2023-07-05 17:57:47 <ikke> stackrot: nice new kernel vulnerability from 6.1 to 6.4: https://www.openwall.com/lists/oss-security/2023/07/05/1
2023-07-05 17:59:07 <psykose> less interesting than the silent memory corruption in 6.4.1 that breaks firefox :D
2023-07-05 17:59:43 <ikke> But that one doesn't have a slick name
2023-07-05 18:00:07 <psykose> :)
2023-07-14 21:22:36 <psykose> well would you look at that
2023-07-14 21:22:42 <psykose> they added io_uring_disabled sysctl to 6.6
2023-07-14 21:23:08 <psykose> now you don't need the same kernel with one option changed :D
2023-07-14 21:24:01 <psykose> it even has a =1 for root/sys_admin only or =2 for fully disabled
2023-07-15 19:51:14 <jvoisin> thanks Google
2023-07-16 17:03:42 <idkrn[m]> When can that happen for unpriv userns :)
2023-07-16 17:08:41 <psykose> ask the kernel developers
2023-07-16 18:46:27 <jvoisin> idkrn[m]: isn't there already one?
2023-07-16 19:18:31 <psykose> nope
2023-07-16 19:42:54 <jvoisin> https://lwn.net/Articles/673597/ > it turns out that Debian currently carries a similar patch, but, on Debian systems, the knob is called unprivileged_userns_clone and doesn't support the "privileged users only" setting.
2023-07-16 19:43:00 <jvoisin> my bad, it's/was debian only
2023-07-16 19:44:25 <jvoisin> one can use `/proc/sys/user/max_user_namespaces = 0`
2023-07-16 20:06:04 <psykose> that does work
2023-07-16 20:06:05 <psykose> hehe
2023-07-16 20:57:19 <idkrn[m]> jvoisin: there is one used by linux-hardened
2023-07-17 08:35:37 <nmeum> https://gitlab.alpinelinux.org/alpine/aports/-/issues/14482
2023-07-17 08:35:53 <nmeum> do we deem this to be a critical issue? looks like this is publically documented now and busybox upstream hasn't fixed it
2023-07-17 08:36:34 <nmeum> ps has a similar issue
2023-07-17 08:37:12 <nmeum> I personally don't think it's too serious and I don't have the time to patch it rn
2023-07-17 08:45:18 <ncopa> we should probably try to get the attention from upstream busybox
2023-07-19 06:08:19 <idkrn[m]> <nmeum> "https://gitlab.alpinelinux.org/..." <- Broken URL?
2023-07-19 06:40:47 <ikke> No, the issue is marked confidential 
2023-07-19 06:57:49 <idkrn[m]> <nmeum> "do we deem this to be a critical..." <- While also being public?
2023-07-19 15:17:16 <ikke> Security release for openssh CVE-2023-38408 9.3p2
2023-07-19 15:19:38 <kpcyrd> it seems this CVE is also assigned to Adobe Illustrator for some reason
2023-07-19 15:20:01 <kpcyrd> ah oof, 2022, sorry
2023-07-19 15:20:44 <ikke> https://www.openssh.com/releasenotes.html
2023-07-19 15:20:51 <ikke> https://www.openssh.com/txt/release-9.3p2
2023-07-19 15:59:45 <ncopa> ikke: i added secfixes data
2023-07-19 16:47:12 <jvoisin> ^ https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
2023-07-19 19:33:08 <psykose> ncopa: the data is useless because it's already fixed in that version
2023-07-20 06:40:18 <ncopa> 👍
2023-07-20 06:42:55 <psykose> technically it was a 0: even, haha
2023-07-20 06:45:33 <ncopa> im feeling old...
2023-07-20 06:45:35 <ncopa> :)
2023-07-20 06:45:57 <psykose> we all get old eventually
2023-07-20 06:46:18 <ncopa> hopefully
2023-07-20 06:46:29 <ncopa> i better get some coffe and breakfast before I do something stupid
2023-07-20 06:46:37 <ncopa> or say something stupid
2023-07-20 06:49:30 <psykose> how so?
