bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Linux: kernel and distributions protect against the Foreshadow/L1TF processor flaw

Summary

In August 2018 the processor flaw Foreshadow, also known as L1 Terminal Fault (L1TF), became known in many Intel CPUs; the Linux main branch and major distributions immediately provided protection. Anyone running third-party virtual machines also had to switch off hyper-threading, which could cost VMs up to 50 percent of their performance. The stable and longterm kernels appeared after less than 24 hours of review.

Ideas

  • Countermeasures had been prepared for months under confidentiality.
  • The fixes reached the main branch and all important stable branches on the same day.
  • For hypervisor operators an update was not enough; hyper-threading had to be switched off.
  • Systems without virtual machines hardly lost any performance.

Insights

  • Hardware flaws shift the cost of security into performance losses in software.
  • Shared processor cores are a trust boundary that has to be drawn deliberately.

Facts

  • The flaws are listed as CVE-2018-3615, CVE-2018-3620 and CVE-2018-3646.
  • Fixed versions included 4.18.1, 4.14.63, 4.9.120 and 4.4.148.
  • Processors from other manufacturers were not affected.
  • Full protection also required microcode updates for the processor.
  • New kernel parameters control L1TF protection; hyper-threading remains active by default.

References

Critique

  • The figure of up to 50 percent performance loss comes from “Linux circles” and is not substantiated.

Recommendations

  • Check the protection status of your systems under /sys/devices/system/cpu/vulnerabilities.
  • Disable SMT on hypervisors that run guests of different trust levels.

Read the original article

Search the Web Archive

hß · 2017

Linux 4.13: kernel handles TLS encryption itself

In 2017 Linux 4.13 was able to take over the encryption and decryption of a TLS connection itself for the first time. This was meant to improve performance and open up new uses. The complex connection setup, however, is still handled by libraries such as OpenSSL in user space.

hß · 2015

c’t Linux 2015: securing servers and long-term Linux distributions tested

The special issue c’t Linux 2015 brought together guides to securing servers and a comparison of ten distributions with long-term support. Further topics were Linux containers, Btrfs as the default file system, console tools and the X11 successor Wayland. In addition there was KDE Plasma 5, a comparison of mail clients and a DVD with eight distributions.

hß · 2010

Root privileges through Linux kernel bug [Update]

In 2010 Rafal Wojtczuk described a problem in Linux memory management in which the stack and shared memory segments could grow into each other. Using the X server as an example, Wojtczuk showed how an attacker could overwrite return addresses on the stack by writing to the shared memory and gain root privileges. The fix, a guard page between the stack and other areas, came in 2.6.32.19, 2.6.34.4 and 2.6.35.2, although SUSE had offered a fix as early as 2004.