CSIRT-DCP-ALE-2018-001 : Différence entre versions

De Docaposte Cyberdéfense
Aller à : navigation, rechercher
(→‎Gestion du document)
 
(126 révisions intermédiaires par le même utilisateur non affichées)
Ligne 1 : Ligne 1 :
 
<div style="text-align: right">'''Bulletin d'alerte de sécurité du CSIRT DOCAPOST'''<br>Multiples vulnérabilités de fuite d’informations dans des processeurs<br>CSIRT-DCP-ALE-2018-001</div>
 
<div style="text-align: right">'''Bulletin d'alerte de sécurité du CSIRT DOCAPOST'''<br>Multiples vulnérabilités de fuite d’informations dans des processeurs<br>CSIRT-DCP-ALE-2018-001</div>
 +
 +
 +
<btn>
 +
Fichier:CSIRT-DCP-ALE-2018-01-v1.7.pdf|Télécharger la version PDF
 +
</btn>
  
 
==== <div style="background-color: #81BEF7">'''Gestion du document'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Gestion du document'''</div> ====
  
−
==== <div style="background-color: #81BEF7">'''Risque(e) / Impact(s)'''</div> ====
+
{| style="color: black; background-color: #ffffcc; width: 100%;"
 +
| style="width: 30%; background-color: white; text-align: left;"|
 +
Date de la première version : 
 +
| style="width: 70%; background-color: white;"|
 +
04/01/2018
 +
|-
 +
| style="width: 30%; background-color: white; text-align: left;"|
 +
Date de la dernière version : 
 +
| style="width: 70%; background-color: white;"|
 +
07/02/2018
 +
|-
 +
| style="width: 30%; background-color: white; text-align: left;"|
 +
Version : 
 +
| style="width: 70%; background-color: white;"|
 +
1.7
 +
|-
 +
| style="width: 30%; background-color: white; text-align: left;"|
 +
Source : 
 +
| style="width: 70%; background-color: white;"|
 +
Service de Lutte Contre La Cybercriminalité (SLCC La Poste)<br>
 +
Agence National de la Sécurité des Systèmes d'Information (ANSSI)<br>
 +
|}
 +
 
 +
==== <div style="background-color: #81BEF7">'''Risque(s) / Impact(s)'''</div> ====
 +
===== '''Score CVSS''' =====
 +
 
 +
{| style="color: black; background-color: #ffffcc; width: 100%;"
 +
| style="width: 10%; background-color: white; text-align: left;"|
 +
[[Fichier:Score.png]]
 +
| style="width: 70%; background-color: white;"|
 +
<btn size="xs"> 
 +
Score CVSS | Score de base :   
 +
Score CVSS |'''4.0'''
 +
Score CVSS |AV:'''L''' / AC:'''M''' / Au:'''S''' / C:'''P''' / I:'''N''' / A:'''N'''
 +
</btn><br>
 +
<btn size="xs">
 +
Score CVSS | Score temporel :
 +
Score CVSS |'''3.4'''
 +
Score CVSS |E:'''POC''' / RL:'''OF''' / RC:'''C'''
 +
</btn><br>
 +
<btn size="xs">
 +
Score CVSS | Score Environmental :
 +
Score CVSS |'''5.1'''
 +
Score CVSS |CDP:'''ND''' / TD:'''H''' / CR:'''H''' / IR:'''ND''' / AR:'''ND'''
 +
</btn>
 +
|}
 +
 
 +
===== '''Risque(s)''' =====
 +
* Atteinte à la confidentialité des données
 +
 
 +
===== '''Impact(s)''' =====
 +
 
 +
Les vulnérabilités décrites dans cette alerte peuvent impacter tous les systèmes utilisant un processeur vulnérable et donc de façon indépendante du système d'exploitation. Selon les chercheurs à l'origine de la découverte de ces failles, il est ainsi possible d'accéder à l'intégralité de la mémoire physique sur des systèmes Linux et OSX et à une part importante de la mémoire sur un système Windows.
 +
On notera que l'impact peut être plus particulièrement important dans des systèmes de ressources partagés de type conteneur (Docker, LXC) où il serait possible depuis un environnement restreint d'accéder à toutes les données présentes sur la machine physique dans lequel s'exécute le conteneur ou encore dans des environnements virtualisés utilisant la para-virtualisation de type Xen.
  
 
==== <div style="background-color: #81BEF7">'''Résumé de la vulnérabilité ou de la menace'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Résumé de la vulnérabilité ou de la menace'''</div> ====
 +
 +
*'''[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753 CVE-2017-5753]''' : Contournement des frontières. Un attaquant local pourrait l'exploiter afin de lire des portions arbitraires de 4GB de la mémoire du noyau via une application utilisateur spécialement conçue. Cette vulnérabilité, due à une lecture mémoire hors des limites dans la fonctionnalité d'optimisation processeur "Branch Prediction", est exploitable par l'attaque Spectre. Cette vulnérabilité existe sous condition que l'interpréteur ou moteur eBPF JIT soit activé par le noyau
 +
 +
*'''[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715 CVE-2017-5715]''' : "Branch target injection". Un attaquant en tant qu'invité privilégié (root) dans une machine virtuelle pourrait l'exploiter afin de lire des informations provenant de la mémoire de l'hôte via l'exécution d'une application spécialement formée en mode utilisateur l'invité. Cette vulnérabilité, due à des fuites de mémoire possible dans les caches pour la fonctionnalité d'optimisation processeur "Branch Prediction", est exploitable par l'attaque Spectre.
 +
 +
*'''[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754 CVE-2017-5754]''' : "Rogue data cache load". Un attaquant local pourrait l'exploiter afin d'obtenir des informations provenant du noyau via une application spécialement formée en mode utilisateur. Cette vulnérabilité, due à une mauvaise gestion des caches par certains CPU Intel, est exploitable par l'attaque MeltDown.
 +
  
 
==== <div style="background-color: #81BEF7">'''Vecteur(s) d'infection(s) / d'attaque(s)'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Vecteur(s) d'infection(s) / d'attaque(s)'''</div> ====
 +
 +
* Local à la machine
 +
* Navigateurs web
 +
 +
'''Campagne de pourriels'''
 +
 +
Le '''CERT-FR''' constate qu'une campagne de pourriels visant à distribuer des logiciels malveillants a été lancée afin de profiter de la situation autour des vulnérabilités Spectre et Meltdown. Des attaquants se faisant passer pour la Bundesamt für Sicherheit in der Informationstechnik (BSI), l'équivalent allemand de l'''ANSSI''', ont envoyé des courriers électroniques invitant leurs destinataires à se rendre sur une copie du site de la BSI. La différence avec le site officiel était une modification de l'alerte concernant les vulnérabilités: l'utilisateur était invité à installer un correctif qui se trouvait être un logiciel malveillant.
 +
 +
Le '''CSIRT DOCAPOST''' rappelle de faire preuve de la plus grande vigilance quant à l'ouverture des courriers électroniques ainsi que d'installer les correctifs de sécurité dans les plus brefs délais, et ce uniquement depuis les sources officielles des éditeurs.
  
 
==== <div style="background-color: #81BEF7">'''Système(s) affecté(s)'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Système(s) affecté(s)'''</div> ====
 +
 +
* Voir Section : '''Documentations et Informations Techniques'''
  
 
==== <div style="background-color: #81BEF7">'''Résumé'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Résumé'''</div> ====
  
−
==== <div style="background-color: #81BEF7">'''Contre(s) mesure(s)'''</div> ====
+
Plusieurs vulnérabilités ont été identifiées dans différents processeurs modernes d'Intel, ARM et AMD. Ces vulnérabilités ont été découvertes et exploitées dans le cadre de plusieurs recherches relatives aux attaques par canaux auxiliaire d'exécution spéculative, ces attaques sont les suivantes :
 +
 
 +
*Meltdown : Tous les CPU, trois preuves de concept privé existent (Google Project Zero)
 +
*Spectre : Intel, ARM et AMD, une preuve de concept privé existe (Google Project Zero).
 +
 
 +
'''Mise à jour du 23/01/2018''' : modification des recommandations suite au communiqué d'Intel (cf.
 +
'''Documentations et Informations Techniques''')
 +
 
 +
 
 +
===== '''VULNÉRABILITÉ MELTDOWN''' =====
 +
 
 +
 
 +
Les processeurs modernes intègrent plusieurs fonctionnalités visant à améliorer leurs performances. Parmi celles-ci, l'exécution dites out-of-order permet d'exécuter les instructions d'un programme en fonction de la disponibilité des ressources de calculs et plus nécessairement de façon séquentielle. Une faiblesse de ce mécanisme peut cependant conduire à l'exécution d'une instruction sans que le niveau de privilèges requis ne soit correctement vérifié au préalable. Bien que le résultat de l'exécution d'une telle instruction ne soit pas validé par la suite il peut être possible de récupérer l'information en utilisant une attaque par canaux cachés.
 +
 
 +
La vulnérabilité CVE-2017-5754 permet d'exploiter une fonctionnalité présente dans plusieurs architectures de processeurs modernes afin d'accéder en lecture à des zones mémoires d'un système autrement non accessibles sans des privilèges élevés. En particulier, l'exploitation de cette vulnérabilité permet d'accéder depuis un programme s'exécutant en mode utilisateur à la mémoire du système en mode noyau. Cela peut conduire à des fuites de données sensibles présentes en mémoire et peut inclure des informations d'autres programmes ou encore des clés de chiffrement. Cette fuite d'informations peut aussi être mise en œuvre pour faciliter la compromission d'un système.
 +
 
 +
 
 +
===== '''VULNÉRABILITÉ SPECTRE''' =====
 +
 
 +
 
 +
L'exécution spéculative est une seconde technique d'optimisation utilisée par les processeurs modernes.
 +
Lorsqu'un processeur est en attente d'une information de la part de la mémoire centrale, il peut continuer à exécuter des instructions de manière probabiliste afin de ne pas gâcher des cycles. Quand cette information arrive, le processeur vérifie la cohérence de son résultat anticipé. Dans le meilleur cas, il a gagné du temps car il a correctement prédit l'information. Dans le pire cas, il n'en a pas perdu car il reprend l'exécution de ses instructions avec la bonne information. Si le contenu des registres sont remis à leurs valeurs initiales, ce n'est pas le cas du cache.
 +
L'exemple donné dans l'article décrivant Spectre est le suivant:
 +
 
