2 new Intel vulnerabilites

[Lorenzo Lamas]

There are 2 new vulnerabilities in Intel CPU's, also affecting Xen. Xen has issued XSA-304(CVE-2018-12207) and XSA 305(CVE-2019-11135). Is the Qubes team aware yet? I haven't seen a new QSB.

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Yes, we're aware. We're currently in the process of preparing
announcements about these XSAs.

Typically, XSAs have a predisclosure period, during which the XSA is
embargoed, and the Qubes Security Team has time to analyze it and
prepare patches and an announcement. However, these XSAs had no
embargo period, so the Qubes Security Team had no advance notice of
them before they were publicly announced.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAl3NSEQACgkQ203TvDlQ
MDDX8xAAlbt56HUIhFc13wh1F6E9H0aU2cve5Kp8Z9VmIvIp+yJP2RKr6jU4BLXJ
Pxee0Peax/yZBwl7cg99plpssz1hGNn7mAv3Fgjcs23YVMPvHc5w6GtqTwayrKHF
yFjLjA0b48gtPryP4qe5DYg+IZkaA7GIMDiHXoRafOLvQXP4KaH2x/SjsES0VXIh
ZMfasNe5KHznn0aODpvGZC7znNkhUt3VP0xYeijGup2+ZoptDhxtYtUlKx8Y+Jqk
uxPkfY9bUgqhqqKTmNCYQ+g53LgU+kn5ulITmunwEYkgQ+WD23Y7mT9rq9Uj/pro
XCaMMNhVVm4iUSvOO5MwuzxJqpX3ae2BHbsg096uNzk6zpAb8dkNfvZsV0cm/b2X
j94Uc4hG2MlLgI6U0by7/PYMc5n0oaSYGS9Jfrjz7TiTStId/sdRty1iVcerGjrl
/+oyRG8wuVfiOVF0QJfDZ4ds6BX0aOssR8rhyJkdJVBfTRJTdF94mQRt8V6XK1rT
ZqGHGATDXDIb1TseqOtnDoRjevlszATErPJSEnMMMpYT7VFSDt9Xy4UnPGLeF+oi
Ba18M1yuH+WGS+g0zA3ESYf98Nbs9iILUTi0/BaNC0tQj6GrKOpJtCcZVoBlEAsz
xi/ZafAVvjRWnRDSxaDewIl2bwpvrDJp71TunU8FX89rYR9NvDY=
=5FCB
-----END PGP SIGNATURE-----

[Chris Laprise]

On 11/14/19 7:28 AM, Andrew David Wong wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 2019-11-13 12:40 PM, Lorenzo Lamas wrote:
>> There are 2 new vulnerabilities in Intel CPU's, also affecting Xen.
>> Xen has issued XSA-304(CVE-2018-12207) and XSA 305(CVE-2019-11135).
>> Is the Qubes team aware yet? I haven't seen a new QSB.
>>
>
> Yes, we're aware. We're currently in the process of preparing
> announcements about these XSAs.
>
> Typically, XSAs have a predisclosure period, during which the XSA is
> embargoed, and the Qubes Security Team has time to analyze it and
> prepare patches and an announcement. However, these XSAs had no
> embargo period, so the Qubes Security Team had no advance notice of
> them before they were publicly announced.

The researchers behind these MDS vuln disclosures were being strung
along by Intel, who kept changing embargo dates. Eventually they decided
to simply publish because the proposed patches from Intel were not
addressing a large number of possible attacks.

I have summary, links and some advice here:
https://groups.google.com/d/msgid/qubes-users/85c426f7-7e17-b1ab-87c3-71f92d169955%40posteo.net

In short, Intel have played a monopolist's game and delivered products
that match; Its much better (and simpler) for people to move to AMD at
least for the time being. It would help if the Qubes community had some
clear AMD choices.

