Earlier today, I published an article here on my blog about the recent flaws found in kernels and processor firmware. I was a bit vague and unclear, but after doing more reading, I can give you a small set of instructions in regards to possible workarounds for now. These are just temporary and they may include a potential increase in RAM usage for those using these applications. Google-Chrome has yet to release their own workarounds inside the browser for the mentioned vulnerabilities on their side, however, the Chromium project released a small post about how users could reduce the attack vector in the browser by enabling one or two possible back end features themselves. Here I will attempt to better explain what this is and how to reduce your own vulnerability, assuming that you’re on Chrome or another chromium based browser.
The recent vulnerabilities are targeted at all processor architectures and as I previously mentioned, do make use of Kernel memory via going through the User as before now the kernel had no way to stop this, but recently, it appears that AMD has increased their own security on the issue and the Linux kernel now uses something called KPTI(Kernel Page Table Isolation) Which essentially allows the kernel to separate itself from Userspace in memory. It’s like a wall between what a user is doing on a PC and what the PC is doing in the background. This is only further boosted when certain mitigation techniques are taken inside of net facing applications. Google- Chrome has a back end flags page which holds a wealth of experimental security and performance enhancing features. This same back end applies to both Opera as well as Vivaldi.
To enable this feature of Site Isolation or Strict Site Isolation you must do the following:
-
Open up Google-Chrome, Opera, or Vivaldi
-
Go into the address bar and type Chrome://flags or Opera://flags for Opera
-
Search for enable-site-per-process
-
Next to Strict “Site Isolation”, click enable
-
Relaunch the browser
Most all chromium based browsers now have this setting at the moment. I wouldn’t count on this being there forever though, each update with Chrome and something changes. This is a good temporary adjustment that you can do to limit the amount of sites being opened in a single process. This will increase memory by possibly as much as 20% though. As I said earlier, future updates in the next week or so will include other workarounds inside the browser that effect buffer array and timing which are a couple of things that this attack would rely on.
As I mentioned in the last article, Pale Moon was not vulnerable as far as I can tell. The developer always does great work securing certain features that the Mozilla team haven’t thought of yet. As far as Mozilla goes, version 57.0.4 of Firefox should include a timing adjustment that slows this attack in its tracks. Intel seems hesitant to fix anything, but at least AMD have stepped up their game a bit. This vulnerability was known about for years and AMD already implemented basic safeguards for this sort of atrocity Short of physical access though, you’re pretty much safe at this point. I would make haste though for anyone running Linux to either search in their repositories for a newer version of the kernel or possibly look into compiling their on from source on kernel.org. More updates will be out next week and Google will update Chrome by the end of January.
More Reading: https://forum.manjaro.org/t/kernel-page-table-isolation-kpti-severe-arm-intel-cpu-bug-hits-partly-amd/37506
https://support.google.com/chrome/answer/7623121
