Juicy new CPU vulnerability?

>Intel Responds to Security Research Findings https://newsroom.intel.com/news/intel-responds-to-security-research-findings/ tl;dr looks like some kind of memory read vulnerability in silicon. Intel are claiming others are involved too I did a bit of digging and found some new Linux patches suggesting this vulnerability effects at least *all* Intel processors https://kernel.googlesource.com/pub/scm/linux/kernel/git/tip/tip/+/694d99d40972f12e59a3696effee8a376b79d7c8%5E%21/#F0 There is some more discussion on lwn which would indicate that the work-arounds for whatever this bug is could have a significant performance impact https://lwn.net/Articles/742404/ Does anyone know any specifics about the vulnerability? is this hype about nothing?

https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html

https://news.ycombinator.com/item?id=16046636

It's potentially exploitable to steal passwords and other sensitive data as it allows user ring3 to access the ring0 memory. The patch is completly seperating those but that costs processing power. KAISER is the codeword you want to look for it you want more info. Personally i find the politcal side more interesting. What you have here is a 10 year old backdoor nobody noticed wich is remarkable in itself. Shows how secure we really are. Also interesting is the fud arround it. Observed our local newsites trying to downplay it first and then release just a day later news of intel driver patches speeding up things without any evidence of it. Not sure if they can fool consumers but that still leaves companies with their servers which might bite them when they have to deal with additional costs due to slowed servers.

I don't understand why those news are almost unnoticed here! The vulnerability called Meltdown affects almost every post-1995 Intel processor (AMD is not affected, some newer ARM processor are). It exploits speculative execution and combined with cache side-channel attacks it allows a process to read the whole kernel/virtual memory (very severe). There are kernel patches, refer to your distro for backports or simply run a 4.14.11 (or higher) kernel. The attack can be done via Javascript. Note: Intel didn't provide any fix and released new vulnerable products even if they were privately informed about the vulnerability on June. Spectre is similar to Meltdown and it has been discovered by the same security team (Google Project Zero I think). The main differences are that AMD is vulnerable too and most of ARM processors as well (not the Raspberry Pi's one interestingly) and that a program can only read its own memory (so it's basically mostly dangerous for browsers). There are 2 variants, one of them relies on JIT switched on, there's already a Proof of Concept for JS to read the browser's memory. There isn't currently a patch, Firefox 57 and Chrome 64 have some mitigations and apparently some code has been merged upstream in the kernel which needs to be combined with a GCC patch ("Retpoline") and/or to vendor microcode to provide protection. (everything needs to be recompiled if I understood correctly) Also an AMD PSP remote code execution vulnerability has been discovered recently. tl;dr your CPU is affected by hardware vulnerabilities, update your software, don't run untrusted code and run as less JS as you can. Also Intel and others knew this for 6 months and didn't do anything to fix this