Fred'ô / En attendant la publication du de XSA-253 ( patch KPTI / KASLR ) : #meltdownattack

Pour plus d’information sur la faille qui va faire perdre des performances:

• XSA-253 :
  • https://xenbits.xen.org/xsa/ : Jeudi 04/01/2018 à midi.
• KPTI :
  • https://en.wikipedia.org/wiki/KPIT_Technologies .
  • https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/ .
• Performance :
  • https://www.phoronix.com/scan.php?page=article&item=linux-415-x86pti&num=2 : - 10% de performance .
• Le patch :
  • https://github.com/torvalds/linux/commit/a89f040fa34ec9cd682aed98b8f04e3c47d998bd#diff-678874d00bf0df04f6f427f16f1dea36R902 .

Many x86 CPUs leak information to user space due to missing isolation of user space and kernel space page tables. There are many well documented ways to exploit that.
The upcoming software migitation of isolating the user and kernel space page tables needs a misfeature flag so code can be made runtime conditional.
Add the BUG bits which indicates that the CPU is affected and add a feature bit which indicates that the software migitation is enabled.
Assume for now that _ALL_ x86 CPUs are affected by this. Exceptions can be made later.

On va donc attendre jeudi à midi.

J’ai l’impression que l’on va vendre du CPU dans les prochains mois … Misère.