The resurgence of Spectre-like malware has pushed the release date for the next iteration of Linux (opens in new tab) for at least a week, its creator has confirmed.
In the 5.17-rc8 announcement, the kernel development head Linus Torvalds explained that the discovery of CVE-2021-26341 - a vulnerability in some AMD processors that resembles the dreaded Spectre/Meltdown fiasco, meant the team needed to apply certain patches, which complicated things for the 5.17 version of the OS.
“Last weekend, I thought I’d be releasing the final 5.17 today. That was then, this is now,” he writes.
We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.
>> Click here to start the survey in a new window (opens in new tab) <<
Flurry of fixes
“Last week was somewhat messy, mostly because of embargoed patches we had pending with another variation of specter attacks. And while the patches were mostly fine, we had the usual “because it was hidden, all our normal testing automation did not see it either”.
Once automation sees “things”, all the possible and impossible combinations get tested, resulting in a “(small) flurry of fixes for the fixes.”
Despite the unforeseen circumstances, Torvalds considered releasing 5.17 anyway, but decided against it, in the end.
“As a result we have an -rc8 release today instead of doing a final 5.17,” he concluded.
> Torvalds admits he's a bit worried about the next Linux build (opens in new tab)
> Keeping your CPU safe from Spectre imposes serious performance penalty (opens in new tab)
> Best Linux distros for privacy and security (opens in new tab)
Detailing the flaw, AMD said the chips "may transiently execute instructions following an unconditional direct branch that may result in detectable cache activity."
The CVE was rated 4.7/10 on the severity scale, and so far - there had been no reported executions in the wild. Still, since the problem is found in 14 client CPUs and both first-gen and second-gen EPYC silicon for servers, it cannot be neglected.
Torvalds also urged the developers not to rely exclusively on automation farms, and to dig into the work themselves.
"Anyway, let's not keep the testing _just_ to automation," he suggested in his weekly kernel progress update. "The more the merrier, and real-life loads are always more interesting than what the automation farms do. So please do give this last rc a quick try," he added.
- Check out our list of the best firewalls (opens in new tab) out there
Via: The Register (opens in new tab)