2018年2月20日 星期二

BSD patches for Spectre/Meltdown

The OpenIndiana project is still alive and well with a recent announcement of migrating the project to GCC 6.4. Unfortunately, this version does not cover the Spectre/Meltdown vulnerabilities, although the next version planned is 7.3 which will cover these hot issues.
While on the topic, the FreeBSD Unix distribution finally patched and fixed their operating environment for both Spectre and Meltdown in revision 329462.

The NetBSD team has been working to improve the security of their highly portable operating system. Several of the enhancements coming to NetBSD's stable branch involve the removal of legacy code and patches to work around the Meltdown and Spectre CPU bugs: "Ilja Van Sprundel presented at Defcon 25 (July 2017) and 34c3 (December 2017) the results of his audit of the BSD kernels. The issues affecting NetBSD were fixed overnight in the NetBSD-current branch, and were propagated to the stable branches within a month. Kernels from NetBSD-6 and NetBSD-7 built after August 23rd 2017 had all the necessary fixes. Some reports published recently suggest that the stable branches remained vulnerable for months, and that NetBSD was lagging behind; that is simply not true. In Ilja Van Sprundel's report, NetBSD was criticized for having too much legacy and buggy code. Several proactive measures were taken, within a month again, to clean up the system." Further details can be found in a blog post on the NetBSD website. http://blog.netbsd.org/tnf/entry/recent_security_affairs

REF: http://www.linuxjournal.com/content/kernel-patch-releases-winehq-openindiana-project-freebsd-unix-distribution-xubuntu-community

沒有留言:

張貼留言