<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>(Remember when the Pentium was discovered to have a bug that
approximated the mathematical results of some computations?
Yeah...that long ago)</p>
<p>Anyway...did some digging, especially since more and more folks
are migrating to the Pi.</p>
<p>But first: in order to implant these malware exploits, you have
to have access to the system. IF you are not practicing good
systems hygiene, and not keeping up to date, have a wide range of
ports open, etc...every port open is one more potential exploit.
Running web servers on the same host as app_rpt, for instance.
Having simple passwords for SSH login. Allowing ROOT login via
SSH. The list is long and ugly. But, but, but...the flexibility
of the event subsystem, macros, and dtmf functions really don't
require anything other than the IAX2 port be opened to do 98% of
system maintenance. And if you really really need console access,
consider configuring a VPN with cryptographic id exchange. Limit
the attack surface...limit the possibility of exploit.<br>
</p>
<p>But, what about the Pi?</p>
<p>According to <a
href="https://developer.arm.com/support/security-update"
rel="noreferrer">ARM</a> themselves (<a
class="moz-txt-link-freetext"
href="https://developer.arm.com/support/security-update">https://developer.arm.com/support/security-update</a>),
the Raspberry Pi's processor cores (for all versions) are <strong>not</strong>
affected.</p>
<blockquote>
<p>"The majority of Arm processors are not impacted by any
variation of this side-channel speculation mechanism. A
definitive list of the small subset of Arm-designed processors
that are susceptible can be found below. <br>
</p>
</blockquote>
<p>The processor cores used by the Pis are:</p>
<ul>
<li>
<p>Pi 1 and Zero (W): <a
href="https://en.wikipedia.org/wiki/ARM11" rel="noreferrer">ARM11</a></p>
</li>
<li>
<p>Pi 2 V1: <a
href="https://en.wikipedia.org/wiki/ARM_Cortex-A7"
rel="noreferrer">ARM Cortex-A7</a> </p>
</li>
<li>
<p>Pi 2 V1.2 and Pi 3: <a
href="https://en.wikipedia.org/wiki/ARM_Cortex-A53"
rel="noreferrer">ARM Cortex-A53</a></p>
</li>
</ul>
<p>None of the above cores are listed as vulnerable to any version
of the attack (they are not listed at all, in fact, because there
is no known vulnerability to these attacks).</p>
<p>Spectre and Meltdown both require out-of-order execution. The <a
href="https://en.wikipedia.org/wiki/ARM_Cortex-A7"
rel="noreferrer">Cortex-A7</a> used in the early Pi 2 and the <a
href="https://en.wikipedia.org/wiki/ARM_Cortex-A53"
rel="noreferrer">Cortex A53</a> used in the later Pi 2 and the
Pi 3 is a strictly in-order architecture. The <a
href="https://en.wikipedia.org/wiki/ARM11" rel="noreferrer">ARM11</a>
used in the Pi 1 is partially out-of-order, but not in a way that
permits Spectre or Meltdown to work.</p>
<p><a href="https://developer.arm.com/support/security-update"
rel="noreferrer">ARM confirms this</a>: only a very limited
subset of ARM processors have hardware that makes them vulnerable
to Spectre, an even more limited subset are vulnerable to
Meltdown, and it's believed that all of them permit mitigation of
the threat. Take that for what it's worth.<br>
</p>
<p>Bottom line, to me: should we worry about this? Not to the point
of loosing sleep, at least on the allstar side of the house. It's
something to be aware of, especially those running on Intel CPUs,
since the chance of it being exploited is greater than zero, but
the risk, at this point, of it happening is less than 100,
especially if you've locked down your ports on your ingress/egress
routers, have firewalls in place, etc., and generally practice
good system management and security hygiene. <br>
</p>
<p>I'm thinking that when the necessary patches for the underlying
OS (Debian) are published, a side effort to respin the release
with the patches, after testing for performance and reliability of
the allstart code, be done and released, and that the USERS
implement the update. We can't force anyone to do so...but, it's
just doing the Right Thing to do so.<br>
</p>
<p>Your Windows/Mac/etc desktop and office systems? That's another
story. Keep a watch on the patch release cycles and fixes that
are offered from the software vendors. Apply them. <br>
</p>
<p>Because these exploits use an acceleration feature in the
architecture to help them work faster...I'm predicting that any
software/OS patch to minimize the exposure will have a performance
hit, since it will essentially turn off a major pipeline speedup
function. So, wariness, both to prevent infection, as well as
implementing changes is certainly warranted.</p>
<p>Bryan <br>
</p>
WB0YLE/W2FUV
</body>
</html>