https://www.zdnet.com/art...bout-intel-security-bugs/
Torvalds "loves speculative execution. CPUs must do this." But, Torvalds is annoyed that "people didn't think about the problems of taking shortcuts with speculative execution. We knew speculative work that wasn't used had to be thrown away." It wasn't. That problem is now baked in most modern processors. The long-term fix is a new generation of Intel CPUs.
This ticked Torvalds off. Linux, programmers and the other operating system developers, had to scramble to fix the hardware vendors' problems. Torvalds said, "It's not fair. When we screw up, it's fair, we have to fix it. But it feels less fair when we have to fix someone's else's problems."
Earlier at the conference, Greg Kroah-Hartman, the stable Linux kernel maintainer, went into more detail about why fixing the first Spectre class bugs was such a problem for Linux developers in particular.
The problems were know about in July of 2017, Kroah-Hartman explained, but "it wasn't until October 25 of last year that the kernel community heard rumors of the flaw. That's a long time, and we only heard rumors because another very large operating system vendor told Intel to get off their tails and tell us about it."
Then, Kroah-Hartman continued, "When we get a kernel security bug, it goes to the Linux kernel security team, we drag in the right people, we work with the distributions getting everyone on the same page and push out patches" Not this time. "Intel siloed SUSE, they siloed Red Hat, they siloed Canonical. They never told Oracle, and they wouldn't let us talk to each other."
Torvalds added that with the "security issues kept under wraps, we couldn't do our usual open methods. This made fixing the bugs much more painful than it should be." "It really wasn't working," continued Kroah-Hartman, so we "yelled at [Intel] and pleaded, and we finally got them to allow us to talk to each other the last week of December. All of our Christmas vacations were ruined. Intel messed up."
Worse still, Kroah-Hartman said, "Debian wasn't allowed to be part of the disclosure, so most of the world was caught with their pants down, and that's not good."
Voor wie het niet weet, Debian is met afstand het meest gebruikte systeem van Linux aangezien Ubuntu en Mint ook gebaseerd zijn op Debian.
Since then, Torvalds said, "Intel has gotten much better." But, even now, "I don't know what the hardware bug schedule is."
Still, when the next Spectre variant showed up, Foreshadow, the Linux kernel developers were notified ahead of time. Because of this, the Linux community could use their battle-tested open methods to patch this bug promptly.
offtopic:
For all the pain this has caused, there's also been one good, unexpected result. Kroah-Hartman explained that Linux and Windows programmers are working together on CPU security bugs.
"We now have this wonderful back channel. We're talking to each other and we're fixing bugs for each other," he said. Who would have thought even five years ago we'd see this?
[
Voor 6% gewijzigd door
Verwijderd op 07-09-2018 01:45
]