Retpoline v5 Published For Fending Off Spectre Branch Target Injection

[audir8]

Also, it seems like the initial targets for Spectre have been the ebpf toolkit, and javascript VMs, the JIT compilers in both of them. Hopefully your browser has already updated itself.

[audir8]

GKH has a nice write up here of fixes so far: http://kroah.com/log/blog/2018/01/06/meltdown-status/

Seems like all the fixes for spectre will take a while, microcode updates, and gcc/llvm updates, and recompiling everything. Hopefully everyone will get microcode updates without the need for BIOS updates on desktops/laptops. As far as android phones go, now would be a good time to get lineage or paranoid android flashed on your phone. They will get the updates pushed to AOSP Kayote .

If you're on ubuntu+intel and can't wait to get the kernel meltdown fix, you can get 4.14.12 from kernel.org, copy a /boot/config-* to .config in the newly unzipped directory, do make olddefconfig && make -j* bindeb-pkg in the directory, and install the resulting 3 *.deb packages. Reboot, and you should be running the kernel with KPTI. To verify you can do: dmesg | grep 'page tables isolation'

[starshipeleven]

hence all this patches need to be backported to androids running 3.xx kernels is going to take a long time to update all those android devices, for a long time a lot will be exposed.

None will ever update that, it will be already great if new devices will have the fix in the next 2 years.

[carewolf]

The kernel, and all programs on systems that want their user space to have enforcing isolation. Without this, root exploits become trivial with local code execution. So then any system which has a risk of remote arbitrary code execution (anything with a web browser, email client, users, or network-accessible services) needs to have at a minimum all binaries that might be run by root recompiled in order to prevent Sally hijacking root, and all binaries that will be run by users recompiled to prevent Sally from hijacking Bob. Basically without this patch there's no longer meaningful posix groups, permissions, ACLs, namespaces, SELINUX or AppArmor.

Just to be clear, recompiling protects the recomplied binary only, not other parts of the system, so if you recompiled everything but the browser then users could hijack each other's browser, and trojans from another user could access your browser while it is running. This isn't a big deal for single-user systems where you can point the finger at yourself, but its a huge problem for shared systems with potentially mutually-untrusting users like CPanel accounts.

One of the reasons Linux users like to believe their systems are more secure than Windows is the set of isolation enforcing security mechanisms, all of which can be bypassed with branch target injection.

Retpoline solves one type of branch target injection. There will be more patches coming. Spectre affords a lot more opportunities than just branch target injection... this is going to be a very interesting year.

I've read that Nested Paging is unaffected by Spectre, so perhaps instead of KPTI (Kernel Page Table Isolation) we will have PPTPI (Per-Process Page Table Isolation) inside this year, and then Spectre attacks will be limited to attacks between threads of a process. The overhead will be significant but at least we'll have working isolation again. Until then, I recommend running your browser in Virtualbox and using its shared folder feature to share your Downloads folder with the VM, and if you are keeping documents that you want protected, run the related apps in another Virtualbox, snapshot the volumes daily, and keep backups on a NAS via crontab/rsync. It's a pain but I'd rather waste 30 seconds a day saving a snapshot than lose an entire day's (or worse) work.

Branch target injection? What part of the security issues allows writing? I thought this was all about reading.

[linuxgeex]

Only programs that run untrusted code and tries to implement user-level separation of memory, so browsers.

OR you can leave your browser unpatched and work-around it everything else, but why would you do that?

The kernel, and all programs on systems that want their user space to have enforcing isolation. Without this, root exploits become trivial with local code execution. So then any system which has a risk of remote arbitrary code execution (anything with a web browser, email client, users, or network-accessible services) needs to have at a minimum all binaries that might be run by root recompiled in order to prevent Sally hijacking root, and all binaries that will be run by users recompiled to prevent Sally from hijacking Bob. Basically without this patch there's no longer meaningful posix groups, permissions, ACLs, namespaces, SELINUX or AppArmor.

Just to be clear, recompiling protects the recomplied binary only, not other parts of the system, so if you recompiled everything but the browser then users could hijack each other's browser, and trojans from another user could access your browser while it is running. This isn't a big deal for single-user systems where you can point the finger at yourself, but its a huge problem for shared systems with potentially mutually-untrusting users like CPanel accounts.

One of the reasons Linux users like to believe their systems are more secure than Windows is the set of isolation enforcing security mechanisms, all of which can be bypassed with branch target injection.

Retpoline solves one type of branch target injection. There will be more patches coming. Spectre affords a lot more opportunities than just branch target injection... this is going to be a very interesting year.

I've read that Nested Paging is unaffected by Spectre, so perhaps instead of KPTI (Kernel Page Table Isolation) we will have PPTPI (Per-Process Page Table Isolation) inside this year, and then Spectre attacks will be limited to attacks between threads of a process. The overhead will be significant but at least we'll have working isolation again. Until then, I recommend running your browser in Virtualbox and using its shared folder feature to share your Downloads folder with the VM, and if you are keeping documents that you want protected, run the related apps in another Virtualbox, snapshot the volumes daily, and keep backups on a NAS via crontab/rsync. It's a pain but I'd rather waste 30 seconds a day saving a snapshot than lose an entire day's (or worse) work.

[andreano]

only kernel. programs do not share memory mappings with attacker

I don't follow you. Isn't the whole point of Spectre to read memory from one userspace program to another (not via the kernel)?

[pal666]

Every program.

only kernel. programs do not share memory mappings with attacker

[Kayote]

I'm guessing these patches will be back-ported to 4.14 or 4.15 once they're in 4.16-rc*. Which GCC versions (5.x, 6.x) will be getting the patches?

hence all this patches need to be backported to androids running 3.xx kernels is going to take a long time to update all those android devices, for a long time a lot will be exposed.

[carewolf]

Without getting too convoluted... Does every program have to be recompiled with the new GCC, or just the kernel?

Only programs that run untrusted code and tries to implement user-level separation of memory, so browsers.

OR you can leave your browser unpatched and work-around it everything else, but why would you do that?

[Mark Rose]

Without getting too convoluted... Does every program have to be recompiled with the new GCC, or just the kernel?

Every program.

https://support.google.com/faqs/answer/7625886