2023-07-20 06:49:33 <psykose> whadya thinking of
2023-07-20 08:29:52 <ncopa> nothing in particular. i just feel stupid for adding CVE data to openssh :)
2023-07-20 08:58:30 <psykose> you also wrote 8.8 when the version is 9.3 :p
2023-07-20 08:58:34 <psykose> but no harm done
2023-07-20 08:58:51 <psykose> it's not like we don't all do redundant or wrong stuff
2023-07-20 08:59:03 <psykose> 8.9*
2023-07-24 23:46:51 <omni> zenbleed
2023-07-25 00:04:53 <omni> !49146
2023-07-25 00:15:26 <omni> !49147 !49148
2023-07-25 01:20:37 <omni> !49149
2023-07-25 01:21:21 <omni> I'm too tired to figure out my 3.16-stable branch issue, would someone please cherry pick for that for me?
2023-07-25 04:54:45 <psykose> not sure if the zenbleed microcode update secretly ignores my cpu or if ucode loading is just broken for me
2023-07-25 04:54:49 <psykose> annoying ass microcode updates
2023-07-25 04:56:50 <zcrayfish> Sums it up very well.
2023-07-25 04:57:19 <psykose> well i can say with 100% certainty it's ignored
2023-07-25 04:57:21 <psykose> no idea why tho
2023-07-25 04:57:33 <psykose> thankfully the exploit is easy to run
2023-07-25 04:57:37 <psykose> only the chicken bit fixes it
2023-07-25 04:58:00 <zcrayfish> oh, was gonna ask if UEFI has been updating before the OS could get to it, but sounds like it's not?
2023-07-25 04:58:07 <psykose> both
2023-07-25 04:58:18 <psykose> uefi updates also generally update ucode
2023-07-25 04:58:25 <psykose> if the ucode you try load is newer it would get applied
2023-07-25 04:58:34 <zcrayfish> right
2023-07-25 04:58:38 <psykose> if you have a new enough motherboard for zen2 you probably have an update through that route already
2023-07-25 04:58:45 <psykose> just run the exploit to see if it works
2023-07-25 04:58:46 <psykose> :D
2023-07-25 04:58:53 <zcrayfish> zenbleed is on AMD, right?
2023-07-25 04:58:56 <psykose> zen2
2023-07-25 04:59:00 <psykose> all cpus
2023-07-25 04:59:06 <zcrayfish> oh fun
2023-07-25 05:00:38 <zcrayfish> I bet my HP t740 is affected for it
2023-07-25 05:00:42 <zcrayfish> s/for/by
2023-07-25 05:01:02 <zcrayfish> or something similarly bad
2023-07-25 05:01:14 <zcrayfish> 
ACTION grumbles about HP's low quality UEFI updates.

2023-07-25 05:02:34 <psykose> V1756B is zen1
2023-07-25 05:02:43 <psykose> so nah
2023-07-25 05:03:20 <zcrayfish> maybe be hope for it yet
2023-07-25 05:03:32 <zcrayfish> anyway time to sleep. have a good one
2023-07-25 05:04:32 <psykose> ikke: you have to reboot the riscv host and whatever for this
2023-07-25 05:04:35 <psykose> the 7402p machine
2023-07-25 05:04:43 <ikke> nld-dev-1
2023-07-25 05:05:14 <psykose> https://img.ayaya.dev/ndCfqvs2thDW
2023-07-25 05:05:15 <psykose> :D
2023-07-25 05:05:45 <psykose> upgrade and see
2023-07-25 05:05:47 <psykose> ucode should be there
2023-07-25 05:05:52 <psykose> if this doesn't fix it means something is really broken
2023-07-25 05:06:01 <psykose> either the update is broken, or the way we generate the .bin is
2023-07-25 05:06:18 <psykose> i'll test it after reboot
2023-07-25 05:13:07 <ikke> rebooting now
2023-07-25 05:14:32 <psykose> ah maybe it needs the new kernel too
2023-07-25 05:14:41 <psykose> there's a kernel-level zenbleed fix
2023-07-25 05:14:43 <psykose> i'll bump that too
2023-07-25 05:16:09 <psykose> all sent
2023-07-25 05:16:12 <psykose> will take a while to build
2023-07-25 05:20:56 <psykose> yeah just updating and rebooting doesn't work and it's still live
2023-07-25 05:22:09 <psykose> i guess next reboot with new kernel will fix it, but that doesn't fix the ucode..
