Slashdot Mirror

← Back to Stories (view on slashdot.org)

Meltdown and Spectre Patches Bricking Ubuntu 16.04 Computers (bleepingcomputer.com)

Posted by msmash on from the things-going-south dept.

An anonymous reader writes: Ubuntu Xenial 16.04 users who updated to receive the Meltdown and Spectre patches are reporting they are unable to boot their systems and have been forced to roll back to an earlier Linux kernel image. The issues were reported by a large number of users on the Ubuntu forums and Ubuntu's Launchpad bug tracker. Only Ubuntu users running the Xenial 16.04 series appear to be affected.

All users who reported issues said they were unable to boot after upgrading to Ubuntu 16.04 with kernel image 4.4.0-108. Canonical, the company behind Ubuntu OS, deployed Linux kernel image 4.4.0-108 as part of a security update for Ubuntu Xenial 16.04 users, yesterday, on January 9. According to Ubuntu Security Notice USN-3522-1 and an Ubuntu Wiki page, this was the update that delivered the Meltdown and Spectre patches.

16 of 233 comments (clear)

  1. Baby out with the bathwater by Lab+Rat+Jason · · Score: 5, Insightful

    It seems that these companies (Microsoft and Ubuntu and others) are forgetting everything about sound software development practices here. They're in such a hurry to deploy patches that they aren't taking the time to fully test them. The cure is worse than the ailment.

    --
    Which has more power: the hammer, or the anvil?
    1. Re:Baby out with the bathwater by king+neckbeard · · Score: 5, Insightful

      To be fair, there is a major security flaw covering the majority of desktop CPUs sold over the last two decades. You are correct that they have not done proper testing, but this is on a ridiculous scale.

      --
      This is my signature. There are many like it, but this one is mine.
    2. Re:Baby out with the bathwater by Merk42 · · Score: 5, Funny

      You know what's pushing this on the average Joe? DRM. Microsoft can't let those DRM keys leak... and now that the flaw is known, that's exactly what *could* happen. This isn't about user's data falling into evil-hacker's hands...

      Ah Slashdot, where a vulnerability from Intel and a bad patch from Canonical, is still, somehow, Microsoft's fault.

  2. Bricked!!?!?! Oh wow! by Anonymous Coward · · Score: 5, Insightful

    "have been forced to roll back to an earlier Linux kernel image."

    So, not actually bricked then...

    WORDS MEAN THINGS!

    1. Re:Bricked!!?!?! Oh wow! by AvitarX · · Score: 5, Interesting

      Doesn't this just mean pressing down in grub once, then setting it to use that kernel by default?

      This is barely even a slight annoyance.

      --
      Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
    2. Re:Bricked!!?!?! Oh wow! by El_Muerte_TDS · · Score: 5, Funny

      It's 2018, we have SmartBricks now. You can change the software of your SmartBricks.

    3. Re:Bricked!!?!?! Oh wow! by ThanatosMinor · · Score: 5, Funny

      Article title updated because we used the term "bricking" incorrectly. Bleeping Computer regrets the error.

      We apologise for the fault in the title. Those responsible have been sacked.

    4. Re:Bricked!!?!?! Oh wow! by GameboyRMH · · Score: 5, Insightful

      I would say that if a software hack, or even a simple hardware hack with common tools can fix it, it's not bricked. If you have to get out a JTAG adapter, then it's bricked.

      --
      "When information is power, privacy is freedom" - Jah-Wren Ryel
    5. Re:Bricked!!?!?! Oh wow! by religionofpeas · · Score: 5, Funny

      We apologise for the fault in the title. Those responsible have been sacked.

      You mean, they've been bricked.

    6. Re:Bricked!!?!?! Oh wow! by k.a.f. · · Score: 5, Informative

      Close, but no cigar. When you have to throw the device away, then it's bricked.

  3. Ultimate security by OrangeTide · · Score: 5, Funny

    Let those hackers try and get into my system now!

    --
    “Common sense is not so common.” — Voltaire
  4. Already fixed... by Anonymous Coward · · Score: 5, Informative

    Kernel 4.4.0-109, which fixes this problem, has already been pushed out.
    Apparently, the PTI fix was not quite backported correctly.
    For details, see https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1741934

  5. It is *NOT* bricking! by Qbertino · · Score: 5, Insightful

    Bricking is the equivalent of applying a killpoke. A software action that makes the hardware henceforth unusable.

    This just screws up the kernel and requires you to set up a fresh one, perhaps reinstalling the core system. On Linux this is usually nothing more than a minor annoyance.

    Again: it's not bricking. Bricking is when a software update or piece of code renders my smartphone not more useful than a brick and irreversibly so.

    Stop using the word just because it's new and describes something significant. It doesn't make your news more interesting, it makes your news false.

    Thank you.

    --
    We suffer more in our imagination than in reality. - Seneca
  6. Not bricked #2305473 by Fly+Swatter · · Score: 5, Informative

    Press down arrow at boot menu screen.

  7. Failed reboot is not "bricking" by Antique+Geekmeister · · Score: 5, Informative

    Failing to use a particular new kernel is not "bricking". Bricking, as commonly used, means the physical hardware is unrecoverable and needs to be replaced. Recovering a failed Ubuntu kernel means being able to select a different kernel to boot with. This means console access or access to the disk image. These are problematic and can disable production servers. But it's much less destructive than ruining the physical hardware.

  8. Re:A web page can now own your system by scdeimos · · Score: 5, Informative

    Meltdown cannot be exploited using Javascript.

    Yes it can, even WebKit says so...

    Meltdown means that userland code, such as JavaScript running in a web browser, can read kernel memory. Not all CPUs are affected by Meltdown and Meltdown is being mitigated by operating system changes. Mounting a Meltdown attack via JavaScript running in WebKit requires first bypassing branch-based security checks, like in the case of a Spectre attack. Therefore, Spectre mitigations that fix the branch problem also prevent an attacker from using WebKit as the starting point for Meltdown.

    REF: https://webkit.org/blog/8048/w...

    Most browser vendors are implementing many changes to mitigate Meltdown and Spectre, including things like reducing the precision of high-fidelity timers from 5us to 20us +/- 20us, disabling SharedArrayBuffers and recompiling with Spectre-aware compilers.