More info at https://www.chromium.org/Home/chromium-security/ssca:
« Chrome's JavaScript engine, V8, will include mitigations starting
with Chrome 64, which will be released on or around January 23rd 2018.
Future Chrome releases will include additional mitigations and hardening
measures which will further reduce the impact of this class of attack.
Additionally, the SharedArrayBuffer feature is being disabled by
default. The mitigations may incur a performance penalty.
In line with other browsers, Chrome has disabled SharedArrayBuffer on
Chrome 63 starting on Jan 5th, and will modify the behavior of other
APIs such as performance.now, to help reduce the efficacy of speculative
side-channel attacks. This is intended as a temporary measure until
other mitigations are in place. »
I tested chromium 64.0.3282.39 against the Tencent tool, and it is reported as
NOT VULNERABLE.
There's a build of chromium 63.0.3239.132 currently going, I will test
it and report here as soon as it's completed.
** Changed in: chromium-browser (Ubuntu)
Status: New => Confirmed
** Changed in: chromium-browser (Ubuntu)
Importance: Undecided => High
** Changed in: chromium-browser (Ubuntu)
Assignee: (unassigned) => Olivier Tilloy (osomon)
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to chromium-browser in Ubuntu.
https://bugs.launchpad.net/bugs/1742740
Title:
Vulnerable to Spectre
Status in chromium-browser package in Ubuntu:
Confirmed
Bug description:
Hi Folks,
Chromium is still vulnerable to Spectre. You can check it:
http://xlab.tencent.com/special/spectre/spectre_check.html
ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: chromium-browser 63.0.3239.108-0ubuntu1
ProcVersionSignature: Ubuntu 4.13.0-25.29-generic 4.13.13
Uname: Linux 4.13.0-25-generic x86_64
NonfreeKernelModules: nvidia_uvm wl nvidia_drm nvidia_modeset nvidia
ApportVersion: 2.20.8-0ubuntu6
Architecture: amd64
CurrentDesktop: GNOME
Date: Thu Jan 11 17:45:51 2018
DetectedPlugins:
InstallationDate: Installed on 2018-01-01 (9 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Alpha amd64 (20171221)
SourcePackage: chromium-browser
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.default.chromium-browser: [deleted]
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1742740/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
