Vulnerable to Spectre

[Hassan El Jacifi]

Hi Folks,

Chromium is still vulnerable to Spectre. You can check it:

 http://xlab.tencent.com/special/spectre/spectre_check.html

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: chromium-browser 63.0.3239.108-0ubuntu1
ProcVersionSignature: Ubuntu 4.13.0-25.29-generic 4.13.13
Uname: Linux 4.13.0-25-generic x86_64
NonfreeKernelModules: nvidia_uvm wl nvidia_drm nvidia_modeset nvidia
ApportVersion: 2.20.8-0ubuntu6
Architecture: amd64
CurrentDesktop: GNOME
Date: Thu Jan 11 17:45:51 2018
DetectedPlugins:

InstallationDate: Installed on 2018-01-01 (9 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Alpha amd64 (20171221)
SourcePackage: chromium-browser
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.default.chromium-browser: [deleted]

[Olivier Tilloy (osomon)]

More info at https://www.chromium.org/Home/chromium-security/ssca:

 « Chrome's JavaScript engine, V8, will include mitigations starting with Chrome 64, which will be released on or around January 23rd 2018. Future Chrome releases will include additional mitigations and hardening measures which will further reduce the impact of this class of attack. Additionally, the SharedArrayBuffer feature is being disabled by default. The mitigations may incur a performance penalty.

   In line with other browsers, Chrome has disabled SharedArrayBuffer on Chrome 63 starting on Jan 5th, and will modify the behavior of other APIs such as performance.now, to help reduce the efficacy of speculative side-channel attacks. This is intended as a temporary measure until other mitigations are in place. »

I tested chromium 64.0.3282.39 against the Tencent tool, and it is reported as NOT VULNERABLE.

There's a build of chromium 63.0.3239.132 currently going, I will test it and report here as soon as it's completed.

[Olivier Tilloy (osomon)]

I tested 63.0.3239.132 and 64.0.3282.71 and both versions are vulnerable.
I might have been testing 64.0.3282.39 in a VM earlier, which would explain why it incorrectly detected as not vulnerable.

[Hassan El Jacifi (waver)]

Hello Olivier,

Thanks a lot for testing different builds. We're forced to wait for their new version of 23rd January.

Regards,

[Hassan El Jacifi (waver)]

Hello Olivier,

Any news about the patched version?

Regards,

[Olivier Tilloy (osomon)]

64.0.3282.119 is in bionic-proposed, and will soon be in trusty-security, xenial-security and artful-security.

[Hassan El Jacifi (waver)]

Thanks a lot. Issue fixed