrote:
>>>> If I become sid and install the kernel correctly, could I go back to
>>> being
>>>> just buster (sounds like an energy drink) and carry on using the new
>>> kernel?
>>>
>>> No.
>>>
>>> *******************
>>>
>>> At that point I really did seem that:
>>>
>>> 1. I had no choice but to become sid/unstable here.
>>
>> I can only guess of course, I think probably they figured you would
>> upgrade your system to Sid, then compile a kernel and then *downgrade*
>> the system again to buster. The answer to that would clearly be "no".
>> But running a kernel compiled on a *different* Sid system on buster or
>> stretch is an entirely different thing of course.
> 
> Yes, that's correct.  If you actually "become sid" (upgrade your whole
> system to sid), there is no going back.
> 
> But you can set up a *separate* system (either an entirely new box,
> or a chroot into which you debootstrap sid, or a virtual machine, or a
> container, or whatever other fancy thing the kids are using these days),
> build a kernel .deb package there, *copy* that package to your buster
> system, and install it.
> 
> Or you can do what most of us are doing: wait for the Debian security
> team (and, really, for the entire *world*) to figure out how best to
> approach, mitigate, and/or solve the issues.
> 
> Meanwhile, I would recommend not letting random people get shell access
> to your critical systems.  Near as I can tell, exploiting a Spectre-type
> CPU vulnerability requires the ability to install and execute a program
> of the attacker's creation on the target system.  If you don't have
> users logging in and running commands, then you probably don't have to
> worry so much about this.  Unless I'm completely missing something.
> 
> (If you have users issuing commands on your system through some other
> vector, like a PHP web-app exploit, then that's a bigger issue you
> should address directly.)
> 

It should be possible to exploit Spectre via javascript, the prominent 
web browsers (G.Chrome/Chromium and Firefox) have already applied 
mitigation for this scenario. For G.Chrome/Chromium you can also use an 
experimental flag do harden site isolation (at the cost of memory 
consumption). But you can be sure the clever kids in their basements, 
the mafia networks and the state sponsored rogue agencies are hard at 
work trying to find novelty use for these new pathways to our systems. 
So patch, update, and be careful what emailed link you click on (hint: 
none).
In Debian we are lucky as far as I can judge, Stable received a backport 
of the Kaiser/kpti patches, and Sid has retpolined kernel and patched 
gcc (but still vulnerable to Spectre 1 just as everybody else on the 
planet).
On Stable and Backport kernel you are covered for Meltdown (for Intel 
cpu) but still vulnerable to Spectre. That will be the case as long as 
the gcc patches are not backported, or the Debian deities decide to 
break the taboo and issue a kernel and gcc bump for Stable, unlikely.

In Testing you are following Sid, remember there is no official security 
support for Testing outside of the very end of the pre-stable release 
freeze period. So you can cherry-pick what you want from Sid, or wait 
for the migration to naturally happen (if it has not happened yet, I 
don't know).
The cpu microcode side of things is a lot murkier, Intel is going back 
and forth with crappy code that crashes some systems, and the decision 
to apply or not those microcode updates is a tricky one. As for board 
vendors they don't seem to scramble to send updates out...

In any case right now there is no cause for alarm for the general public 
(IMHO), that may change if a working javascript exploit surfaces but it 
isn't here yet. If you are hosting virtual systems for distrusted 
clients (aren't they all) then you need to weight your options 
seriously, keeping in mind that when an efficient exploit surfaces it 
will be too late to patch.

All of the above is just my attempt at offering a synthesis of my 
experience, I am not working for US-CERT and I am not a DD, so you can 
ignore all of the above and go find out for yourself (the best way®).

