Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #190657
| From | The Wanderer <wanderer@fastmail.fm> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws |
| Date | 2018-01-04 18:40 +0100 |
| Message-ID | <v4hEK-dn-11@gated-at.bofh.it> (permalink) |
| References | <v4hv3-a1-7@gated-at.bofh.it> |
| Organization | This space intentionally left blank. |
[Multipart message — attachments visible in raw view] - view raw
On 2018-01-04 at 12:22, Curt wrote: > https://arstechnica.com/gadgets/2018/01/meltdown-and-spectre-every-modern-processor-has-unfixable-security-fladdws/U > > > TL;DR > > Windows, Linux, and macOS have all received security patches that > significantly alter how the operating systems handle virtual memory > in order to protect against a hitherto undisclosed flaw. > ... > In the immediate term, it looks like most systems will shortly have > patches for Meltdown. At least for Linux and Windows, these patches > allow end-users to opt out if they would prefer. The most vulnerable > users are probably cloud service providers; Meltdown and Spectre can > both in principle be used to further attacks against hypervisors, > making it easier for malicious users to break out of their virtual > machines. > ... > For typical desktop users, the risk is arguably less significant. > While both Meltdown and Spectre can have value in expanding the scope > of an existing flaw, neither one is sufficient on its own to, for > example, break out of a Web browser. > > Apparent moral of story for CPU: don't speculate (but it's > significantly *slower*). https://spectreattack.com/ has the best and most concise summary I've seen yet, as well as links to various other places for in-depth details (whitepapers and blog posts). The situation as I understand it is basically that: * Meltdown affects all Intel CPUs released since about 1995, except for Itanium models and pre-2013 Atom models. * Spectre appears to affect Intel, AMD, and ARM chips alike, going back who-knows-how-far. * Meltdown can be mitigated by security patches which people are rushing out, but doing so has a performance cost, anywhere from 5% to 30% depending on various factors. * Spectre can only be fixed (or even meaningfully mitigated) per-program, and doing so isn't necessarily trivial. * Meltdown is relatively easy and straightforward to trigger, once you know how. * Spectre is harder to trigger and/or exploit, but still possible. * Nobody knows whether either of these is being exploited in the wild. Also, https://techreport.com/news/33026/researchers-reveal-meltdown-and-spectre-cpu-exploits?post=1064251 is what looks to me like an "as near to layman's terms as we're likely to get" explanation of how the Spectre exploit actually works. -- The Wanderer The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man. -- George Bernard Shaw
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
“Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Curt <curty@free.fr> - 2018-01-04 18:30 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws The Wanderer <wanderer@fastmail.fm> - 2018-01-04 18:40 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-04 18:50 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws The Wanderer <wanderer@fastmail.fm> - 2018-01-04 19:00 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Tixy <tixy@yxit.co.uk> - 2018-01-04 19:20 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws The Wanderer <wanderer@fastmail.fm> - 2018-01-04 19:30 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Michael Fothergill <michael.fothergill@gmail.com> - 2018-01-04 19:40 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Nicholas Geovanis <nickgeovanis@gmail.com> - 2018-01-04 20:00 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Jack Dangler <tdldev@gmail.com> - 2018-01-05 13:50 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws <tomas@tuxteam.de> - 2018-01-05 14:00 +0100
Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws "Thomas Schmitt" <scdbackup@gmx.net> - 2018-01-05 14:50 +0100
Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws <tomas@tuxteam.de> - 2018-01-05 15:40 +0100
Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws "Thomas Schmitt" <scdbackup@gmx.net> - 2018-01-05 16:50 +0100
Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws <tomas@tuxteam.de> - 2018-01-05 17:10 +0100
[OFFTOPIC] Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws Stefan Monnier <monnier@iro.umontreal.ca> - 2018-01-05 19:10 +0100
Re: [OFFTOPIC] Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws SDA <marathon.durandal@gmail.com> - 2018-01-08 02:40 +0100
Re: [OFFTOPIC] Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws Curt <curty@free.fr> - 2018-01-08 11:30 +0100
Re: [OFFTOPIC] Re: "Meltdown" and "Spectre": Every modern processor has unfixable security flaws Tom Furie <tom@furie.org.uk> - 2018-01-08 13:10 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Nicholas Geovanis <nickgeovanis@gmail.com> - 2018-01-05 17:40 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws <tomas@tuxteam.de> - 2018-01-05 17:50 +0100
[OFFTOPIC] Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws Stefan Monnier <monnier@iro.umontreal.ca> - 2018-01-05 19:10 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws francis picabia <fpicabia@gmail.com> - 2018-01-04 19:10 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws bw <bwtnguy@yahoo.com> - 2018-01-04 19:20 +0100
Re: “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws The Wanderer <wanderer@fastmail.fm> - 2018-01-04 19:20 +0100
csiph-web