{"uuid": "6d36f5f1-5116-40b3-bd04-46d8d8db2c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2017-5754", "type": "seen", "source": "https://t.me/information_security_channel/14993", "content": "More Chrome OS Devices Receive Meltdown, Spectre Patches\nhttp://feedproxy.google.com/~r/Securityweek/~3/GblQCUJarZ4/more-chrome-os-devices-receive-meltdown-spectre-patches\n\nThe latest stable channel update for Google\u2019s Chrome OS operating system includes mitigations for devices with Intel processors affected by the Spectre and Meltdown vulnerabilities.\nMeltdown and Spectre attacks exploit design flaws in Intel, AMD, ARM and other processors. They allow malicious applications to bypass memory isolation mechanisms and gain access to sensitive data.\nMeltdown attacks are possible due to CVE-2017-5754, while Spectre attacks are possible due to CVE-2017-5753 (Variant 1) and CVE-2017-5715 (Variant 2). While Meltdown and Variant 1 can be addressed with software updates, Variant 2 also requires microcode updates from the manufacturers of the impacted processors. Software mitigations include kernel page-table isolation (KPTI/KAISER) and a technique developed by Google called Retpoline.\nMeltdown and Spectre were discovered independently by three teams of researchers. Google Project Zero researcher Jann Horn was one of the experts who found the flaws, which meant the company had enough time to work on patches before the details of the vulnerabilities were disclosed.\nIn the case of Chrome OS, Google rolled out the first Meltdown mitigations with the release (https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-chrome-os.html) of version 63 in mid-December, more than two weeks before public disclosure (https://www.securityweek.com/intel-amd-chip-vulnerabilities-put-billions-devices-risk).\nAt the time, Google rolled out the KPTI/KAISER patch to roughly 70 Intel-based Chromebook models from Acer, ASUS, Dell, HP, Lenovo, Samsung and others.\nGoogle released Chrome OS 65 (https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-chrome-os_19.html) on Monday and informed users that it includes the KPTI mitigation against Meltdown for additional Intel devices with version 3.14 of the kernel.\nA status page (https://www.chromium.org/chrome-os-devices-and-kernel-versions#TOC-Variant-1-CVE-2017-5753-) created by Google to help users track the availability of Meltdown and Spectre patches for Chrome OS shows that all older Chromebooks with Intel processors, including with kernel versions 3.14 and 3.8, should get the KPTI mitigation for Meltdown with the release of Chrome OS 66, which is currently scheduled for release on April 24.\nChrome OS 65 also brings the Retpoline mitigation for Spectre Variant 2 to all devices with Intel processors. Google noted that Variant 2 can be exploited using virtualization, and while Chrome OS devices don\u2019t use this type of feature, some measures have been taken to proactively protect users.\nIn the case of Spectre Variant 1, the eBPF feature in the Linux kernel can be abused for exploitation, but Chrome OS is not impacted as it disables eBPF, Google said.\nThe tech giant informs customers that Chrome OS devices with ARM processors are not affected by Meltdown. As for the Spectre vulnerabilities, Google says it has started integrating the firmware and kernel patches supplied by ARM, but release timelines have not been finalized.\nRelated: Intel Shares Details on New CPUs With Spectre, Meltdown Protections (https://www.securityweek.com/intel-shares-details-new-cpus-spectre-meltdown-protections)\nRelated: Microsoft Releases More Patches for Meltdown, Spectre (https://www.securityweek.com/microsoft-releases-more-patches-meltdown-spectre)", "creation_timestamp": "2018-03-22T16:08:23.000000Z"}