 +
if (x < array1_size)
 +
y = array2[array1[x] * 256];
 +
 
 +
Selon les bonnes pratiques, on teste si l'index est bien dans les limites du tableau avant d'y accéder. Or, si l'on a déjà demandé plusieurs fois d'accéder au tableau avec des valeurs légitimes, le processeur partira du principe que les valeurs demandées seront légitimes dans le cadre de l'exécution spéculative. Un attaquant pourra alors fournir une donnée erronée afin de provoquer un débordement de tampon. Une fois que le processeur exécutera réellement l'instruction, il se rendra compte de l'erreur, cependant le résultat de la lecture interdite restera dans le cache. Il faut ensuite récupérer cette information, ce qui n'est pas trivial.
 +
 
 +
Une autre manière d'exploiter Spectre est de forcer l'exécution spéculative à partir d'un autre processus. Le cas de figure le plus probable étant un hôte tentant d'obtenir des informations de la part de l'hyperviseur. Cette technique est la plus difficile à exploiter, mais également la plus difficile à contourner.
 +
 
 +
==== <div style="background-color: #81BEF7">'''Contre mesure(s)'''</div> ====
 +
 
 +
* Mise à jour des postes de travail Windows et Linux
 +
* Mise à jour des hyperviseurs afin de limiter les rebonds de machines virtuelles à machines virtuelles
 +
* Mise à jour des serveurs ayant un rôle d'administration
 +
 
 +
'''Attention : Pour les serveurs de production et d'applications il est préférable d'effectuer des tests de performances'''
 +
 
 +
* Voir Section : '''Documentations et Informations Techniques'''
  
 
==== <div style="background-color: #81BEF7">'''Mesure(s) réactive(s)'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Mesure(s) réactive(s)'''</div> ====
 +
 +
* Voir Section : '''Documentations et Informations Techniques'''
  
 
==== <div style="background-color: #81BEF7">'''IoC'''</div> ====
 
==== <div style="background-color: #81BEF7">'''IoC'''</div> ====
 +
 +
* '''N.C'''
  
 
==== <div style="background-color: #81BEF7">'''Documentations et informations techniques'''</div> ====
 
