davidgillon | Entries tagged with computer security

Umadoshi pointed out news of Meltdown, an OMG-you-are-fucking-kidding level computer security cock-up by Intel, and Spectre, an only marginally less severe version affecting AMD and ARM as well.

The NYT article covers the implications in a non-technical way, the Register article is better if you understand computer hardware/ software interaction. A second Register article has more details, confirms the vulnerability has been demonstrated, and looks at implications.

From the Register article:

At one point, Forcefully Unmap Complete Kernel With Interrupt Trampolines, aka FUCKWIT, was mulled by the Linux kernel team, giving you an idea of how annoying this has been for the developers.

Do not annoy operating system engineers with microcode-cockups, for they are unsubtle and swift to sarcasm.

Intel Cockups For Dummies summary as I interpret the Register articles:
The kernel is the memory space where your processor does all the secure stuff to access hardware, including holding stuff like passwords.
User processes shouldn't be able to access the kernel.
Every modern Intel processor tries to be clever and speculatively execute code it thinks may be needed next.
Unfortunately this speculative code can access the kernel memory before the processor checks whether it has the security rights to do that.
Hackers could theoretically force the speculative behaviour in such a way as to completely map kernel memory, including stuff like passwords.
Fixing it means completely isolating the kernel rather than pretending to isolate it as currently
This means it will take longer every time your computer needs to access the kernel
The performance hit may be up to 30%, but varying with applications. The suggestion is home users will be hit least

That's Meltdown, Spectre is slightly more arcane, but ultimately amounts to doing the same thing and affects Intel, AMD and ARM.

Linux and Windows updates are being rolled out urgently. A MacOS fix has already rolled out.
No need to panic, but make sure you install the next few security updates.