3

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using kernel 4.17.

I read on a site there is a framework called 007 that fixes Spectre very easy, but I can't find it on GitHub.

3

There's not much you as a user can do besides waiting for processor microcode updates (Spectre v3) and browser updates (Spectre v4).

Once the microcode updates are here, you then have to update all the software that you use, because these have to be rewritten and recompiled to incorporate changes that are needed to mitigate Spectre (especially how software handles memory disambiguation).

If your browser is up to date, it is now very hard[citation needed] to execute a Spectre v4-based attack. The first wave of updates dedicated to mitigate Spectre limited certain high-resolution timer functionalities. If you update your browser and generally don't use JavaScript on untrusted sites, you are probably safe. If you want to target Spectre attacks specifically you can only disable Just in Time-Compilation (JIT).


Regarding 007: afaik this is a framework/tool for programmers and developers, not for the average end user because the source code has to be accesible at the very least. I'm unsure what other requirements there are.

  • 2
    It's not JavaScript in particular that is an issue so much as JIT, which can bypass the reduced performance.now() granularity. – forest Aug 3 '18 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.