Blaming "Linux" for Intel Defects
-
Hacker News ☛ Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel [Ed: x86 should be deprecated; it's just cheating to fake performance.]
Cybersecurity researchers have disclosed what they say is the "first native Spectre v2 exploit" against the Linux kernel on Intel systems that could be exploited to read sensitive data from the memory.
-
Security Week ☛ Researchers Resurrect Spectre v2 Attack Against defective chip maker Intel CPUs
VUSec researchers resurrect Spectre v2 attack, showing that it works against the GNU/Linux kernel on the latest-generation defective chip maker Intel CPUs.
-
LinuxSecurity ☛ Native Spectre v2 Exploit Uncovered: Implications & Analysis for GNU/Linux Security Practitioners
The recently uncovered "Native Branch History Injection (BHI)" exploit against the GNU/Linux kernel marks a significant milestone in the ongoing battle against Spectre v2 vulnerabilities. Researchers have revealed that BHI can bypass existing Spectre v2/BHI mitigations to read sensitive data from the memory of defective chip maker Intel systems.
-
Bleeping Computer ☛ New Spectre v2 attack impacts Linux systems on Intel CPUs [Ed: It is an Intel defect, self-inflicted, rather than "Linux" issue; this is how Microsoft sites slant it.]
An update
A couple more (ARM also):
-
New Variant of Spectre Attack Bypasses Intel and Arm Hardware Mitigations
A team of researchers from the Vrije Universiteit Amsterdam in the Netherlands has demonstrated a new Spectre attack variant that can bypass hardware mitigations implemented in recent years by Intel and Arm.
-
Branch History Injection - vusec
BHI (or Spectre-BHB) is a revival of cross-privilege Spectre-v2 attacks on modern systems deploying in-hardware defenses. And we have a very neat end-to-end exploit leaking arbitrary kernel memory on modern Intel CPUs to prove it (PoC||GTFO right?). We started asking ourselves if hardware Spectre-v2 mitigations (Intel eIBRS and Arm CSV2) delivered on their promises of isolating different privilege domains in speculative execution land. The answer is “kind of”. They did deliver some isolation, but the isolation is incomplete. Hence, our kernel exploit: [...]
Another one:
-
Native Spectre v2 exploit puts defective chip maker Intel systems running GNU/Linux at risk
It's been some time since we discussed the initial Spectre security flaw that impacted numerous CPUs, and which was subsequently followed by the Spectre v2 vulnerability. Now there are new concerns following the discovery of the first native Spectre v2 exploit against the GNU/Linux kernel.
Late one:
-
Spectre's spooky sequel haunts Linux [Ed: The real issue here is Intel defects]
Tech boffins are quaking in their boots as the ghost of Spectre returns to haunt Linux systems.
Still going on 2 weeks later:
-
Understanding Spectre V2: A New Threat to Linux Systems
Recently, researchers uncovered a significant threat dubbed Spectre v2, a variant of the notorious Spectre attack, targeting Linux systems running on modern Intel processors. Let’s delve into the intricacies of this exploit, its implications, and the measures being taken to mitigate its impact.