Six New Stable Linux Kernel Updates For Intel DOWNFALL & AMD INCEPTION

[phoronix]

Phoronix: Six New Stable Linux Kernel Updates For Intel DOWNFALL & AMD INCEPTION

As a result of the AMD INCEPTION and Intel DOWNFALL speculative execution vulnerabilities published this Patch Tuesday, Linux 6.5 Git quickly picked up the patches on embargo expiration and now there are six new stable point releases for back-porting these CPU security vulnerabilites to the supported stable kernel series...

https://www.phoronix.com/news/New-Linux-Stable-Downfall

[arekm]

Why GDS_FORCE_MITIGATION is "If in doubt, say N"?

[JMB9]

Why GDS_FORCE_MITIGATION is "If in doubt, say N"?

The mitigation (Intel DOWNFALL: CVE-2022-40982) is quite bad for performance - and
as no one will be responsible, the user should say he does not want the necessary mitigation
which is necessary if one does not want to lose any control over ones data, security keys ...

Normally, such CPUs should be swapped with correct ones by the company responsible
for such severe faults - but it is the new correct to have really expensive CPUs only to
be used in a secure way as paperweight.
As Linus Torvalds put it:
"Or is Intel basically saying "we are committed to selling you shit
forever and ever, and never fixing anything"?"
This was 01. Jan. 2018 - and it remains true ...

I have two bricks myself killer by prior mitigations (Haswell the latet one) - so no longer on Intel.
Lessons learnt ...

[carewolf]

The mitigation (Intel DOWNFALL: CVE-2022-40982) is quite bad for performance - and
as no one will be responsible, the user should say he does not want the necessary mitigation
which is necessary if one does not want to lose any control over ones data, security keys ...

Normally, such CPUs should be swapped with correct ones by the company responsible
for such severe faults - but it is the new correct to have really expensive CPUs only to
be used in a secure way as paperweight.
As Linus Torvalds put it:
"Or is Intel basically saying "we are committed to selling you shit
forever and ever, and never fixing anything"?"
This was 01. Jan. 2018 - and it remains true ...

I have two bricks myself killer by prior mitigations (Haswell the latet one) - so no longer on Intel.
Lessons learnt ...

You could choose not to download and run bad software you know. You don't have to pwn yourself, which is the only way these vulnerbilities affect you, unless you run a multiuser server. Could imagine Microsoft and Amazon being pissed though.

[alpha_one_x86]

ARM, RISC-V impacted?

[hf_139]

Oh wow!
Another vulnerability with a mitigation that drastically slows down your CPU?
Oh man! But not all!
If you buy now a new Intel™ 13th Generation Raptor Lake CPU, you are secure!
(until we release the next generation and decide to release a vulnerability for that one)
BUY your new CPU today!
NO REFUNDS

[yump]

You could choose not to download and run bad software you know. You don't have to pwn yourself, which is the only way these vulnerbilities affect you, unless you run a multiuser server. Could imagine Microsoft and Amazon being pissed though.

Of course! "don't run bad software." A thing that is very easy for users to do and doesn't interfere with normal use of the computer at all.

https://techcrunch.com/2023/07/27/hackers-are-infecting-call-of-duty-players-with-a-self-spreading-malware/

[pomac]

You could choose not to download and run bad software you know. You don't have to pwn yourself, which is the only way these vulnerbilities affect you, unless you run a multiuser server. Could imagine Microsoft and Amazon being pissed though.

[Q] What about web browsers?

[A] In theory, remotely exploiting this vulnerability from the web browser is possible. In practice, demonstrating successful attacks via web browsers requires additional research and engineering efforts.

from: https://downfall.page/

[fong38]

[Q] What about web browsers?

[A] In theory, remotely exploiting this vulnerability from the web browser is possible. In practice, demonstrating successful attacks via web browsers requires additional research and engineering efforts.

from: https://downfall.page/

But the solution is obvious, just don't visit any bad websites!

[Malsabku]

The first thing I do on every fresh Linux install is to add mitigations=off to the Grub parameters.