Hacker News
securityaffairs$150K awarded for #L1TF #Reloaded exploit that bypasses cloud mitigations
https://securityaffairs.com/182476/security/150k-awarded-for-l1tf-reloaded-exploit-that-bypasses-cloud-mitigations.html
#securityaffairs #hacking
Hex
Bryan Steele 
Disable SMT/Hyperthreading in all Intel BIOSes: https://marc.info/?l=openbsd-tech&m=153504937925732&w=2 #OpenBSD #L1TF
peter hessler @openbsdThere's some fire in #OpenBSD's commit message to address Intel's #L1TF screwup
"""(3) stuffing the L1D cache with fresh data and expiring old content. This stuffing loop is complicated and interesting, no details on the mitigation have been released by Intel so Mike and I studied other systems for inspiration. Replacement algorithm for the L1D is described in the tlbleed paper."""
davidochobitsL1TF – L1 Terminal Fault Attack, la última vulnerabilidad en los procesadores Intel
NicholasSo I'm waiting until Intel's 9th Gen announcement to build my new PC, but things like #L1TF/#Foreshadow strongly make me consider #AMD... well, those and the fact that I can get 16 cores for $899.
That being said, #Intel said they patched this one with 0 performance hit so I guess it shouldn't be that much of a dealbreaker. Choices, choices...
RT @[email protected] Theo de Raadt on the impact of the Intel #Foreshadow #L1TF on #OpenBSD. “We asked repeatedly, but Intel provided no advance notice. We did not even receive replies to our requests for dialogue. On a side note, AMD cpus are not vulnerable to this problem.”
Alexander BochmannSo, #L1TF is kinda the "hyperthreading is dead" one... VMware introduces a new "ESXi Side-Channel-Aware Scheduler".
Quote: "Currently, this scheduler provides the Hyper-Threading-aware mitigation by scheduling on only one Hyper-Thread of a Hyper-Thread-enabled core. As described in more detail below, careful capacity planning is required prior to enabling the ESXi Side-Channel-Aware Scheduler as it could have a performance impact for enterprise applications."
Looks like we'll be planning for the next round of VMware updates due to #L1TF tomorrow: https://www.vmware.com/security/advisories/VMSA-2018-0020.html
"vCenter Server, ESXi, Workstation, and Fusion updates include Hypervisor-Specific Mitigations for L1 Terminal Fault - VMM. This issue may allow a malicious VM running on a given CPU core to effectively read the hypervisor’s or another VM’s privileged information that resides sequentially or concurrently in the same core’s L1 Data cache."
#infosec
"vCenter Server, ESXi, Workstation, and Fusion updates include Hypervisor-Specific Mitigations for L1 Terminal Fault - VMM. This issue may allow a malicious VM running on a given CPU core to effectively read the hypervisor’s or another VM’s privileged information that resides sequentially or concurrently in the same core’s L1 Data cache."
#infosec