Thread

Kernel for Spectre and Meltdown Dextin Jerafmel <jerafmel@yahoo.com> - 2018-01-29 09:10 +0100
  Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 10:00 +0100
    Re: Kernel for Spectre and Meltdown arne <sp113438@telfort.nl> - 2018-01-29 10:50 +0100
      Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-29 11:50 +0100
        Re: Kernel for Spectre and Meltdown arne <sp113438@telfort.nl> - 2018-01-29 13:30 +0100
    Re: Kernel for Spectre and Meltdown Jonathan Dowland <jmtd@debian.org> - 2018-01-29 10:50 +0100
    Re: Kernel for Spectre and Meltdown deloptes <deloptes@gmail.com> - 2018-01-29 11:20 +0100
      Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 12:40 +0100
        Re: Kernel for Spectre and Meltdown rhkramer@gmail.com - 2018-01-29 14:30 +0100
          Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 14:50 +0100
        Re: Kernel for Spectre and Meltdown deloptes <deloptes@gmail.com> - 2018-01-29 14:30 +0100
          Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 15:00 +0100
            Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 15:30 +0100
              Re: Kernel for Spectre and Meltdown rhkramer@gmail.com - 2018-01-29 16:50 +0100
                Re: Kernel for Spectre and Meltdown Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-29 17:20 +0100
                Re: Kernel for Spectre and Meltdown deloptes <deloptes@gmail.com> - 2018-01-29 18:40 +0100
                Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-29 19:10 +0100
                Re: Kernel for Spectre and Meltdown "Thomas Schmitt" <scdbackup@gmx.net> - 2018-01-29 19:40 +0100
                Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-29 20:00 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-30 20:40 +0100
                Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-30 22:50 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-30 23:10 +0100
                Re: Kernel for Spectre and Meltdown Elimar Riesebieter <riesebie@lxtec.de> - 2018-01-30 16:30 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-30 17:20 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-30 18:00 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-31 14:50 +0100
          Re: Kernel for Spectre and Meltdown Carl Fink <carl@finknetwork.com> - 2018-01-29 15:50 +0100
            Re: Kernel for Spectre and Meltdown deloptes <deloptes@gmail.com> - 2018-01-29 18:40 +0100
    Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-29 11:30 +0100
      Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 13:40 +0100
        Re: Kernel for Spectre and Meltdown Michael Stone <mstone@debian.org> - 2018-01-29 14:00 +0100
      Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-29 14:10 +0100
        Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-29 19:20 +0100
          Re: Kernel for Spectre and Meltdown deloptes <deloptes@gmail.com> - 2018-01-29 19:40 +0100
            Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-29 20:00 +0100
        Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-30 10:50 +0100
          Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-30 12:20 +0100
            Re: Kernel for Spectre and Meltdown Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-30 14:30 +0100
              Re: Kernel for Spectre and Meltdown Gene Heskett <gheskett@shentel.net> - 2018-01-30 14:50 +0100
              Re: Kernel for Spectre and Meltdown "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2018-01-30 16:40 +0100
              Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-31 19:20 +0100
                Re: Kernel for Spectre and Meltdown Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-31 19:30 +0100
                Re: Kernel for Spectre and Meltdown Michael Lange <klappnase@freenet.de> - 2018-01-31 19:40 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-31 23:40 +0100
                Re: Kernel for Spectre and Meltdown Richard Hector <richard@walnut.gen.nz> - 2018-01-31 23:50 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-01 00:10 +0100
                Re: Kernel for Spectre and Meltdown Richard Hector <richard@walnut.gen.nz> - 2018-02-01 00:20 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-01 00:50 +0100
              Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-01 13:10 +0100
                Re: Kernel for Spectre and Meltdown Andy Smith <andy@strugglers.net> - 2018-02-02 05:40 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-03 09:10 +0100
                Re: Kernel for Spectre and Meltdown rhkramer@gmail.com - 2018-02-03 15:50 +0100
                Re: Kernel for Spectre and Meltdown Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-02-03 16:40 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-03 18:10 +0100
                Re: Kernel for Spectre and Meltdown David Wright <deblis@lionunicorn.co.uk> - 2018-02-03 18:30 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-03 23:50 +0100
                Re: Kernel for Spectre and Meltdown David Wright <deblis@lionunicorn.co.uk> - 2018-02-03 18:20 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-03 23:10 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-03 23:10 +0100
                Re: Kernel for Spectre and Meltdown Andy Smith <andy@strugglers.net> - 2018-02-04 00:20 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-04 01:10 +0100
                Re: Kernel for Spectre and Meltdown Andy Smith <andy@strugglers.net> - 2018-02-04 16:30 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-05 00:10 +0100
                Re: Kernel for Spectre and Meltdown Michael Fothergill <michael.fothergill@gmail.com> - 2018-02-05 00:10 +0100
                Re: Kernel for Spectre and Meltdown rhkramer@gmail.com - 2018-02-04 05:30 +0100
    comment and new question--when do upgrades take effect  (was: Re: Kernel for Spectre and Meltdown) rhkramer@gmail.com - 2018-01-29 14:20 +0100
      Re: comment and new question--when do upgrades take effect  (was:  Re: Kernel for Spectre and Meltdown) Roberto C. Sánchez <roberto@debian.org> - 2018-01-29 14:50 +0100
      Re: comment and new question--when do upgrades take effect  (was:  Re: Kernel for Spectre and Meltdown) Joe <joe@jretrading.com> - 2018-01-29 14:50 +0100
        Re: comment and new question--when do upgrades take effect (was: Re:  Kernel for Spectre and Meltdown) Boyan Penkov <boyan.penkov@gmail.com> - 2018-01-29 15:40 +0100
          Re: comment and new question--when do upgrades take effect Richard Hector <richard@walnut.gen.nz> - 2018-01-30 00:20 +0100
            Re: comment and new question--when do upgrades take effect Boyan Penkov <boyan.penkov@gmail.com> - 2018-01-30 01:00 +0100
        Re: comment and new question--when do upgrades take effect  (was:  Re: Kernel for Spectre and Meltdown) David Wright <deblis@lionunicorn.co.uk> - 2018-01-29 17:20 +0100
      Re: comment and new question--when do upgrades take effect  (was:  Re: Kernel for Spectre and Meltdown) Andy Smith <andy@strugglers.net> - 2018-01-29 15:20 +0100
        Re: comment and new question--when do upgrades take effect Richard Owlett <rowlett@cloud85.net> - 2018-01-29 15:40 +0100
          Re: comment and new question--when do upgrades take effect Roberto C. Sánchez <roberto@debian.org> - 2018-01-29 15:40 +0100
            Re: comment and new question--when do upgrades take effect <tomas@tuxteam.de> - 2018-01-29 16:00 +0100
              Re: comment and new question--when do upgrades take effect Richard Owlett <rowlett@cloud85.net> - 2018-01-29 16:20 +0100
                Re: comment and new question--when do upgrades take effect David Wright <deblis@lionunicorn.co.uk> - 2018-01-29 16:50 +0100
        Re: comment and new question--when do upgrades take effect (side  question) Neo <neo@spacerat.ch> - 2018-01-29 17:10 +0100
      Re: comment and new question--when do upgrades take effect  (was:  Re: Kernel for Spectre and Meltdown) Michael Lange <klappnase@freenet.de> - 2018-01-29 19:20 +0100
  Re: Kernel for Spectre and Meltdown Bastien Durel <bastien@durel.org> - 2018-01-29 10:50 +0100

csiph-web