Slashdot Mirror
Linux Kernel Gets Another Option To Disable Spectre Mitigations (zdnet.com)
Despite being more than one year old, the Meltdown or Spectre vulnerabilities have remained a theoretical threat, and no malware strain or threat actor has ever used any in a real-world attack. Over the course of the last year, system and network administrators have called on the Linux project for options to disable these protections. A report adds: Many argued that the threat is theoretical and could easily be mitigated with proper perimeter defenses, in some scenarios. Even Linus Torvalds has called for a slowdown in the deployment of some performance-hitting Spectre mitigations. The Linux kernel team has reacted positively towards these requests and has been slowly adding controls to disable some of the more problematic mitigations.
[...] The latest effort to have mitigations turned off -- and stay down -- is the addition of the PR_SPEC_DISABLE_NOEXEC control bit to the Linux kernel. This bit will prevent child processes from starting in a state where the protections for Spectre v4 are still activated, despite being deactivated in the parent process.
[...] The latest effort to have mitigations turned off -- and stay down -- is the addition of the PR_SPEC_DISABLE_NOEXEC control bit to the Linux kernel. This bit will prevent child processes from starting in a state where the protections for Spectre v4 are still activated, despite being deactivated in the parent process.
Intel chips cheated the most on security, and therefore got burned the hardest by this. Of course they pushed hard to add options to disable the mitigations so that their benchmarks could still look good.
That comment is a total red flag. Seems a little bit presumptuous.
Never exploited on a honeypot maybe, or never with with a exe.
The option should be at least available, but the claim it's never been used may be bs
First you find out your CPU fucks up by the numbers.
Then you mitigate.
Then you need multiple options to turn the mitigations off again.
What the fsck are you silly fscks on about?
I want a decent CPU. And a decent OS, while at it. Thanks.
Were talking well over a year since this made news, and yet we haven't seen anything remotely a threat in the wild that would cause most of us concern. Yet we were told the sky would fall upon us if we didn't patch. Not only was the threat over inflated, but in my opinion the negative effects of the fixes were also inflated to make news. Obviously the sky did not fall, and the internet never came to a crashing halt.
Spectre etc are dreadful if you're running a server with secrets on. Things that turn remote exploits into local ones are bad.
I don't want the slowdowns on compute machines though. It's not like there's remote access from anything untrusted anyway so the security holes aren't an issue.
SJW n. One who posts facts.
> Meltdown or Spectre vulnerabilities have remained a theoretical
> threat, and no malware strain or threat actor has ever used any in
> a real-world attack.
Really? Has Dr. Xavier been using Cerebro to divine this?
And thus the low IQ have anointed themselves as our prophets through the power of media.
There's always been kernel command line parameters to disable the mitigations.
Let's just forego getting vaccinations for any kid because kid's don't get sick from measles or other things any more.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
the power of media.
The media has no power. The audience chooses to be gullible. Then they can blame the 'tube' for their own lack of self control and absolve themselves of all responsibility.
Guys nobody gets measles anymore. That means we don't have to vaccinate against it anymore!
He's probably a doctor. They always claim that something is "incurable". In all of the universe forever. When really, they just haven't heard of the cure / read the research paper yet.
It's called having a God complex. (Or being one of the spying industry's professional liars.)
I don't see how the vulnerabilities could be so hard to use in the real world. Especially with things like WebAssembly and in-browser virtualization
Here's another possible way to work this in a low risk low hazard environment that makes the most sense to me.
1. Don't prevent it or impede it in any way.
2. Except, periodically poll the system state with a hypervisor that looks for evidence of timing based attacks. it could also scoop up row hammer attacks in the same way.
3. Freeze the processes and report them to the admin, and if you opt-in, report suspect behavior with code snippets or fingerprints to a central database
Some drink at the fountain of knowledge. Others just gargle.
This is about process-level options. Your workstation or server might have a server process that is network accessible, and another proces that is CPU-intensive. You probably do want to enable protection for your file sharing server process or IMAP; you probably want your ray tracer to run at full speed.
An example I've worked with many times is a web server that has videos in several bitrates or formats. In the background, it transcodes videos from whatever format they are in when they are uploaded. That's CPU intensive. You'd want protections on the web server daemon, probably wouldn't want to slow down the transcoding process by adding protections there.
The people have no say in the matter. Learn to serve the corporate state and its subsidiary corporation like a good goy.
One password of 9 ASCII characters can fit in one 64-bit long register.
Proof: 9 x 7-bit = 63-bit < 64-bit
I guess that must be news to all the secuirty firms, who have been seeing malware exploiting the spectre vulnerabilities (and adding antivirus definitions for) since the beginning of 2018. Methinks the post author has an axe to grind here with their truthy description.
Do people seriously expect malware authors to tout: "Hey look, we just used Spectre successfully and extracted a thousand private keys from software that ran on the same physical cloud servers than our malware!"...?
The thing with Spectre and Meltdown is that there is no need to alter the software on the (virtual) CPU cores the victim uses.
And the specifically precise Meltdown attacks out there now are captured and modified by less intense hackers to bother a wider range of systems. Then it's everybody's problem and the option to disable will not be an issue.
Do people seriously expect malware authors to tout: "Hey look, we just used Spectre successfully and extracted a thousand private keys from software that ran on the same physical cloud servers than our malware!"...?
No, people rely on the large security industry which analyses malware in detail to determine how it works and have identified that no known strains of Malware use this attack.
No surprise really either, it's not like this can be packaged in a general purpose attack. To pull this off in any meaningful way requires knowledge of the target detailed enough that there are easier attack vectors available.
You may be laughing, but no one else is.
It is only of interest if you are allowing any user to execute random code. Eg. desktops (JavaScript and the like) and cloud/virtual servers MAY be affected by it. But for the vast majority of servers and environments, if these bugs are exploited, you typically have bigger issues to fix.
Custom electronics and digital signage for your business: www.evcircuits.com
Really? It's almost as if a certain chip vendor would like to downplay the seriousness of their shite hardware design or something.
You're just actively fighting getting any of it.
And we're not forcing you. We've tried.
The cure is not fucking up your children. Esp. with crap pseudo-food, toxins in the environment, pedagogically incompetent immature "parents", and a degenerated cancerous "culture" of hailing the money god over literally ALL the things.
The kids are mostly already born super-smart. You're just intentionally ruining them because of clinging to your stupid cancerous cultural mindset.