Project

General

Profile

Bug #15796

Mitigate Foreshadow aka. L1 Terminal Fault vulnerabilities

Added by cypherpunks 9 months ago. Updated 9 months ago.

Status:
Resolved
Priority:
Elevated
Assignee:
-
Category:
-
Target version:
Tails_3.9
Start date:
08/15/2018
Due date:
% Done:

100%

Estimated time:
0.50 h
QA Check:
Pass
Feature Branch:
bugfix/15796-foreshadow+force-all-tests
Type of work:
Code
Blueprint:
Starter:
Affected tool:

Description

A recent and very severe vulnerability has been revealed that allows arbitrary memory reads. The mitigations (both for userspace and hypervisors) were submitted to the Linux kernel in commit 958f338e96f874a0d29442396d6adf9c1e17aa2d. For non-hypervisors, the fix is simple and has no performance impact. It is important that Tails upgrade its kernel to mitigate this nasty vulnerability.

Debian status:

Related issues

Blocks Tails - Feature #15334: Core work 2018Q3: Foundations Team Resolved 02/20/2018
Blocks Tails - Bug #15852: Upgrade firmware-nonfree to 20180825-1 Resolved 08/27/2018
Blocks Tails - Bug #15846: devel and branches based on devel FTBFS: The following packages have unmet dependencies Resolved 08/26/2018

Associated revisions

Revision dd67b669 (diff)
Added by intrigeri 9 months ago

Upgrade Linux to 4.17.15-1 (refs: #15796).

This is the first Debian kernel with the fixes for CVE-2018-3620
aka. Foreshadow aka. L1 Terminal Fault vulnerabilities.

Revision 7dbe9eac (diff)
Added by intrigeri 9 months ago

Bump snapshots of the Debian APT archive to 2018081901 (refs: #15796).

This is needed to get linux-image-4.17.0-3-amd64 (4.17.17-1),
which fixes issues introduced in 4.17.15-1.

Revision b1e19b7d (diff)
Added by intrigeri 9 months ago

Enable the bugfix-15796-foreshadow-force-all-tests APT overlay (refs: #15796).

Revision 485bbfc5
Added by intrigeri 9 months ago

Merge branch 'bugfix/15796-foreshadow+force-all-tests' into testing-integration+force-all-tests (Fix-committed: #15796, #15852)

History

#1 Updated by u 9 months ago

  • Priority changed from High to Normal

#2 Updated by u 9 months ago

  • Related to Feature #15117: Improve visibility of scrollbar in persistence assistant added

#3 Updated by u 9 months ago

  • Related to deleted (Feature #15117: Improve visibility of scrollbar in persistence assistant)

#4 Updated by mercedes508 9 months ago

  • Status changed from New to Confirmed
  • Assignee set to intrigeri
  • Target version set to Tails_3.9

#5 Updated by intrigeri 9 months ago

  • Description updated (diff)
  • Priority changed from Normal to Elevated

Next step is: upgrade to linux (4.17.15-1), that introduces the mitigation.

#6 Updated by intrigeri 9 months ago

#7 Updated by intrigeri 9 months ago

  • Subject changed from Mitigate Foreshadow to Mitigate Foreshadow aka. L1 Terminal Fault vulnerabilities
  • Description updated (diff)

#8 Updated by intrigeri 9 months ago

  • Description updated (diff)

#9 Updated by intrigeri 9 months ago

  • Status changed from Confirmed to In Progress
  • % Done changed from 0 to 10
  • Feature Branch set to bugfix/15796-foreshadow+force-all-tests

#10 Updated by intrigeri 9 months ago

I should update my branch to include Linux 4.17.17-1. Linux 4.17.17 was released with only 1 new commit to fix a regression that seems important: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.17

#11 Updated by intrigeri 9 months ago

Full test suite runs with 4.17.15-1 look as good as usual.

#12 Updated by intrigeri 9 months ago

  • % Done changed from 10 to 20
  • QA Check set to Ready for QA

intrigeri wrote:

I should update my branch to include Linux 4.17.17-1

Done on the topic branch. Next steps:

  • full test suite runs
  • test on bare metal

#13 Updated by intrigeri 9 months ago

  • % Done changed from 20 to 30

Next steps:

  • full test suite runs

LGTM. Left: test on bare metal.

#14 Updated by intrigeri 9 months ago

  • Assignee changed from intrigeri to segfault
  • % Done changed from 30 to 50
  • Estimated time set to 0.50 h

#15 Updated by segfault 9 months ago

  • Assignee changed from segfault to intrigeri
  • QA Check changed from Ready for QA to Info Needed

LGTM. Should I build and test this?

#16 Updated by intrigeri 9 months ago

  • Assignee changed from intrigeri to segfault
  • QA Check changed from Info Needed to Ready for QA

LGTM. Should I build and test this?

Yes, please test on whatever bare metal you have handy :)

#17 Updated by intrigeri 9 months ago

  • Assignee changed from segfault to intrigeri
  • QA Check changed from Ready for QA to Dev Needed

Hold on, I'd like to include the upgrade to intel-microcode 3.20180807a.1 that adds some more L1TF and Spectre mitigation measures.

#18 Updated by intrigeri 9 months ago

  • Blocks Bug #15852: Upgrade firmware-nonfree to 20180825-1 added

#19 Updated by intrigeri 9 months ago

  • Assignee changed from intrigeri to segfault
  • QA Check changed from Dev Needed to Ready for QA

#20 Updated by intrigeri 9 months ago

  • Blocks Bug #15846: devel and branches based on devel FTBFS: The following packages have unmet dependencies added

#21 Updated by segfault 9 months ago

  • Assignee changed from segfault to intrigeri
  • QA Check changed from Ready for QA to Pass

Works on my hardware

#22 Updated by intrigeri 9 months ago

  • Status changed from In Progress to Fix committed
  • Assignee deleted (intrigeri)
  • % Done changed from 50 to 100

#23 Updated by intrigeri 9 months ago

  • Status changed from Fix committed to Resolved

Also available in: Atom PDF