AMD Inception "SRSO" Mitigation Cleanup & Fixes Head To Linux 6.5-rc7

[phoronix]

Phoronix: AMD Inception "SRSO" Mitigation Cleanup & Fixes Head To Linux 6.5-rc7

Earlier this month the AMD Inception vulnerability was disclosed and quickly mitigated within the mainline Linux kernel and back-ported to the stable kernels. In the rush to get the code merged and the mitigation being under embargo until the disclosure date, some bugs and clean-ups with the mitigation code were discovered. That revised code was now submitted today for merging ahead of the Linux 6.5-rc7 kernel release this weekend...

https://www.phoronix.com/news/AMD-Inception-Cleanups

[creative]

lscpu in a terminal for anyone who wants to check what mitigations they have applied.

[avis]

I wonder why AMD released the firmware to fix INCEPTION for its enterprise CPUs right away but the firmware for consumer parts is yet to be seen.

[timofonic]

I wonder why AMD released the firmware to fix INCEPTION for its enterprise CPUs right away but the firmware for consumer parts is yet to be seen.

It's a very bad situation, I hope an AMD representative writes about it here.

[smitty3268]

I wonder why AMD released the firmware to fix INCEPTION for its enterprise CPUs right away but the firmware for consumer parts is yet to be seen.

To be fair, it's mostly a concern for their large cloud consumers. Stuff that requires local execution rights to exploit isn't as urgent to fix on your average desktop machine.

[Ranguvar]

if someone really wants your info you have they are going to get it anyway

I strongly encourage anyone who has not become completely defeatist to trust the kernel maintainers and distros, and leave the mitigations enabled.

As annoying as these faults are, I'd rather have a computer that attempts to enforce code correctness and security boundaries, than a little more performance.

Meltdown and Zenbleed are much more practically dangerous than "traditional" Spectre.

Obviously if it's airgapped or a complete throwaway, the user can and should override.

all these patches are naive PR responses to exploit teams who think this exploit they found is somehow a vulnerability.

The engineers behind Linux, OpenBSD, Xen, Windows, Intel, and AMD, are not all providing patches as "naive PR responses".
They are doing so to correct real vulnerabilities, as real risks exist and can indeed be mitigated.

if it is on and connected to the internet, it is vulnerable no matter how many patches.

This is only true in theory. OpenBSD default server installs are incredibly secure, as are Qubes OS default client installs.