2023-07-25 05:22:20 <psykose> all https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.1.y&id=ed9b87010aa84c157096f98c322491e9af8e8f07 is doing is applying the chicken bit when ucode doesn't work
2023-07-25 05:22:34 <psykose> so we still have to figure that out
2023-07-25 05:23:19 <psykose> could you post a dmesg from the host
2023-07-25 05:24:16 <ikke> https://tpaste.us/vN15
2023-07-25 05:24:52 <ikke> microcode: CPU0: patch_level=0x0830104d
2023-07-25 05:25:19 <psykose> yeah, but that comes from the bios
2023-07-25 05:25:28 <psykose> if it actually applies the file it prints something about updating from/to
2023-07-25 05:25:44 <psykose> i assume it's grub and there's a `initrd amd-ucode.bin` line
2023-07-25 05:25:49 <psykose> img*
2023-07-25 05:27:11 <ikke> there is no such line in /boot/grub/grub.cfg
2023-07-25 05:27:43 <psykose> mm
2023-07-25 05:27:45 <psykose> there should be
2023-07-25 05:28:07 <psykose> is there a /boot/amd-ucode.bin
2023-07-25 05:28:12 <ikke> no
2023-07-25 05:28:19 <psykose> apk add amd-ucode and regenerate the grub config
2023-07-25 05:28:22 <psykose> then check again
2023-07-25 05:28:26 <psykose> if it's there, then reboot after
2023-07-25 05:28:48 <psykose> in this case it was just never installed, afaik if it was grub would generate it
2023-07-25 05:28:53 <ikke> yes
2023-07-25 05:28:58 <ikke> initrd  /boot/amd-ucode.img /boot/initramfs-lts
2023-07-25 05:29:02 <psykose> correct
2023-07-25 05:29:10 <ikke> it automatically regenerated
2023-07-25 05:29:14 <psykose> sweet
2023-07-25 05:29:16 <psykose> time for round 2
2023-07-25 05:29:43 <psykose> send it (intentionally without waiting for kernel)
2023-07-25 05:34:19 <ikke> back
2023-07-25 05:34:30 <psykose> it sure takes a long time to boot
2023-07-25 05:34:41 <ikke> yes, it's bare metal
2023-07-25 05:35:02 <ikke> needs to initialize firmware first
2023-07-25 05:35:19 <psykose> yeah, big lad
2023-07-25 05:35:31 <psykose> it's fixed
2023-07-25 05:35:32 <psykose> no leaks
2023-07-25 05:35:36 <psykose> now look at dmesg again
2023-07-25 05:36:25 <ikke> microcode: microcode updated early to new patch_level=0x0830107a
2023-07-25 05:36:32 <psykose> :)
2023-07-25 05:36:52 <psykose> i guess limine just fails to actually load it for some reason since that's what i use
2023-07-25 05:37:17 <psykose> or my 3700x rejects it
2023-07-25 07:01:57 <psykose> > Also, the firmware fixes are apparently only targeting EPYC at this point, not consumer CPUs.
2023-07-25 07:01:59 <psykose> ok makes sense
2023-07-25 07:02:08 <psykose> so that ucode is just for our nld server
2023-07-25 07:02:10 <psykose> :D
2023-07-25 07:03:44 <psykose> > AMD has patches ready for its EPYC 7002 'Rome' processors now, but it will not patch its consumer Zen 2 Ryzen 3000, 4000, and some 5000-series chips until November and December of this year.
2023-07-25 07:03:47 <psykose> .....
2023-07-25 07:05:20 <ikke> Oof
2023-07-25 07:05:28 <ikke> RIP
2023-07-25 07:05:43 <ikke> 🐔 bit it is until then
2023-07-25 07:05:49 <ikke> G
2023-07-25 07:09:42 <psykose> yeah
2023-07-25 07:09:49 <psykose> new kernel sets it so nothin to do, just sucks
2023-07-25 12:14:58 <omni> grep microcode /proc/cpuinfo
2023-07-31 17:46:13 <ikke> omni: apparently xen released a new revision of their zenbleed patches
2023-07-31 20:43:01 <omni> ikke: I think they only updated with the CVE number
2023-07-31 20:43:07 <omni> the .patch files seem to be the same
2023-07-31 20:43:21 <omni> or do you mean this? https://xenbits.xen.org/xsa/xsa433-bugfix.patch
2023-07-31 20:43:29 <ikke> hmm, they mentioned they set some unspecified bits potentially leading to unexpected behavior
2023-07-31 20:47:40 <omni> ah, yes, it is the -bugfix.patch
2023-07-31 20:47:41 <omni> thanks
2023-07-31 21:22:01 <omni> !49360 !49364 !49365 !49366 !49367