==== <div style="background-color: #81BEF7">'''Documentations et informations techniques'''</div> ====
 +
====='''CERT Announce'''=====
 +
 +
* CERT/CC:  [https://www.kb.cert.org/vuls/id/584653 Vulnerability Note VU#584653 - CPU hardware vulnerable to side-channel attacks]
 +
* US-CERT:  [https://www.us-cert.gov/ncas/alerts/TA18-004A TA18-004A - Meltdown and Spectre Side-Channel Vulnerability Guidance]
 +
* CERT-EU:  [http://cert.europa.eu/static/SecurityAdvisories/2018/CERT-EU-SA2018-001.pdf Security Advisory 2018-001 - Meltdown and Spectre Critical Vulnerabilities]
 +
* NCSC-UK:  [https://www.ncsc.gov.uk/guidance/meltdown-and-spectre-guidance Meltdown and Spectre guidance]
 +
* CERT-FR:  [https://www.cert.ssi.gouv.fr/alerte/CERTFR-2018-ALE-001/ CERTFR-2018-ALE-001 - Multiples vulnérabilités de fuite d’informations dans des processeurs]
 +
* CERT Nazionale:  [https://www.certnazionale.it/news/2018/01/04/moderni-processori-vulnerabili-ad-attacchi-side-channel/ Moderni processori vulnerabili ad attacchi side-channel](italian only)
 +
* CERT-PA:  [https://www.cert-pa.it/web/guest/news?id=9378 Meltdown e Spectre, vulnerabiliti sui microprocessori mettono potenzialmente a rischio informazioni sensibili] (Italian only)
 +
* CERT-GARR:  [https://www.cert.garr.it/en/alert-en/security-alerts/listid-1/mailid-1905-alert-gcsa-18001-vulnerabilita-meltdown-e-spectre ALERT GCSA-18001 - Vulnerability Meltdown e Spectre](italian only]
 +
* SingCERT:  Alert on Security Flaws Found in Central Processing Units (CPUs)  [https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-security-flaws-found-in-central-processing-units]
 +
* CERT.BE:  Architectural Design Flaws Central Processor Unit (CPU)  [https://www.cert.be/docs/central-processor-unit-cpu-architectural-design-flaws-30.html]
 +
* CERT-IS:  [https://www.cert.is/is/node/41.html Alvarlegur Çôryggisgalli Çð ÇôrgjÇôrvum - Meltdown/Spectre] (Icelandic only]
 +
* MyCERT:  [https://www.mycert.org.my/en/services/advisories/mycert/2018/main/detail/1301/index.html MA-691.012018: Alert - CPU Hardware Side-Channel Attacks Vulnerability]
 +
* CERT-BUND:  [https://www.bsi-fuer buerger.de/BSIFB/DE/Service/Aktuell/Informationen/Artikel/Meltdown_Spectre_Sicherheitsluecke_10012018.html Prozessor-Schwachstellen: Spectre und Meltdown] (German only)
 +
 +
====='''Spectre & Meltdown Checkers'''=====
 +
 +
(Use at your own risk )
 +
* Linux: Stéphane Lesimple [https://github.com/speed47/spectre-meltdown-checker put together] "a simple shell script to tell if your Linux installation is vulnerable against the 3" "speculative execution" "CVEs."]
 +
* Linux: [https://access.redhat.com/security/vulnerabilities/speculativeexecution Red Hat Check Script] Get the latest version from the diagnose tab of the main Red Hat vulnerability article.]
 +
* Linux: [https://packages.debian.org/stretch-backports/spectre-meltdown-checker?utm_source=dlvr.it&utm_medium=twitter Debian Spectre-Meltdown Checker] Spectre & Meltdown vulnerability/mitigation checker available in stretch-backports.
 +
* Microsoft Windows: See the #windows section in this document containing the link to the official Powershell script.
 +
 +
====='''PoCs'''=====
 +
 +
* In a [https://twitter.com/mlqxyz/status/950744467736354816 recent tweet] Moritz Lipp (Graz University of Technology has announced the release of their PoC implementations for Meltdown.
 +
* [https://github.com/iaik/meltdown GitHub repository]
 +
* In a [https://twitter.com/tehjh/status/950774905544507393 recent tweet] Jann Horn (Google's Project Zero has announced that the PoC code referenced in their recent blogpost about CPUs is now public.
 +
* The LSDS group at Imperial College London [https://github.com/lsds/spectre-attack-sgx has published sample code] demonstrating a Spectre-like attack against an Intel SGX enclave.
 +
* Dag-Erling published a [https://github.com/dag-erling/meltdown Meltdown PoC for FreeBSD].
 +
 +
====='''Antiviruses'''=====
 +
 +
Some Antiviruses do things that break when installing the Windows patches, therefore Microsoft doesn't automatically install the patches on those systems.
 +
 +
Vendor overview: https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLpzAtckQxYiuirADzf3cL42FQ/htmlview?usp=sharing&sle=true
 +
 +
* Trend Micro:  Important Information for Trend Micro Solutions and Microsoft January 2018 Security Updates [https://success.trendmicro.com/solution/1119183-important-information-for-trend-micro-solutions-and-microsoft-january-2018-security-updates Meltdown and Spectre]
 +
* Emsisoft: [https://blog.emsisoft.com/2018/01/04/chip-vulnerabilities-and-emsisoft-what-you-need-to-know/ Chip vulnerabilities and Emsisoft]: What you need to know
 +
* Sophos:  Advisory - Kernel memory issue affecting multiple OS [https://community.sophos.com/kb/en-us/128053 aka F..CKWIT, KAISER, KPTI, Meltdown & Spectre]
 +
* Webroot: [https://community.webroot.com/t5/Announcements/Microsoft-Patch-Release-Wednesday-January-3-2018/m-p/310146 Microsoft Patch Release] - Wednesday, January 3, 2018
 +
* McAfee: [https://securingtomorrow.mcafee.com/mcafee-labs/decyphering-the-noise-around-meltdown-and-spectre/ Decyphering the Noise Around Meltdown and Spectre] and [https://kc.mcafee.com/corporate/index?page=content&id=KB90167 Meltdown and Spectre Microsoft update (January 3, 2018) compatibility issue with anti-virus products]     
 +
* Kaspersky: [https://support.kaspersky.com/14042 Compatibility of Kaspersky Lab solutions] with the Microsoft Security update of January 9, 2018
 +
* ESET: [https://www.eset.com/us/about/newsroom/corporate-blog-list/corporate-blog/meltdown-spectre-how-to-protect-yourself-from-these-cpu-security-flaws/ Meltdown & Spectre]: How to protect yourself from these CPU security flaws
 +
* Avira: [https://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1925 With our latest product update 15.0.34.17] Avira Antivirus Free, Avira Antivirus Pro and Avira Antivirus Server are compatible with the Microsoft update
 +
* Symantec: [https://support.symantec.com/en_US/article.INFO4793.html Meltdown and Spectre]: Are Symantec Products Affected?
 +
* Avast: [https://blog.avast.com/meltdown-and-spectre-yes-your-device-is-likely-vulnerable Meltdown and Spectre]: Yes, your device is likely vulnerable
 +
* eScan: [http://blog.escanav.com/2018/01/meltdown-spectre-cpu-vulnerabilities/ Meltdown and Spectre CPU Vulnerabilities]
 +
* Bitdefender: [https://businessinsights.bitdefender.com/meltdown-and-spectre-decades-old-cpu-design-flaws-put-businesses-at-risk Meltdown and Spectre]: decades-old CPU design flaws put businesses at risk
 +
 +
====='''Linux upstream kernel'''=====
 +
 +
[https://en.wikipedia.org/wiki/Kernel_page-table_isolation#cite_note-:2-4 Kernel Page Table Isolation] is a mitigation in the Linux Kernel, originally named KAISER.
 +
 +
* [https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 Version 4.14.11] contains KPTI.
 +
* [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/?h=v4.15-rc6 Version 4.15-rc6] contains KPTI.
 +
* Longterm support kernels [https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.75 Version 4.9.75] and 4.4.110 [https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.110 contain KPTI backports.
 +
 +
====='''Noteworthy'''=====
 +
* Comment by kernel developer Andrew Lutomirski [https://news.ycombinator.com/item?id=16087736 that pre-4.14 kernels got an earlier version of KPTI and may contain bugs .
 +
* [https://archive.fo/ma8Iw Explanation of PCID] which will reduce performance impact of KPTI on newer kernels.
 +
 +
====='''minipli patches '''=====
 +
 +
minipli is an unofficial fork of the former grsecurity patches (original grsecurity is no longer publicly
 +
available . minipli is based on the longterm kernel 4.9, which supports KPTI since
 +
4.9.75, yet the patchset isn't ported yet.
 +
 +
* [https://github.com/minipli/linux-unofficial_grsec/issues/25 Bug report] with discussion about backporting KPTI
 +
 +
====='''Android'''=====
 +
 +
* Fixed with [https://source.android.com/security/bulletin/2018-01-01 Android Security Bulletin] January 2018.
 +
 +
====='''Windows'''=====
 +
 +
 +
* [https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv180002 Microsoft Advisory]
 +
* [https://support.microsoft.com/en-gb/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution-s Windows Server Guidance]and Windows Client Guidance [https://support.microsoft.com/en-gb/help/4073119/windows-client-guidance-for-it-pros-to-protect-against-speculative-exe . Note: both links include a Powershell tool to query the status of Windows mitigations for CVE-2017-5715 (branch target injection and CVE-2017-5754 (rogue data cache load .     
 +
*  Protecting guest virtual machines from CVE-2017-5715 (branch target injection [https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/CVE-2017-5715-and-hyper-v-vms
 +
* [https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/ Understanding] the performance impact of Spectre and Meltdown mitigations on Windows Systems
 +
* [https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/ Spectre mitigations in MSVC]
 +
 +
====='''Update - Tue 9 Jan 09:00 UTC'''=====
 +
 +
Microsoft has reports of some customers with AMD devices getting into an unbootable state after installing [https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892 this KB] . To prevent this issue, Microsoft will temporarily pause Windows OS updates to devices with impacted AMD processors (older CPUs, eg. Athlon and Sempron at this time. Microsoft is working with AMD to resolve this issue and resume Windows OS security updates to the affected AMD devices via Windows Update and WSUS as soon as possible. If you have experienced an unbootable state or for more information see [https://support.microsoft.com/en-us/help/4073707 KB4073707]. For AMD specific information please contact AMD.     
 +
 +
====='''Update - Sat 27 Jan'''=====
 +
 +
* [https://support.microsoft.com/en-us/help/4078130/update-to-disable-mitigation-against-spectre-variant-2 Update to Disable Mitigation] against Spectre, Variant 2
 +
 +
====='''Apple'''=====
 +
 +
 +
Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown.
 +
 +
* [https://support.apple.com/en-us/HT208394 Official statement]
 +
 +
====='''Update - Mon 8 Jan 18:00 UTC'''=====
 +
 +
Apple has released security improvements to Safari and WebKit to mitigate the effects of Spectre (CVE-2017-5753 and CVE-2017-5715) :
 +
* [https://support.apple.com/en-us/HT208397 macOS High Sierra 10.13.2] Supplemental Update
 +
* [https://support.apple.com/en-us/HT208403 Safari 11.0.2]for Mac OS X El Capitan 10.11.6 and macOS Sierra 10.12.6
 +
* [https://support.apple.com/en-us/HT208401 iOS 11.2.2 update]for iPhone and iPad
 +
 +
====='''Update - Sun 7 Jan 2018, 9:00 UTC'''=====
 +
 +
