Brief items

Zenbleed: an AMD Zen 2 speculative vulnerability

Tavis Ormandy reports on a vulnerability that he has found in "all Zen 2 class processors" from AMD. (Wayback Machine link as the original site is overloaded.) It can allow local attackers to recover data used in string operations; "If you remove the first word from the string 'hello world', what should the result be? This is the story of how we discovered that the answer could be your root password!" The report has lots of details, including an exploit; AMD has released a microcode update to address the problem.

We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn't matter if they're happening in other virtual machines, sandboxes, containers, processes, whatever!

This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file.

Comments (17 posted)

Security quotes of the week

And there's a new remote attestation technology making the rounds: Google's Web Environment Integrity, which will leverage Google's dominance over browsers to allow websites to block users who run ad-blockers:

https://github.com/RupertBenWiser/Web-Environment-Integrity

There's plenty else WEI can do (it would make detecting ad-fraud much easier), but for every legitimate use, there are a hundred ways this could be abused. It's a technology purpose-built to allow rent extraction by stripping us of our right to technological self-determination.

Releasing a technology like this into a world where companies are willing to make their products less reliable, less attractive, less safe and less resilient in pursuit of rents is incredibly reckless and shortsighted. You want unauthorized bread? This is how you get Unauthorized Bread:

https://arstechnica.com/gaming/2020/01/unauthorized-bread-a-near-future-tale-of-refugees-and-sinister-iot-appliances/amp/

— Cory Doctorow (worth reading in its entirety)

And this brings us to the heart of the issue: If you're accused by a computer, are you entitled to review that computer's inner workings and potentially challenge its accuracy in court? What does cross-examination look like when the prosecutor's witness is a computer? How could you possibly access, analyze, and understand all microdirectives relevant to your case in order to challenge the AI's legal interpretation? How could courts hope to ensure equal application of the law? Like the man from the country in Franz Kafka's parable in The Trial, you'd die waiting for access to the law, because the law is limitless and incomprehensible.

— Bruce Schneier and Jon Penney

Comments (1 posted)

Kernel release status

The current development kernel is 6.5-rc3, released on July 23. Linus said: "Things continue to look pretty normal - there's nothing here that would seem to stand out, with both the commit counts and the diffs looking pretty much normal for rc3".

Stable updates: 6.4.5, 6.1.40, and 5.15.121 were released on July 23, followed one day later by 6.4.6, 6.1.41, 5.15.122, 5.10.187, 5.4.250, and 4.19.289, which contained mitigations for the Zenbleed vulnerability.

The 6.4.7, 6.1.42, 5.15.123, 5.10.188, and 5.4.251 stable updates are in the review process; they are due on July 27.

Comments (none posted)

Extensible scheduler class rejected

The extensible scheduler class enables the creation of CPU schedulers in BPF. After the fourth version of this series was greeted with relative silence, Tejun Heo asked about the status of this work:

We are comfortable with the current API. Everything we tried fit pretty well. It will continue to evolve but sched_ext now seems mature enough for initial inclusion. I suppose lack of response doesn't indicate tacit agreement from everyone, so what are you guys all thinking?

Scheduler maintainer Peter Zijlstra gave him his answer: "I'm still hating the whole thing with a passion". He went on to make it clear that this work will not be merged into the mainline. So, it seems, developers wanting to try their hand at BPF scheduler development will need to apply an out-of-tree patch series, for now at least.

Comments (33 posted)

Debian adds RISC-V as an official architecture

The Debian project is now supporting 64-bit RISC-V systems as an official architecture. Some work remains to be done, though:

However before you rush to update your sources.list file, I want to warn you that the archive is currently almost empty, and that only the sid and experimental suites are available. The procedure is to rebootstrap the port within the official archive, which means we won't import the full debian-ports archive.

Comments (12 posted)

Inkscape 1.3 released

Version 1.3 of the Inkscape drawing editor has been released. "With version 1.3 of Inkscape, you’ll find improved performance, several new features, and a solid set of improvements to a few existing ones". Changes include a new shape-builder tool, a "document resources" dialog for the management of drawings, a new pattern editor, and more.

Comments (1 posted)