On 08/15/2018 08:40 AM, Rusty Bird wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Sphere:
https://www.bleepingcomputer.com/news/security/researchers-disclose-new-foreshadow-l1tf-vulnerabilities-affecting-intel-cpus/
There are other vulnerabilities disclosed along with this today and
if possible, I would like to confirm that as well.
On a side note, I have long disabled Hyperthreading on my machine.
To me as a layman, it looks like Qubes is indeed vulnerable to the
XSA-273 data leak, and that fixing it involves
1. disabling hyperthreading (by adding smt=off to the Xen command line)
2. AND upgrading Intel microcode to 20180807
On #2, assuming Intel has still abandoned Ivy Bridge and earlier CPUs, I
wonder if this makes the CoreBoot targeted systems essentially
unsafe/unusable.
Very bad.
--
Chris Laprise, [email protected]
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/6c1e9733-4a7d-bc0a-7ab0-927b4599e7f2%40posteo.net.
For more options, visit https://groups.google.com/d/optout.