Based on the Apple's response posted [https://twitter.com/GraveSpy720/status/949489861886537728 here] Meltdown (CVE-2017-5754) is currently only addressed in iOS 11.2, macOS 10.13.2, and tvOS 11.2. Apple cannot say at this time if there will be updates to OS versions prior to the ones listed in their article at this time. The same can be said for Spectre (CVE-2017-5753 and CVE-2017-5715) and any updates for Safari. This means that at this given time there are NO patches for 10.11.x (El Capitan) or 10.12.x (Sierra).
 +
 +
====='''Linux distributions'''=====
 +
 +
* [https://access.redhat.com/security/vulnerabilities/speculativeexecution Red Hat Advisory]
 +
* [https://access.redhat.com/articles/3307751 Speculative Execution Exploit Performance Impacts] - Describing the performance impacts to security patches for CVE-2017-5754 CVE-2017-5753 and CVE-2017-5715
 +
* [https://access.redhat.com/security/vulnerabilities/speculativeexecution Red Hat Check Script] - Get the latest version from the diagnose tab of the main Red Hat vulnerability article.
 +
* CentOS:
 +
** 7 :
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022696.html CESA-2018:0007] (kernel)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022697.html CESA-2018:0012] (microcode_ctl)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022698.html CESA-2018:0014] (linux-firmware)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022705.html CESA-2018:0023] (qemu-kvm)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022704.html CESA-2018:0029] (libvirt)
 +
 +
**6 :
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022701.html CESA-2018:0008](kernel)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022700.html CESA-2018:0013] (microcode_ctl)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022702.html CESA-2018:0024] (qemu-kvm)
 +
***[https://lists.centos.org/pipermail/centos-announce/2018-January/022703.html CESA-2018:0030] (libvirt) 
 +
 +
** Fedora - Fixed in :
 +
***[https://bodhi.fedoraproject.org/updates/FEDORA-2018-8ed5eff2c0 FEDORA-2018-8ed5eff2c0] (Fedora 26)
 +
***[https://bodhi.fedoraproject.org/updates/FEDORA-2018-22d5fa8a90 FEDORA-2018-22d5fa8a90] (Fedora 27)
 +
 +
====='''Update - Wed 10 Jan 2018, 08:00 UTC'''=====
 +
*Fedora [https://bodhi.fedoraproject.org/updates/?packages=microcode_ctl has pushed to **testing**] new microcode_ctl packages for F26 [https://bodhi.fedoraproject.org/updates/FEDORA-2018-6b319763ab FEDORA-2018-6b319763ab] and F27 [https://bodhi.fedoraproject.org/updates/FEDORA-2018-7e17849364 FEDORA-2018-7e17849364]. They contain the update to upstream 2.1-15.20180108 and include fix for Spectre.   
 +
* Ubuntu (tl subsequent patches for *Spectre* are coming in the future before the kernels are pushed to official release branch dr: Patches for Meltdown now available
 +
 +
The first set of updates for 14.04 / 16.04 was broken on some systems, please make sure you update to the very latest kernel packages and avoid the broken ones.
 +
 +
====='''Update - Sun 7 Jan 2018, 22:00 UTC'''=====
 +
 +
Release candidate kernels 4.4.x (Trusty HWE / Xenial GA are now publicly available from a  and 4.13.x (Xenial HWE-edge / Artful GA / Artful HWE dedicated  [https://launchpad.net/~canonical-kernel-team/+archive/ubuntu/pti/ Launchpad PPA] and currently contain patches for CVE-2017-5754 *aka Meltdown*, with support only some architactures. Support for a broader array of architectures and patches for CVE-2017-5715 and CVE-2017-5753 *aka Spectre* are expected in the near future.
 +
 +
After some testing, the patched kernels will be pushed to the main release branch.
 +
 +
====='''Update - Mon 8 Jan 2018, 16:00 UTC'''=====
 +
 +
Canonical Ltd. announced that, in order to speed up the patching process for all supported distribution versions and branches, the 4.10.x *Xenial HWE* kernel will be migrated early to version 4.13.x, thus leaving no supported kernel branch exposed to vulnerabilities. The migration will occur concurrently to the push of patched kernels to the main distribution repositories.
 +
In addition, Ubuntu 17.04, aka *Zesty Zapus*, will [https://lists.ubuntu.com/archives/ubuntu-announce/2018-January/000227.html reach End Of Life] on Sat 13 Jan 2018 and will not receive any kind kernel patch support.
 +
 +
* [https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown Ubuntu Wiki SecurityTeam KnowledgeBase]
 +
* [https://insights.ubuntu.com/2018/01/04/ubuntu-updates-for-the-meltdown-spectre-vulnerabilities/ Ubuntu Insights blog] : Ubuntu Updates for the Meltdown / Spectre Vulnerabilities
 +
* 17.10: [https://usn.ubuntu.com/usn/usn-3523-1/ USN-3523-1]
 +
* 16.04: [https://usn.ubuntu.com/usn/usn-3522-1/ USN-3522-1]
 +
* 14.04: [https://usn.ubuntu.com/usn/usn-3522-2/ USN-3522-2]
 +
* 16.04/regression: [https://usn.ubuntu.com/usn/usn-3522-3/ USN-3522-3]
 +
* 14.04/regression: [https://usn.ubuntu.com/usn/usn-3522-4/ USN-3522-4]
 +
* "Details about CVE-2017-5753 (variant 1), aka[https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5753 Spectre]
 +
* "Details about CVE-2017-5715 (variant 2), aka [https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5715 Spectre]
 +
* "Details about CVE-2017-5754 (variant 3), aka [https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5754.html Meltdown]
 +
* Debian: Meltdown fixed in :
 +
**Stretch 4.9.65-3+deb9u2 : [https://security-tracker.debian.org/tracker/DSA-4078-1 DSA-4078-1]
 +
**Jessie 3.16.51-3+deb8u1 : [https://security-tracker.debian.org/tracker/DSA-4082-1 DSA-4082-1]
 +
**Wheezy 3.2.96-3 : [https://security-tracker.debian.org/tracker/DLA-1232-1 DLA-1232-1]
 +
 +
* "Details about CVE-2017-5753 (variant 1), aka [https://security-tracker.debian.org/tracker/CVE-2017-5753 Spectre]
 +
* "Details about CVE-2017-5715 (variant 2), aka [https://security-tracker.debian.org/tracker/CVE-2017-5715 Spectre]
 +
* "Details about CVE-2017-5754 (variant 3), aka [https://security-tracker.debian.org/tracker/CVE-2017-5754 Meltdown]
 +
 +
* Suse Linux : [https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/ SUSE Advisory]
 +
 +
* Scientific Linux:
 +
**7 :
 +
***[https://www.scientificlinux.org/category/sl-errata/slsa-20180007-1/ SLSA-2018:0007-1] (kernel)
 +
***[https://www.scientificlinux.org/category/sl-errata/slsa-20180012-1/ SLSA-2018:0012-1] (microcode_ctl)
 +
***[https://www.scientificlinux.org/category/sl-errata/slsa-20180014-1/ SLSA-2018:0014-1] (linux-firmware
 +
 +
** 6 :
 +
***[https://www.scientificlinux.org/category/sl-errata/slsa-20180008-1/ SLSA-2018:0008-1] (kernel)
 +
***[https://www.scientificlinux.org/category/sl-errata/slsa-20180013-1/ SLSA-2018:0013-1) (microcode_ctl)     
 +
 +
* CoreOS Container Linux: Fixes for Meltdown are [https://coreos.com/blog/container-linux-meltdown-patch available in all release channels now] (Alpha 1649.0.0, Beta 1632.1.0, Stable 1576.5.0 Auto-updated systems will receive the releases containing the patch on 2017-01-08. Spectre patches are still WIP.
 +
 +
* NixOS: According to [https://github.com/NixOS/nixpkgs/issues/33414 #33414] KPTI is in  [https://github.com/NixOS/nixpkgs/commit/1e129a3f9934ae62b77475909f6812f2ac3ab51f nixpkgs since 1e129a3]     
 +
* [https://lists.archlinux.org/pipermail/arch-security/2018-January/001110.html Arch Linux Advisory]
 +
 +
* Gentoo:
 +
** [https://wiki.gentoo.org/wiki/Project:Security/Vulnerabilities/Meltdown_and_Spectre Gentoo Wiki] : Project:Security/Vulnerabilities/Meltdown and Spectre
 +
*** [https://bugs.gentoo.org/643228 Bugtracker] - Bug#643228 - Security Tracking Bug
 +
 +
* Oracle Linux (ELSA Security Advisory :
 +
**Details about CVE-2017-5753 (variant 1) aka [https://linux.oracle.com/cve/CVE-2017-5753.html Spectre]
 +
**Details about CVE-2017-5715 (variant 2) aka [https://linux.oracle.com/cve/CVE-2017-5715.html Spectre]
 +
**Details about CVE-2017-5754 (variant 3) aka [https://linux.oracle.com/cve/CVE-2017-5754.html Meltdown]
 +
 +
* CloudLinux: [https://www.cloudlinux.com/cloudlinux-os-blog/entry/intel-cpu-bug-kernelcare-and-cloudlinux Intel CPU Bug] - Meltdown and Spectre - KernelCare and CloudLinux
 +
 +
* Parrot Security OS: [https://blog.parrotsec.org/meltdown-spectre-security-patches/ meltdown/spectre security patches]
 +
 +
* Tails: [https://tails.boum.org/security/Numerous_security_holes_in_3.3/index.en.html Tails 3.4] has been released . It contains the fix for Meltdown and partial mitigation for Spectre.
 +
* Manjaro: [https://forum.manjaro.org/t/kernel-page-table-isolation-kpti-severe-arm-intel-cpu-bug-hits-partly-amd/37506 Detail about Kernel Page-Table Isolation] patched with [https://forum.manjaro.org/t/stable-update-2018-01-05-kernels-kpti-plasma-calamares-tlp/37695 stable update 2018-01-05]
 +
 +
====='''FreeBSD'''=====
 +
 +
* [https://lists.freebsd.org/pipermail/freebsd-security/2018-January/009719.html Statement
 +
 +
====='''Virtualization'''=====
 +
 +
 +
* XEN - [https://xenbits.xen.org/xsa/advisory-254.html XSA-254] and Xen Project Spectre/Meltdown [https://blog.xenproject.org/2018/01/04/xen-project-spectremeltdown-faq/ FAQ] no patches yet     
 +
* QEMU - unofficial patch published [https://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00811.html here] [https://www.qemu.org/2018/01/04/spectre/ official blog post] discussion on [https://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00613.html qemu-devel]
 +
 +
* VMware :
 +
** vSphere status is tracked in [https://kb.vmware.com/s/article/52245 KB52245]
 +
*** [https://www.vmware.com/us/security/advisories/VMSA-2018-0004.html VMSA-2018-0004]
 +
***Update 01/13/18: All of the ESXi patches associated with VMSA-2018-0004 have been PULLED from the online repository after Intel notified VMware of faulty microcode updates for certain Haswell/Broadwell CPUs. Please see https://kb.vmware.com/s/article/52345 for affected systems & workaround for those applied microcode update until new updates are available from Intel.
 +
*** VMware currently advises patching to the levels provided in [https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html VMSA-2018-0002 .
 +
** VMware Appliance status is tracked in [https://kb.vmware.com/s/article/52264 KB52264]
 +
 +
* Red Hat Enterprise Virtualization - [https://access.redhat.com/solutions/3307851 Impacts of CVE-2017-5754, CVE-2017-5753, and CVE-2017-5715 to Red Hat Virtualization products]
 +
 +
* Citrix XenServer - [https://support.citrix.com/article/CTX231390 Citrix XenServer Multiple Security Updates]
 +
 +
* Nutanix:
 +
***Update - Wed 31 Jan 2018**
 +
***New Nutanix Security Advisory #0007 v9 - [http://download.nutanix.com/alerts/SecurityAdvisory07-v9.pdf Nutanix Side-Channel Speculative Execution Vulnerabilities]
 +
**Update - Wed 17 Jan 2018**
 +
***New Nutanix Security Advisory #0007 v7 - [http://download.nutanix.com/alerts/Security-***Advisory_07_v7.pdf Nutanix Side-Channel Speculative Execution Vulnerabilities]
 +
 +
