Meltdown & Spectre Information and Discussion

[Searchernow]

https://wiki.ubuntu.com/SecurityTeam/Kno...wn/TechFAQ

I doubt microcode updation will ever appear for anything older than Skylake, and though Intel is already facing over 30 litigations I expect class actions to branch out to include OEMs Dell, HP, Lenovo, and Asus. We've only just begun in Linux with retpoline and it's going to be an application by application case instance without microdode updation for older CPUs. Worse off MS is riddled with potential sleeper applications and the Spring update is probably going to kill off hordes of current Windows 10 users on machines older than Skylake who will find themselves unable to connect to their financial institutions.

TC

Thanks for all this info, some of which I think (!) I understand, a bit.

I'm using 2 laptops. My i5 CPUs are pre-Skylake ... not sure about the meaning of microcode issues, but I think you're saying it may become a serious problem for those on pre-Skylake cpu computers. Soon?

I use an i5 laptop (1) (single partition) windows 7 ( to run windows-based cad) and so far this year I've not had to go online with it and I don't intend to.

But it does get some files transferred to it (on SD cards or usb) from my i5 linux Lite laptop (2) (dual-boot) which I use online - Firefix & Chromium. I'm not sure if a Windows bug can get onto LL (2) then over to the other laptop (1) running win7?

Longer term - should I be putting money in a piggy-bank for a new computer? Or could I fit new CPU?

[newtusmaximus]

https://wiki.ubuntu.com/SecurityTeam/Kno...wn/TechFAQ

I doubt microcode updation will ever appear for anything older than Skylake, and though Intel is already facing over 30 litigations I expect class actions to branch out to include OEMs Dell, HP, Lenovo, and Asus. We've only just begun in Linux with retpoline and it's going to be an application by application case instance without microdode updation for older CPUs. Worse off MS is riddled with potential sleeper applications and the Spring update is probably going to kill off hordes of current Windows 10 users on machines older than Skylake who will find themselves unable to connect to their financial institutions.

TC

So what are we saying here please?  Are we saying, even with the patches from the recent Kernel update for LL, because of thepre skylake CPUs, our  older machines are still vulnerable  even when J's  test reports no vulnerabily.

I.e ALL older hardware is now "junk" if used "online".

Can not the anti virus / malware boys evolve their products to screen for "code" that  would exploit these vulnerabilities.?

Very confused as to what all this will mean for the average user.  Does it mean online shopping/ banking etc is potentially now a nono!! ??

[trinidad]

The link below is one of the better explanations of the retpoline mitigation.

https://support.google.com/faqs/answer/7625886

This link is the "claimed" status of Intel's micocode updation which should be taken sceptically not optimistically.

https://newsroom.intel.com/wp-content/up...idance.pdf

This is from my 5year old AMD A8 HP.

https://imgur.com/a/bWhLr

TC

[trinidad]

News

1) Well Intel has made stable microcode available now as far back as Sandy Bridge, however OEM's Dell and HP are still lagging behind in the implementations. Microsoft continues to be ahead of the curve on the whole issue though the latest updations have install issues as well due to the lagging OEM implementations. I have succeeded with a couple of W10 Dell Sandy Bridge boxes but it cannot be done without resorting to the CLI so everyday users are unlikely to install the mc mitigations.

2) New security studies from AMD are dismal for some of their CPU's. See the link below.

https://www.amdflaws.com/

3) Being a regular Debian user I am a bit spoiled when it comes to updates. Debian stable is slow and methodical about such things. But I also use both Ubuntu and LL where update schedules are far denser and hectic. I have to remind myself that so many of the current issues are linked to S/M and Intel. Ubuntu has been on top of the issues since they began and the devs have worked very hard to deal with the changes for their users. Updation was not always so intense with Linux in general, but it is good to remember that Linux is a community and as such more in touch with its own reality in more diverse ways than any corporate entity could ever hope to be. It is discouraging what corporate OEMs have done to everyday people, but it is wonderful to watch the Linux community respond.

TC

[Searchernow]

Trinidad - thanks for keeping us up-to-date!!  Much appreciated.

[Valtam]

[Searchernow]

Hi Jerry,
for me your post is blank. Maybe my firefox settings are detecting something considered insecure and blocking it.

[firenice03]

Hi Jerry,
for me your post is blank. Maybe my firefox settings are detecting something considered insecure and blocking it.

It's an image, I can see... maybe slow loading or FF??

[Jocklad]

Loading ok on Chrome

[bitsnpcs]

Loading quickly for me on Firefox and Opera browsers.