5

KPTI brings with it a performance hit. For the average Ubuntu (non-Windows, non-wine) user using their laptop behind a home or office firewall, is there any significant risk of exploitation by Spectre or Meltdown when KPTI is turned off?

E.g. some Linux users don't install an anti-virus package because computer viruses are much rarer on Linux than on Windows. Is a user more likely to encounter a Spectre or Meltdown exploitation than a Linux virus?

Please answer this using a cost- benefit analysis not just an opinion.

Improve this question
4
  • Thanks for the link. I had a look but only get an impression of a theoretical risk. I have edited my question to compare to risk of Linux viruses.
    – mcarans
    Jan 12, 2018 at 12:30
  • 1
    As right now the risk is probably small as it would take a while for crackers to leverage the exploit. You really need to read a quality review article about this - theguardian.com/technology/2018/jan/04/… . There will be a delay, and then the cracking tools will script this exploit and it will be a large problem for unpatched systems. As with any security decision, how much do you value your data ? How much , if any, of a performance hit is the fix for your CPU ? Is keeping your bank account worth the slow down ?
    – Panther
    Jan 12, 2018 at 16:02
  • I think this is an excellent cost/benefit analysis question and was considering answering it with KAISER and KASLR references. But with 4 close votes so far hours spent answering seems like a waste of time.
    – WinEunuuchs2Unix
    Jan 13, 2018 at 1:53
  • 1
    I don't see that answers to this have to be primarily opinion based. It is possible as WinEunuuchs2Unix says to do a cost benefit analysis.
    – mcarans
    Jan 14, 2018 at 9:10

1 Answer 1

Reset to default
5

Before we go to hard facts, let me voice my opinion that your comparison between viruses and exploits for Spectre and Meltdown are a bit skewed: there are >1 million viruses out there and no exploits for Spectre and Meltdown at the time of this writing: only Proof of Concept (PoC) code, but the NSA, CIA,BSI, ФСБ and other three-letter organisations are very probably running overtime now to come up with exploits.

Secondly, risk cannot be taken into account all by itself without talking about impact as well, so that's why I added that to your question.

Now onto the hard facts:

  • Today the number of exploits is 0 (as far was we know), so the risk is low.
    (Cost: high. Benefit: Low)
  • In the future, the number of exploits will increase, so the risk will increase linearly.
    (Cost: High. Benefit: Medium.)
  • If you would decide not to implement the patches, and you would be hit by an exploit in the future, the impact will be high as this is a side-channel vulnerability
    (Cost: High. Benefit: High)
  • If you would be running in a virtual environment with Ubuntu as the host system, the impact would be very high as the VMs on the same physical host would be able to inspect each other's memory...
    (Cost: High. Benefit: Extremely High)
Improve this answer
11
  • If you run in a Cloud environment the Meltdown / Spectre vulnerability should be patched in the Cloud systems OS primrly, I think, as the OS in the vm don't have direct access to hardware.
    – Soren A
    Jan 14, 2018 at 12:30
  • @SorenA yes, correct: at the hypervisor level, but as the OP did not specify that in its question and other people might be reading this question while running in such an environment, I've added that scenario just to be rigorously complete.
    – Fabby
    Jan 14, 2018 at 12:36
  • 1
    @SorenA Incorrect. In VMs, a virtual CPU has its own firmware and such. The OSes therefore still need patched in the Cloud environment, so taht more than just the 'host' is patched, as the virtual CPUs exposed to the guests could potentially be exploited in a similar way. This has been confirmed and accepted within the Internet Security community.
    – Thomas Ward ♦
    Jan 14, 2018 at 20:39
  • Thanks, this is great Fabby but would you be able to compare cost benefit roughly with not installing antivirus software eg. if infected by a typical Linux virus is the impact the same or higher? Will the number of exploits increase at a greater rate than Linux viruses? What is the performance impact of running antivirus software? Etc. This will make it easier to quantify the costs and benefits.
    – mcarans
    Jan 14, 2018 at 20:55
  • 1
    "Today the number of viruses is less than 50 (as far was we know), so the risk is low/medium/high. (Cost: low/medium/high. Benefit: low/medium/high). In the future, the number of viruses will increase, so the risk will increase linearly/exponentially/whatever. (Cost: low/medium/high. Benefit: low/medium/high) If you would decide not to install antivirus, and you would be hit by a virus in the future, the impact will be low/medium/high. (Cost: low/medium/high. Benefit: low/medium/high)." This would make understanding the cost benefit easier IMHO.
    – mcarans
    Jan 19, 2018 at 8:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .