Some workloads just took a hit on many Intel processors made in the last 10 years.
- stop the presses - looks like Intel might patch 90% of the processors less than 5 years old:
Guess that would not be most folks anyway.
https://newsroom.intel.com/news-releases/intel-issues-updates-protect-systems-security-exploits/
https://www.thomas-krenn.com/en/wiki/Safety_instructions_for_Meltdown_and_Spectre
https://git.kernel.org/pub/scm/linux/kernel/git/daveh/x86-kaiser.git/tree/Documentation/x86/kaiser.txt?h=kaiser-dynamic-414rc6-20171101
https://www.phoronix.com/scan.php?page=news_item&px=x86-PTI-EPYC-Linux-4.15-Test
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
https://www.qemu.org/2018/01/04/spectre/
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown
TLDR: Looks like kernel memory can probably be read by user space without a patch in kernel code.
Problem is, you pay a penalty for the patch in performance for some workloads.
Meltdown - side channel timing attack to learn kernel memory space secrets.
Spectre - predictive out of order CPU execution to work around slow memory fetches by malicious code to use timing differences from sequential and out-of-order executions - attacks memory from victim process.
Forcefully Unmap Complete Kernel With Interrupt Trampolines
i.e. FUCKWIT
Might want to enable some protection in your browsers:
Chrome:
chrome://flags/#enable-site-per-process
http://www.chromium.org/Home/chromium-security/site-isolation
https://www.chromium.org/Home/chromium-security/ssca
Firefox:
about:config?filter=privacy.firstparty.isolate
Light reading before you consider any of this below this line:
https://technet.microsoft.com/en-us/library/bb694007.aspx
Here is some code to check for the Windows - won't update without the new reg key:
import _winreg import sys # replace None with \computer-name for remote... rem_reg = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE) try: # change _winreg.KEY_WOW64_64KEY with _winreg.KEY_WOW64_32KEY for 32 bit systems... akey = _winreg.OpenKey(rem_reg, r'SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat', 0, _winreg.KEY_READ | _winreg.KEY_WOW64_64KEY) except WindowsError: print "Key not found or is WIN32" sys.exit(128) for i in range(0,_winreg.QueryInfoKey(akey)[1]): n, v, t = _winreg.EnumValue(akey, i) print i, n, v, t
Here is the same above as an exe:
Checker for 64 bit Windows -
reg key to add if not added by your non-existent Anti Virus software :-)
Now we have Foreshadow (2015 and later Intel only with the SGX extension)
8/15/2018 - If you have the SGX extension in your processor, there is a new (timing sorta) attack for that added but not thought out cpu "feature".
Details here https://www.intel.com/content/dam/www/public/us/en/documents/sa00115-microcode-update-guidance.pdf