Re: [qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-26 Thread Rusty Bird
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Rusty Bird: > To me as a layman, it looks like Qubes is indeed vulnerable to the > XSA-273 data leak, and that fixing it involves > > 1. disabling hyperthreading (by adding smt=off to the Xen command line) > 2. AND upgrading Intel microcode to

Re: [qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-16 Thread Rusty Bird
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Chris Laprise: > On 08/15/2018 08:40 AM, Rusty Bird wrote: > > To me as a layman, it looks like Qubes is indeed vulnerable to the > > XSA-273 data leak, and that fixing it involves > > > > 1. disabling hyperthreading (by adding smt=off to the Xen

Re: [qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-16 Thread Rusty Bird
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Sphere: > I have hyperthreading disabled on my BIOS, do I still have to add > that option to Xen command line? Disabling it in the BIOS is okay too, according to the XSA. > By pull request you mean, it's still being grabbed for use and >

Re: [qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-15 Thread Chris Laprise
On 08/15/2018 08:40 AM, Rusty Bird wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Sphere: https://www.bleepingcomputer.com/news/security/researchers-disclose-new-foreshadow-l1tf-vulnerabilities-affecting-intel-cpus/ There are other vulnerabilities disclosed along with this today and

Re: [qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-15 Thread Sphere
On Wednesday, August 15, 2018 at 8:50:28 PM UTC+8, Rusty Bird wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > Sphere: > > https://www.bleepingcomputer.com/news/security/researchers-disclose-new-foreshadow-l1tf-vulnerabilities-affecting-intel-cpus/ > > > > There are other

Re: [qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-15 Thread Rusty Bird
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Sphere: > https://www.bleepingcomputer.com/news/security/researchers-disclose-new-foreshadow-l1tf-vulnerabilities-affecting-intel-cpus/ > > There are other vulnerabilities disclosed along with this today and > if possible, I would like to confirm

[qubes-users] Is Qubes vulnerable to CVE-2018-3620?

2018-08-14 Thread Sphere
https://www.bleepingcomputer.com/news/security/researchers-disclose-new-foreshadow-l1tf-vulnerabilities-affecting-intel-cpus/ There are other vulnerabilities disclosed along with this today and if possible, I would like to confirm that as well. On a side note, I have long disabled