**Update - Mon 8 Jan 2018**
 +
***New Nutanix Security Advisory #0007 v2 - [http://download.nutanix.com/alerts/Security-***Advisory_0007_v2.pdf Nutanix Side-Channel Speculative Execution Vulnerabilities]
 +
***Nutanix Security Advisory #0007 v1  [http://download.nutanix.com/alerts/Security-***Advisory_0007_v1.pdf Nutanix Side-Channel Speculative Execution Vulnerabilities]
 +
 +
* Virtuozzo - [https://virtuozzo.com/virtuozzo-addresses-intel-bug-questions/ Virtuozzo Addresses Intel Bug Questions]
 +
 +
* KVM: **Update - Tue 9 Jan 07:50 UTC** - Paolo Bonzini, KVM developer, posted [https://twitter.com/fagiolinux/status/950435721961144322 in a tweet]the following status update for CVE-2017-5715 (Spectre) :
 +
** Already in Linus's tree: clearing registers on vmexit
 +
** First wave of KVM fixes here: https://marc.info/?l=kvm&m=151543506500957&w=2
 +
** He is also mentioning that a full solution will require all the Linux parts to be agreed upon, but this will unblock the QEMU updates
 +
 +
====='''Browsers'''=====
 +
 +
 +
* Mozilla:  Mitigations landing for new class of timing attack [https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ blog post]
 +
**[https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/ Security Advisory 2018-01]
 +
**[https://www.mozilla.org/en-US/firefox/57.0.4/releasenotes/ Firefox mitigation update 57.0.4]
 +
 +
* Chrome: [https://www.chromium.org/Home/chromium-security/ssca Actions Required to Mitigate Speculative Side-Channel Attack Techniques]
 +
 +
* Microsoft Edge: [https://blogs.windows.com/msedgedev/2018/01/03/speculative-execution-mitigations-microsoft-edge-internet-explorer/ Mitigating speculative execution side-channel attacks in Microsoft Edge and Internet Explorer]
 +
 +
* Webkit : [https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/ (open source browser engine What Spectre and Meltdown Mean For WebKit)]
 +
 +
* Brave Browser:  New desktop release just out [https://twitter.com/brave/status/950613194933874688 0.19.131] with various security enhancements, including Strict Site Isolation support.
 +
** [https://github.com/brave/browser-laptop/releases/tag/v0.19.131dev Release Notes]
 +
 +
====='''Update Mon 8 Jan 2018, 13:00 UTC'''=====
 +
 +
[http://xlab.tencent.com/special/spectre/spectre_check.html Tencent's Xuanwu Lab] has released a web-based tool]that can detect whether your browser is vulnerable to Spectre Attack and can be easily exploited. Official [https://twitter.com/XuanwuLab/status/950345917013504001 tweet]
 +
 +
====='''Cloud Providers'''=====
 +
 +
* Amazon AWS: [https://aws.amazon.com/security/security-bulletins/AWS-2018-013/ Processor Speculative Execution Research Disclosure]
 +
* Google Cloud: [https://support.google.com/faqs/answer/7622138 Google Mitigations Against CPU Speculative Execution Attack Methods]
 +
* Microsoft Azure: [https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/ Securing Azure customers from CPU vulnerability]
 +
* DigitalOcean: [https://blog.digitalocean.com/a-message-about-intel-security-findings/ A Message About Intel Security Findings]
 +
* Scaleway/Online: [https://www.scaleway.com/meltdown-spectre-status/ Spectre and Meltdown vulnerabilities status]
 +
* Linode: [https://blog.linode.com/2018/01/03/cpu-vulnerabilities-meltdown-spectre/ CPU Vulnerabilities: Meltdown & Spectre]
 +
* Rackspace: [https://blog.rackspace.com/rackspace-is-tracking-vulnerabilities-affecting-processors-by-intel-amd-and-arm Rackspace is Tracking Vulnerabilities Affecting Processors by Intel, AMD and ARM]
 +
* OVH:
 +
**bug impacting x86-64 CPU : [https://www.ovh.co.uk/news/articles/a2570.meltdown-spectre-bug-x86-64-cpu-ovh-fully-mobilised Meltdown/Spectre OVH fully mobilised] (en)
 +
**Vunérabilités Meltdown/Spectre affectant les CPU x86-64 : [https://www.ovh.com/fr/blog/vulnerabilites-meltdown-spectre-cpu-x86-64-ovh-pleinement-mobilise/ OVH pleinement mobilisé]  (fr)
 +
***[https://twitter.com/olesovhcom/status/948518635320070144 Octave Klaba's (OVH CEO Twitter thread)]
 +
* Vultr: [https://www.vultr.com/news/Intel-CPU-Vulnerability-Alert/ Intel CPU Vulnerability Alert]
 +
* Hetzner: [https://wiki.hetzner.de/index.php/Spectre_and_Meltdown/en Spectre and Meltdown]
 +
* UpCloud: [https://www.upcloud.com/blog/intel-cpu-vulnerability-meltdown/ Information regarding the Intel CPU vulnerability Meltdown]
 +
* Heroku: [https://blog.heroku.com/meltdown-and-spectre-security-update Meltdown and Spectre Security Update]
 +
* Alibaba Cloud: [https://www.alibabacloud.com/forum/read-2878 Intel Processor Meltdown and Specter Security Vulnerability Bulletin] 
 +
* Zscaler: [https://www.zscaler.com/blogs/research/meltdown-and-spectre-vulnerabilities-what-you-need-know Meltdown and Spectre vulnerabilities : What you need to know]
 +
* Gandi: [https://news.gandi.net/en/2018/01/meltdown-and-spectre-vulnerabilities/ Meltdown and Spectre vulnerabilities]
 +
 +
====='''Chip Manufacturers / HW Vendors '''=====
 +
 +
* Intel: [https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr INTEL-SA-00088] - Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method] Intel Analysis of Speculative
 +
Execution Side Channels [https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf Whitepaper] Intel Issues Updates to Protect Systems from [https://newsroom.intel.com/news-releases/intel-issues-updates-protect-systems-security-exploits/ Security Exploits]  [https://newsroom.intel.com/news/firmware-updates-and-initial-performance-data-for-data-center-systems/ Firmware Updates and Initial Performance Data for Data Center Systems] [https://newsroom.intel.com/news/root-cause-of-reboot-issue-identified-updated-guidance-for-customers-and-partners/ Root Cause of Reboot Issue Identified Updated Guidance for Customers and Partners]
 +
* AMD: [https://www.amd.com/en/corporate/speculative-execution An Update on AMD Processor Security]
 +
* ARM: [https://developer.arm.com/support/security-update Security Update]
 +
* Arista: [https://www.arista.com/en/support/advisories-notices/security-advisories/4025-security-advisory-31 Security Advisories]
 +
* Raspberry Pi: [https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ Why Raspberry Pi isn't vulnerable to Spectre or Meltdown]
 +
* NVIDIA: [https://nvidia.custhelp.com/app/answers/detail/a_id/4609 Security Notice: Speculative Side Channels]
 +
**[https://nvidia.custhelp.com/app/answers/detail/a_id/4614 NVIDIA Shield Tablet Security Updates]
 +
**[https://nvidia.custhelp.com/app/answers/detail/a_id/4613 NVIDIA Shield TV Security Updates]
 +
**[https://nvidia.custhelp.com/app/answers/detail/a_id/4611 NVIDIA GPU Display Driver Security Updates]
 +
**[https://nvidia.custhelp.com/app/answers/detail/a_id/4617 NVIDIA Tegra Jetson TX2 L4T Security Updates]
 +
**[https://nvidia.custhelp.com/app/answers/detail/a_id/4616 NVIDIA Tegra Jetson TX1 L4T and Jetson TK1 L4T Security Updates]
 +
* Lenovo: [https://support.lenovo.com/it/en/solutions/len-18282 LEN-18282 - Reading Privileged Memory with a Side Channel]
 +
* IBM: [https://exchange.xforce.ibmcloud.com/collection/Central-Processor-Unit-CPU-Architectural-Design-Flaws-c422fb7c4f08a679812cf1190db15441 Architectural Design Flaws Central Processor Unit (CPU)], [https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/ Potential Impact on Processors in the POWER family]     
 +
* Huawei: [http://www.huawei.com/en/psirt/security-notices/huawei-sn-20180104-01-intel-en huawei-sn-20180104-01 - Statement on the Media Disclosure of a Security Vulnerability in the Intel CPU Architecture Design]
 +
* F5: [https://support.f5.com/csp/article/K91229003 K91229003] - Side-channel processor vulnerabilities CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754
 +
* Cisco [https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel CPU Side-Channel Information Disclosure Vulnerabilities]
 +
* Fortigate: [https://fortiguard.com/psirt/FG-IR-18-002 CPU hardware vulnerable to Meltdown and Spectre attacks]
 +
* Cumulus Linux: [https://support.cumulusnetworks.com/hc/en-us/articles/115015951667-Meltdown-and-Spectre-Modern-CPU-Vulnerabilities Meltdown and Spectre: Modern CPU Vulnerabilities]
 +
* Check Point:  Check Point Response to Meltdown and Spectre [https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122205 CVE-2017-5753, CVE-2017-5715, CVE-2017-5754]
 +
* Palo Alto Networks:  Information about Meltdown and Spectre findings [https://securityadvisories.paloaltonetworks.com/ PAN-SA-2018-0001]
 +
* HP Enterprise:  Side Channel Analysis Method Allows Improper Information Disclosure in Microprocessors [https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00039267en_us CVE-2017-5715, CVE-2017-5753, CVE-2017-5754], [https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us HPESBHF03805 Certain HPE products using Microprocessors from Intel, AMD, and ARM, with Speculative Execution, Elevation of Privilege and Information Disclosure]     
 +
* Juniper: [https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10842&actp=RSS 2018-01 Out of Cycle Security Bulletin: Meltdown & Spectre: CPU Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method] Meltdown & Spectre: [https://forums.juniper.net/t5/Security-Now/Meltdown-amp-Spectre-Modern-CPU-vulnerabilities/ba-p/317254 Modern CPU vulnerabilities]     
 +
* Infoblox: [https://support.infoblox.com/app/answers/detail/a_id/7346 #7346: Spectre/Meltdown Vulnerabilities - CVE-2017-5715, CVE-2017-5753, CVE-2017-5754](Login required)
 +
* FireEye:  FireEye Notice for [https://www.fireeye.com/blog/products-and-services/2018/01/fireeye-notice-for-meltdown-and-spectre-vulnerabilities.html CVE-2017-5754, CVE-2017-5753, and CVE-2017-5715 Meltdown and Spectre vulnerabilities], Community Protection Event (CPE : CPU Security Flaws) [https://community.fireeye.com/thread/2727 Spectre/Meltdown] (Login required]   
 +
* Symantec: [https://support.symantec.com/en_US/article.INFO4793.html Meltdown and Spectre]: Are Symantec Products Affected?
 +
* Dell: : Impact on Dell products Microprocessor Side-Channel Vulnerabilities [http://www.dell.com/support/article/us/en/19/sln308587/microprocessor-side-channel-vulnerabilities--cve-2017-5715--cve-2017-5753--cve-2017-5754---impact-on-dell-products?lang=en CVE-2017-5715, CVE-2017-5753, CVE-2017-5754]
 +
* Dell EMC: Impact on Dell EMC products (Dell Enterprise Servers, Storage and Networking Microprocessor Side-Channel Attacks [http://www.dell.com/support/article/us/en/04/sln308588/microprocessor-side-channel-attacks--cve-2017-5715--cve-2017-5753--cve-2017-5754---impact-on-dell-emc-products--dell-enterprise-servers--storage-and-networking-?lang=en (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754)]
 +
* NetApp: [https://security.netapp.com/advisory/ntap-20180104-0001/ NTAP-20180104-0001] - Processor Speculated Execution Vulnerabilities in NetApp Products
 +
* ASUS: [https://www.asus.com/News/V5urzYAT6myCC1o2 ASUS Motherboards Microcode Update] for Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method
 +
* Aruba Networks: [http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt ARUBA-PSA-2018-001] - Unauthorized Memory Disclosure through CPU Side-Channel Attacks
 +
* Pure Storage: [https://support.purestorage.com/Field_Bulletins/The_Meltdown_and_Spectre_CPU_Vulnerabilities Advisory] (login required)
 +
* Supermicro: [https://www.supermicro.com/support/security_Intel-SA-00088.cfm Security Vulnerabilities Regarding Side Channel Speculative Execution and Indirect Branch Prediction Information Disclosure]
 +
* A10 Networks: [https://www.a10networks.com/sites/default/files/Spectre_Meltdown-CVE-2017-5715_5753_5754.pdf SPECTRE/MELTDOWN - CVE-2017-5715/5753/5754]
 +
* Avaya: [https://downloads.avaya.com/css/P8/documents/101045884 Recent Potential CPU Vulnerabilities: Meltdown and Spectre]
 +
* RSA: Impact on RSA products 000035890 - Microprocessor Side-Channel Attacks [https://community.rsa.com/docs/DOC-85418 CVE-2017-5715, CVE-2017-5753, CVE-2017-5754] (login required)
 +
* Fujitsu: [http://www.fujitsu.com/global/support/products/software/security/products-f/jvn-93823979e.html CPU hardware vulnerable to side-channel attacks] [https://sp.ts.fujitsu.com/dmsp/Publications/public/Intel-Side-Channel-Analysis-Method-Security-Review-CVE2017-5715-vulnerability-Fujitsu-products.pdf 6 SPARC server models listed as t.b.d. p.9]     
 +
* Veritas Appliance: [https://www.veritas.com/support/en_US/article.100041496 Veritas Appliance Statement] on Meltdown and Spectre
 +
* Polycom: [https://support.polycom.com/content/dam/polycom-support/global/documentation/spectre-meltdown-vulnerability-1-1.pdf Security Advisory Relating to the Speculative Execution Vulnerabilities with some microprocessors]
 +
* Sonicwall: [https://www.sonicwall.com/en-us/support/product-notification/meltdown-and-spectre-vulnerabilities-a-sonicwall Meltdown and Spectre Vulnerabilities: A SonicWall Alert]
 +
* Aerohive Networks: [https://www.aerohive.com/support/security-center/product-security-announcement-aerohives-response-to-meltdown-and-spectre-jan-5-2018/ Aerohive's response to Meltdown and Spectre]
 +
* Barracuda Networks: [https://blog.barracuda.com/2018/01/05/barracuda-networks-security-advisory/ Security Advisory]
 +
* Netgate: [https://www.netgate.com/blog/an-update-on-meltdown-and-spectre.html An update on Meltdown and Spectre]
 +
* Silver Peak: [https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_-_meltdown-spectre.pdf Security Advisory]
 +
* Arbor Networks: [https://arbor.custhelp.com/app/answers/detail/a_id/4148 Security Advisory](requires support login)
 +
* Extreme Networks:
 +
**VN 2018-001 [https://extremeportal.force.com/ExtrArticleDetail?n=000018943 CVE-2017-5715, CVE-2017-5753 - Spectre]
 +
**VN 2018-002 [https://extremeportal.force.com/ExtrArticleDetail?n=000018944 CVE-2017-5754 - Meltdown]
 +
 +
* KEMP Technologies:  Meltdown And Spectre [https://support.kemptechnologies.com/hc/en-us/articles/115003789132-Meltdown-and-Spectre-CVE-2017-5754-CVE-2017-5753- CVE-2017-5754 & CVE-2017-5753]
 +
* Pulse Secure: CVE-2017-5715 (Branch Target Injection) AKA Spectre KB43597 - Impact of CVE-2017-5753 (Bounds Check bypass) AKA Spectre and CVE-2017-5754 [http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43597/?q=KB43597&l=en_US&fs=Search&pn=1&atype= Meltdown on Pulse Secure Products]     
 +
* Nokia: [https://alerts.alcatel-lucent.com/alerts/viewalert.cgi?alert_id=18572 Security Advisory](requires Nokia OLCS login)
 +
* Riverbed: [https://supportkb.riverbed.com/support/index?page=content&id=S31752 Meltdown/Spectre: Side Channel Attacks against X86 hardware and Linux Kernel](requires Riverbed Support Account)
 +
* Acer: [https://us.answers.acer.com/app/answers/detail/a_id/53104 Meltdown and Spectre security vulnerabilities]
 +
* Asus: [https://www.asus.com/News/YQ3Cr4OYKdZTwnQK ASUS Update on Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method]
 +
* Gigabyte: [https://www.gigabyte.com/MicroSite/481/intel-sa-00088.html BIOS update for Side Channel Analysis Security issue Mitigations]
 +
* Panasonic: [https://pc-dl.panasonic.co.jp/itn/vuln/g18-001.html Security information of vulnerability by Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method]
 +
* MSI: [https://www.msi.com/news/detail/OkG5SUMDBqXU6aat7V7mjK19PeY9USryNqafkIcVX9KrTL9kD4wPpTAxIJCC2sBeYjNfGz221AA2yAjPZIzXKw~~ MSI pushes out motherboard BIOS updates to tackle recent security vulnerabilities]
 +
* Toshiba: [https://support.toshiba.com/support/viewContentDetail?contentId=4015952 Intel, AMD & Microsoft Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method Security Vulnerabilities]
 +
* Vaio: [https://solutions.vaio.com/3316 Side Channel Analysis] (japanese only)
 +
* HP: [https://support.hp.com/us-en/document/c05869091 HPSBHF03573 rev. 4 - Side-Channel Analysis Method]
 +
 +
====='''CPU microcode'''=====
 +
 +
*Update - Wed 17 Jan 8:30 UTC
 +
**Red Hat is currently recommending that subscribers contact their CPU OEM vendor to download the latest microcode/firmware. Red Hat is no longer providing microcode to address Spectre variant 2, due to instabilities that are causing systems to not boot. More details can be found in [https://access.redhat.com/solutions/3315431 this article](subscription required)
 +
 +
*Update - Tue 9 Jan 21:50 UTC
 +
**Latest [https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File?product=122139 Intel microcode] update (released 1/8/2018 is 20180108. According to its release notes:
 +
 +
-- Updates upon 20171117 release --
 +
"IVT C0 (06-3e-04:ed"]428->42a
 +
"SKL-U/Y D0         (06-4e-03:c0"]ba->c2
 +
"BDW-U/Y E/F         (06-3d-04:c0"]25->28
 +
"HSW-ULT Cx/Dx         (06-45-01:72"]20->21
 +
"Crystalwell Cx (06-46-01:32"]17->18
 +
"BDW-H E/G         (06-47-01:22"]17->1b
 +
"HSX-EX E0         (06-3f-04:80"]0f->10
 +
"SKL-H/S R0         (06-5e-03:36"]ba->c2
 +
"HSW Cx/Dx         (06-3c-03:32"]22->23
 +
"HSX C0 (06-3f-02:6f"]3a->3b
 +
"BDX-DE V0/V1         (06-56-02:10"]0f->14
 +
"BDX-DE V2         (06-56-03:10"]700000d->7000011
 +
"KBL-U/Y H0         (06-8e-09:c0"]62->80
 +
"KBL Y0 / CFL D0 (06-8e-0a:c0"]70->80
 +
"KBL-H/S B0         (06-9e-09:2a"]5e->80
 +
"CFL U0 (06-9e-0a:22"]70->80
 +
"CFL B0 (06-9e-0b:02"]72->80
 +
"SKX H0 (06-55-04:b7"]2000035->200003c
 +
"GLK B0 (06-7a-01:01"]1e->22
 +
 +
====='''Update - Thu 4 Jan 2018, 15:30 UTC'''=====
 +
 +
It seems that the new Intel microcode archive (2017-12-15) provided with the latest Red Hat microcode_ctl update includes three new files: 06-3f-02, 06-4f-01, 06-55-04.
 +
 +
Based on what we know:
 +
1. it adds one new CPUID and two MSR for the variant of Spectre that uses indirect branches
 +
2. it forces LFENCE to terminate the execution of all previous instructions, thus having the desired effect for the variant of Spectre that uses conditional branches (out-of-bounds-bypass)
 +
 +
Those IDs belong to the following processor microarchitectures: Haswell, Broadwell, Skylake [https://software.intel.com/en-us/articles/intel-architecture-and-processor-identification-with-cpuid-model-and-family-numbers official reference]
 +
 +
====='''Update - Thu 4 Jan 2018, 16:30 UTC'''=====
 +
 +
Regarding AMD's microcode update: it seems to be only for EPYC (maybe Ryzen, not sure! . It uses a different bit than Intel's in the CPUID. It is also for Spectre with indirect branches. Previous microprocessors resolved it with a chicken bit. Please note that the same solution implemented at kernel level works for both Intel and AMD. and it only adds one of the two MSRs (IA32_PRED_CMD
 +
 +
====='''Update - Fri 5 Jan 2018, 03:35 UTC'''===== 
 +
 +
Debian Project package maintainers released an  "updated version of the intel-microcode package (version 2017-12-15) [https://packages.debian.org/sid/intel-microcode for the Sid] (unstable branch olny). Upon inspection, it seems to contain the same microcode additions observed in the Red Hat microcode_ctl update of Thu 4 Jan 2018, 15:30 UTC.
 +
 +
The package in compatible with all Debian-based distributions that support post-boot microcode updates.
 +
 +
====='''RDBMS'''=====
 +
 +
* SQL Server: [https://support.microsoft.com/en-us/help/4073225/guidance-for-sql-server SQL Server Guidance to protect] against speculative execution side-channel vulnerabilities
 +
 +
====='''NOSQL'''=====
 +
 +
* Elastic stack: [https://www.elastic.co/blog/performance-impact-of-meltdown-on-elasticsearch Performance Impact of Meltdown on Elasticsearch] [https://www.elastic.co/blog/elastic-cloud-and-meltdown Elastic Cloud and Meltdown]   
 +
* Couchbase: [https://blog.couchbase.com/speculative-execution-processor-vulnerabilities-meltdown-spectre-need-know/ Speculative Execution Processor] Vulnerabilities Meltdown and Spectre: What you need to know
 +
* ScyllaDB: [http://www.scylladb.com/2018/01/07/cost-of-avoiding-a-meltdown/ The Cost of Avoiding a Meltdown]
 +
* Redis Enterprise: [https://redislabs.com/blog/securing-redis-enterprise-meltdown-spectre-vulnerabilities/ Securing Redis Enterprise] from Meltdown and Spectre Vulnerabilities
 +
* Redis:
 +
**[https://gist.github.com/antirez/9e716670f76133ec81cb24036f86ee95 Meltdown fix] impact on Redis performances in virtualized environments
 +
 +
====='''Embedded Devices'''=====
 +
 +
 +
* Synology: [https://www.synology.com/en-us/support/security/Synology_SA_18_01 Synology-SA-18:01] Meltdown and Spectre Attacks
 +
* Opengear: [https://opengear.zendesk.com/hc/en-us/articles/115003797711-CVE-2017-5754-CVE-2017-5715-CVE-2017-5753-Meltdown-and-Spectre-CPU-Vulnerabilities CVE-2017-5754, CVE-2017-5715, CVE-2017-5753 - Meltdown and Spectre CPU Vulnerabilities]
 +
* QNAP: [https://www.qnap.com/en/security-advisory/nas-201801-08 NAS-201801-08] - Security Advisory for Speculative Execution Vulnerabilities in Processors
 +
 +
====='''Compilers'''=====
 +
 +
 +
* [https://support.google.com/faqs/answer/7625886 Google's Retpoline]: a software construct for preventing branch-target-injection](technical write-up
 +
* LLVM: An implementation is under review for official merge [https://reviews.llvm.org/D41723 here]
 +
* GCC: An implementation for GCC is available [http://git.infradead.org/users/dwmw2/gcc-retpoline.git/shortlog/refs/heads/gcc-7_2_0-retpoline-20171219 here]
 +
 +
==== <div style="background-color: #81BEF7">'''Gestion détaillée du document'''</div> ====
 +
 +
* 04/01/2018 : Serge Carpentier : 1.0 : Création
 +
* 05/01/2018 : Serge Carpentier : 1.2 : Ajout alerte pourriel
 +
* 05/01/2018 : Serge Carpentier : 1.5 : Mise à jour des contre-mesures
 +
* 06/02/2018 : Serge Carpentier : 1.6 : Mise à jour informations et documentations techniques
 +
* 07/02/2018 : Serge Carpentier : 1.7 : Import portail / Réorganisation du document

Version actuelle datée du 11 février 2018 à 20:43

Bulletin d'alerte de sécurité du CSIRT DOCAPOST
Multiples vulnérabilités de fuite d’informations dans des processeurs
CSIRT-DCP-ALE-2018-001


Télécharger la version PDF

Gestion du document

Date de la première version :

04/01/2018

Date de la dernière version :

07/02/2018

Version :

1.7

Source :

Service de Lutte Contre La Cybercriminalité (SLCC La Poste)
Agence National de la Sécurité des Systèmes d'Information (ANSSI)

Risque(s) / Impact(s)

Score CVSS

Score.png

Score de base :4.0AV:L / AC:M / Au:S / C:P / I:N / A:N

Score temporel :3.4E:POC / RL:OF / RC:C

Score Environmental :5.1CDP:ND / TD:H / CR:H / IR:ND / AR:ND
Risque(s)
  • Atteinte à la confidentialité des données
Impact(s)

Les vulnérabilités décrites dans cette alerte peuvent impacter tous les systèmes utilisant un processeur vulnérable et donc de façon indépendante du système d'exploitation. Selon les chercheurs à l'origine de la découverte de ces failles, il est ainsi possible d'accéder à l'intégralité de la mémoire physique sur des systèmes Linux et OSX et à une part importante de la mémoire sur un système Windows. On notera que l'impact peut être plus particulièrement important dans des systèmes de ressources partagés de type conteneur (Docker, LXC) où il serait possible depuis un environnement restreint d'accéder à toutes les données présentes sur la machine physique dans lequel s'exécute le conteneur ou encore dans des environnements virtualisés utilisant la para-virtualisation de type Xen.

Résumé de la vulnérabilité ou de la menace

  • CVE-2017-5753 : Contournement des frontières. Un attaquant local pourrait l'exploiter afin de lire des portions arbitraires de 4GB de la mémoire du noyau via une application utilisateur spécialement conçue. Cette vulnérabilité, due à une lecture mémoire hors des limites dans la fonctionnalité d'optimisation processeur "Branch Prediction", est exploitable par l'attaque Spectre. Cette vulnérabilité existe sous condition que l'interpréteur ou moteur eBPF JIT soit activé par le noyau
  • CVE-2017-5715 : "Branch target injection". Un attaquant en tant qu'invité privilégié (root) dans une machine virtuelle pourrait l'exploiter afin de lire des informations provenant de la mémoire de l'hôte via l'exécution d'une application spécialement formée en mode utilisateur l'invité. Cette vulnérabilité, due à des fuites de mémoire possible dans les caches pour la fonctionnalité d'optimisation processeur "Branch Prediction", est exploitable par l'attaque Spectre.
  • CVE-2017-5754 : "Rogue data cache load". Un attaquant local pourrait l'exploiter afin d'obtenir des informations provenant du noyau via une application spécialement formée en mode utilisateur. Cette vulnérabilité, due à une mauvaise gestion des caches par certains CPU Intel, est exploitable par l'attaque MeltDown.


Vecteur(s) d'infection(s) / d'attaque(s)

  • Local à la machine
  • Navigateurs web

Campagne de pourriels

Le CERT-FR constate qu'une campagne de pourriels visant à distribuer des logiciels malveillants a été lancée afin de profiter de la situation autour des vulnérabilités Spectre et Meltdown. Des attaquants se faisant passer pour la Bundesamt für Sicherheit in der Informationstechnik (BSI), l'équivalent allemand de lANSSI, ont envoyé des courriers électroniques invitant leurs destinataires à se rendre sur une copie du site de la BSI. La différence avec le site officiel était une modification de l'alerte concernant les vulnérabilités: l'utilisateur était invité à installer un correctif qui se trouvait être un logiciel malveillant.

Le CSIRT DOCAPOST rappelle de faire preuve de la plus grande vigilance quant à l'ouverture des courriers électroniques ainsi que d'installer les correctifs de sécurité dans les plus brefs délais, et ce uniquement depuis les sources officielles des éditeurs.

Système(s) affecté(s)

  • Voir Section : Documentations et Informations Techniques

Résumé

Plusieurs vulnérabilités ont été identifiées dans différents processeurs modernes d'Intel, ARM et AMD. Ces vulnérabilités ont été découvertes et exploitées dans le cadre de plusieurs recherches relatives aux attaques par canaux auxiliaire d'exécution spéculative, ces attaques sont les suivantes :

  • Meltdown : Tous les CPU, trois preuves de concept privé existent (Google Project Zero)
  • Spectre : Intel, ARM et AMD, une preuve de concept privé existe (Google Project Zero).

Mise à jour du 23/01/2018 : modification des recommandations suite au communiqué d'Intel (cf. Documentations et Informations Techniques)


VULNÉRABILITÉ MELTDOWN

Les processeurs modernes intègrent plusieurs fonctionnalités visant à améliorer leurs performances. Parmi celles-ci, l'exécution dites out-of-order permet d'exécuter les instructions d'un programme en fonction de la disponibilité des ressources de calculs et plus nécessairement de façon séquentielle. Une faiblesse de ce mécanisme peut cependant conduire à l'exécution d'une instruction sans que le niveau de privilèges requis ne soit correctement vérifié au préalable. Bien que le résultat de l'exécution d'une telle instruction ne soit pas validé par la suite il peut être possible de récupérer l'information en utilisant une attaque par canaux cachés.

La vulnérabilité CVE-2017-5754 permet d'exploiter une fonctionnalité présente dans plusieurs architectures de processeurs modernes afin d'accéder en lecture à des zones mémoires d'un système autrement non accessibles sans des privilèges élevés. En particulier, l'exploitation de cette vulnérabilité permet d'accéder depuis un programme s'exécutant en mode utilisateur à la mémoire du système en mode noyau. Cela peut conduire à des fuites de données sensibles présentes en mémoire et peut inclure des informations d'autres programmes ou encore des clés de chiffrement. Cette fuite d'informations peut aussi être mise en œuvre pour faciliter la compromission d'un système.


VULNÉRABILITÉ SPECTRE

L'exécution spéculative est une seconde technique d'optimisation utilisée par les processeurs modernes. Lorsqu'un processeur est en attente d'une information de la part de la mémoire centrale, il peut continuer à exécuter des instructions de manière probabiliste afin de ne pas gâcher des cycles. Quand cette information arrive, le processeur vérifie la cohérence de son résultat anticipé. Dans le meilleur cas, il a gagné du temps car il a correctement prédit l'information. Dans le pire cas, il n'en a pas perdu car il reprend l'exécution de ses instructions avec la bonne information. Si le contenu des registres sont remis à leurs valeurs initiales, ce n'est pas le cas du cache. L'exemple donné dans l'article décrivant Spectre est le suivant: 

if (x < array1_size)
y = array2[array1[x] * 256];

Selon les bonnes pratiques, on teste si l'index est bien dans les limites du tableau avant d'y accéder. Or, si l'on a déjà demandé plusieurs fois d'accéder au tableau avec des valeurs légitimes, le processeur partira du principe que les valeurs demandées seront légitimes dans le cadre de l'exécution spéculative. Un attaquant pourra alors fournir une donnée erronée afin de provoquer un débordement de tampon. Une fois que le processeur exécutera réellement l'instruction, il se rendra compte de l'erreur, cependant le résultat de la lecture interdite restera dans le cache. Il faut ensuite récupérer cette information, ce qui n'est pas trivial.

Une autre manière d'exploiter Spectre est de forcer l'exécution spéculative à partir d'un autre processus. Le cas de figure le plus probable étant un hôte tentant d'obtenir des informations de la part de l'hyperviseur. Cette technique est la plus difficile à exploiter, mais également la plus difficile à contourner.

Contre mesure(s)

  • Mise à jour des postes de travail Windows et Linux
  • Mise à jour des hyperviseurs afin de limiter les rebonds de machines virtuelles à machines virtuelles
  • Mise à jour des serveurs ayant un rôle d'administration

Attention : Pour les serveurs de production et d'applications il est préférable d'effectuer des tests de performances

  • Voir Section : Documentations et Informations Techniques

Mesure(s) réactive(s)

  • Voir Section : Documentations et Informations Techniques

IoC

  • N.C

Documentations et informations techniques

CERT Announce
Spectre & Meltdown Checkers

(Use at your own risk )

  • Linux: Stéphane Lesimple put together "a simple shell script to tell if your Linux installation is vulnerable against the 3" "speculative execution" "CVEs."]
  • Linux: Red Hat Check Script Get the latest version from the diagnose tab of the main Red Hat vulnerability article.]
  • Linux: Debian Spectre-Meltdown Checker Spectre & Meltdown vulnerability/mitigation checker available in stretch-backports.
  • Microsoft Windows: See the #windows section in this document containing the link to the official Powershell script.
PoCs
  • In a recent tweet Moritz Lipp (Graz University of Technology has announced the release of their PoC implementations for Meltdown.
  • GitHub repository
  • In a recent tweet Jann Horn (Google's Project Zero has announced that the PoC code referenced in their recent blogpost about CPUs is now public.
  • The LSDS group at Imperial College London has published sample code demonstrating a Spectre-like attack against an Intel SGX enclave.
  • Dag-Erling published a Meltdown PoC for FreeBSD.
Antiviruses

Some Antiviruses do things that break when installing the Windows patches, therefore Microsoft doesn't automatically install the patches on those systems.

Vendor overview: https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLpzAtckQxYiuirADzf3cL42FQ/htmlview?usp=sharing&sle=true

Linux upstream kernel

Kernel Page Table Isolation is a mitigation in the Linux Kernel, originally named KAISER.

Noteworthy
minipli patches

minipli is an unofficial fork of the former grsecurity patches (original grsecurity is no longer publicly available . minipli is based on the longterm kernel 4.9, which supports KPTI since 4.9.75, yet the patchset isn't ported yet.

  • Bug report with discussion about backporting KPTI
Android
Windows
Update - Tue 9 Jan 09:00 UTC

Microsoft has reports of some customers with AMD devices getting into an unbootable state after installing this KB . To prevent this issue, Microsoft will temporarily pause Windows OS updates to devices with impacted AMD processors (older CPUs, eg. Athlon and Sempron at this time. Microsoft is working with AMD to resolve this issue and resume Windows OS security updates to the affected AMD devices via Windows Update and WSUS as soon as possible. If you have experienced an unbootable state or for more information see KB4073707. For AMD specific information please contact AMD.

Update - Sat 27 Jan
Apple

Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown.

Update - Mon 8 Jan 18:00 UTC

Apple has released security improvements to Safari and WebKit to mitigate the effects of Spectre (CVE-2017-5753 and CVE-2017-5715) :

Update - Sun 7 Jan 2018, 9:00 UTC

Based on the Apple's response posted here Meltdown (CVE-2017-5754) is currently only addressed in iOS 11.2, macOS 10.13.2, and tvOS 11.2. Apple cannot say at this time if there will be updates to OS versions prior to the ones listed in their article at this time. The same can be said for Spectre (CVE-2017-5753 and CVE-2017-5715) and any updates for Safari. This means that at this given time there are NO patches for 10.11.x (El Capitan) or 10.12.x (Sierra).

Linux distributions
Update - Wed 10 Jan 2018, 08:00 UTC
  • Fedora has pushed to **testing** new microcode_ctl packages for F26 FEDORA-2018-6b319763ab and F27 FEDORA-2018-7e17849364. They contain the update to upstream 2.1-15.20180108 and include fix for Spectre.
  • Ubuntu (tl subsequent patches for *Spectre* are coming in the future before the kernels are pushed to official release branch dr: Patches for Meltdown now available

The first set of updates for 14.04 / 16.04 was broken on some systems, please make sure you update to the very latest kernel packages and avoid the broken ones.

Update - Sun 7 Jan 2018, 22:00 UTC

Release candidate kernels 4.4.x (Trusty HWE / Xenial GA are now publicly available from a and 4.13.x (Xenial HWE-edge / Artful GA / Artful HWE dedicated Launchpad PPA and currently contain patches for CVE-2017-5754 *aka Meltdown*, with support only some architactures. Support for a broader array of architectures and patches for CVE-2017-5715 and CVE-2017-5753 *aka Spectre* are expected in the near future.

After some testing, the patched kernels will be pushed to the main release branch.

Update - Mon 8 Jan 2018, 16:00 UTC

Canonical Ltd. announced that, in order to speed up the patching process for all supported distribution versions and branches, the 4.10.x *Xenial HWE* kernel will be migrated early to version 4.13.x, thus leaving no supported kernel branch exposed to vulnerabilities. The migration will occur concurrently to the push of patched kernels to the main distribution repositories. In addition, Ubuntu 17.04, aka *Zesty Zapus*, will reach End Of Life on Sat 13 Jan 2018 and will not receive any kind kernel patch support.

  • "Details about CVE-2017-5753 (variant 1), aka Spectre
  • "Details about CVE-2017-5715 (variant 2), aka Spectre
  • "Details about CVE-2017-5754 (variant 3), aka Meltdown
  • CoreOS Container Linux: Fixes for Meltdown are available in all release channels now (Alpha 1649.0.0, Beta 1632.1.0, Stable 1576.5.0 Auto-updated systems will receive the releases containing the patch on 2017-01-08. Spectre patches are still WIP.
  • Gentoo:
    • Gentoo Wiki : Project:Security/Vulnerabilities/Meltdown and Spectre
  • Oracle Linux (ELSA Security Advisory :
    • Details about CVE-2017-5753 (variant 1) aka Spectre
    • Details about CVE-2017-5715 (variant 2) aka Spectre
    • Details about CVE-2017-5754 (variant 3) aka Meltdown
  • CloudLinux: Intel CPU Bug - Meltdown and Spectre - KernelCare and CloudLinux
FreeBSD
Virtualization
  • KVM: **Update - Tue 9 Jan 07:50 UTC** - Paolo Bonzini, KVM developer, posted in a tweetthe following status update for CVE-2017-5715 (Spectre) :
    • Already in Linus's tree: clearing registers on vmexit
    • First wave of KVM fixes here: https://marc.info/?l=kvm&m=151543506500957&w=2
    • He is also mentioning that a full solution will require all the Linux parts to be agreed upon, but this will unblock the QEMU updates
Browsers
  • Brave Browser: New desktop release just out 0.19.131 with various security enhancements, including Strict Site Isolation support.
Update Mon 8 Jan 2018, 13:00 UTC

Tencent's Xuanwu Lab has released a web-based tool]that can detect whether your browser is vulnerable to Spectre Attack and can be easily exploited. Official tweet

Cloud Providers
Chip Manufacturers / HW Vendors
  • Intel: INTEL-SA-00088 - Speculative Execution and Indirect Branch Prediction Side Channel Analysis Method] Intel Analysis of Speculative

Execution Side Channels Whitepaper Intel Issues Updates to Protect Systems from Security Exploits Firmware Updates and Initial Performance Data for Data Center Systems Root Cause of Reboot Issue Identified Updated Guidance for Customers and Partners

CPU microcode
  • Update - Wed 17 Jan 8:30 UTC
    • Red Hat is currently recommending that subscribers contact their CPU OEM vendor to download the latest microcode/firmware. Red Hat is no longer providing microcode to address Spectre variant 2, due to instabilities that are causing systems to not boot. More details can be found in this article(subscription required)
  • Update - Tue 9 Jan 21:50 UTC
    • Latest Intel microcode update (released 1/8/2018 is 20180108. According to its release notes:
-- Updates upon 20171117 release -- 
"IVT C0		(06-3e-04:ed"]428->42a 
"SKL-U/Y D0	        (06-4e-03:c0"]ba->c2 
"BDW-U/Y E/F	        (06-3d-04:c0"]25->28 
"HSW-ULT Cx/Dx	        (06-45-01:72"]20->21 
"Crystalwell Cx	(06-46-01:32"]17->18 
"BDW-H E/G	        (06-47-01:22"]17->1b 
"HSX-EX E0	        (06-3f-04:80"]0f->10 
"SKL-H/S R0	        (06-5e-03:36"]ba->c2 
"HSW Cx/Dx	        (06-3c-03:32"]22->23 
"HSX C0		(06-3f-02:6f"]3a->3b 
"BDX-DE V0/V1	        (06-56-02:10"]0f->14 
"BDX-DE V2	        (06-56-03:10"]700000d->7000011 
"KBL-U/Y H0	        (06-8e-09:c0"]62->80 
"KBL Y0 / CFL D0	(06-8e-0a:c0"]70->80 
"KBL-H/S B0	        (06-9e-09:2a"]5e->80 
"CFL U0		(06-9e-0a:22"]70->80 
"CFL B0		(06-9e-0b:02"]72->80 
"SKX H0		(06-55-04:b7"]2000035->200003c 
"GLK B0		(06-7a-01:01"]1e->22
Update - Thu 4 Jan 2018, 15:30 UTC

It seems that the new Intel microcode archive (2017-12-15) provided with the latest Red Hat microcode_ctl update includes three new files: 06-3f-02, 06-4f-01, 06-55-04.

Based on what we know: 1. it adds one new CPUID and two MSR for the variant of Spectre that uses indirect branches 2. it forces LFENCE to terminate the execution of all previous instructions, thus having the desired effect for the variant of Spectre that uses conditional branches (out-of-bounds-bypass)

Those IDs belong to the following processor microarchitectures: Haswell, Broadwell, Skylake official reference

Update - Thu 4 Jan 2018, 16:30 UTC

Regarding AMD's microcode update: it seems to be only for EPYC (maybe Ryzen, not sure! . It uses a different bit than Intel's in the CPUID. It is also for Spectre with indirect branches. Previous microprocessors resolved it with a chicken bit. Please note that the same solution implemented at kernel level works for both Intel and AMD. and it only adds one of the two MSRs (IA32_PRED_CMD

Update - Fri 5 Jan 2018, 03:35 UTC

Debian Project package maintainers released an "updated version of the intel-microcode package (version 2017-12-15) for the Sid (unstable branch olny). Upon inspection, it seems to contain the same microcode additions observed in the Red Hat microcode_ctl update of Thu 4 Jan 2018, 15:30 UTC.

The package in compatible with all Debian-based distributions that support post-boot microcode updates.

RDBMS
NOSQL
Embedded Devices
Compilers
  • Google's Retpoline: a software construct for preventing branch-target-injection](technical write-up
  • LLVM: An implementation is under review for official merge here
  • GCC: An implementation for GCC is available here

Gestion détaillée du document

  • 04/01/2018 : Serge Carpentier : 1.0 : Création
  • 05/01/2018 : Serge Carpentier : 1.2 : Ajout alerte pourriel
  • 05/01/2018 : Serge Carpentier : 1.5 : Mise à jour des contre-mesures
  • 06/02/2018 : Serge Carpentier : 1.6 : Mise à jour informations et documentations techniques
  • 07/02/2018 : Serge Carpentier : 1.7 : Import portail / Réorganisation du document
Récupérée de « https://csirt.docapost.fr/index.php?title=CSIRT-DCP-ALE-2018-001&oldid=411 »