--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2019-11-14 6:28 AM, Andrew David Wong wrote:
> On 2019-11-13 12:40 PM, Lorenzo Lamas wrote:
>> There are 2 new vulnerabilities in Intel CPU's, also affecting
>> Xen. Xen has issued XSA-304(CVE-2018-12207) and XSA
>> 305(CVE-2019-11135). Is the Qubes team aware yet? I haven't seen
>> a new QSB.
>
>
> Yes, we're aware. We're currently in the process of preparing
> announcements about these XSAs.
>
> Typically, XSAs have a predisclosure period, during which the XSA
> is embargoed, and the Qubes Security Team has time to analyze it
> and prepare patches and an announcement. However, these XSAs had
> no embargo period, so the Qubes Security Team had no advance notice
> of them before they were publicly announced.
>

The announcements have been published:

https://www.qubes-os.org/news/2019/11/13/xsa-304-qubes-not-affected/

https://www.qubes-os.org/news/2019/11/13/qsb-053/

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAl3NXTIACgkQ203TvDlQ
MDB1tRAAwCpQCkP52V7LlN7TJGA2jdJGffw+Wp12l66m3fmY/y3FnxZnVBR8Q+Jm
rZ2TDW/khZVUyi3Oq8OH9BwClIBgO9k3HLu/Cjt68QoKsth24SRmufdzDicsBzJG
BFwXpX/uxJ7U08Ja1vlRWj3wln0pCc5xFKMkpDLMQ/3xaL/bAdXgMcxx5eAIUrjI
rd2V5UkqQsIFnEIfWyyVI45gcr8jCIb2P5TZ9yKuyKmHJQHBqYUlLwuc0cK+Az+J
4SXwTMpp1H1F+iKhyageOgbCZQiVdxbodlw3rAyvA/rZ1zxogN+q27yfIkQu9TBO
Mj461YeX/bAHM35WNPJhCSH9Ivm/ahBGBCJxpwuZF9BWWE1gLfjQuZsEUQbJizjc
hn3oxsw2yFSg0bEuRJxkgHr9f/e2LnPDOc5lRJ/HY6ST2739CZfVgrxTV+4wKusv
c4/TGuXigOIKisLE3QBUFewZESbo6SfdLPDNHcgUWpunk66g/xMMGvTFIRcXbzWt
hKcnKj3+9qWFhJbuRF5VWDDuVIF0/biXglQAsUVM3q6xK5OKDTjXGR6M/DvQGH68
sNEEOY8K+OcbGvX0188IGrrmK25i5X0z+0U4hFJFOi8e1iKh24a6cCi9hJ//Sotj
q0t5EUspfPzz7i6yE/FU1N0USZQSENtZKz18LV+NsEiQoO9qDaU=
=J53Z
-----END PGP SIGNATURE-----

[Lorenzo Lamas]

Thank you, and thanks for the earlier explanation!
Btw, do you think it is possible for Qubes to distribute the Intel fTPM(http://tpm.fail/) update somehow like Qubes does with microcodes?

[haaber]

Just a small comprehension question to the microkerel update shipped in
the last xen update: are these microkernels "flashed" into some cpu
memory, or are they re-run / setup at each boot again? Cheers, Bernhard

[awokd]

haaber:

> Just a small comprehension question to the microkerel update shipped in
> the last xen update: are these microkernels "flashed" into some cpu
> memory, or are they re-run / setup at each boot again? Cheers, Bernhard
>

I think you mean microcode. From what I know, the CPU starts with burned
in microcode. Firmware/BIOS will then patch it if it has a more current
version. The OS will then patch it again if a more current version.

--
- don't top post
Mailing list etiquette:
- trim quoted reply to only relevant portions
- when possible, copy and paste text instead of screenshots

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, Nov 14, 2019 at 10:37:33AM -0800, Lorenzo Lamas wrote:
> Btw, do you think it is possible for Qubes to distribute the Intel
> fTPM(http://tpm.fail/) update somehow like Qubes does with microcodes?

I don't think it's directly possible, this part of the system firmware
is specific to particular device configuration (bundled together with
the rest of BIOS/UEFI), not only CPU.

A quote from Intel advisory:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
| Intel recommends that users of Intel® CSME, Intel® SPS, Intel® TXE,
| Intel® AMT and Intel® DAL update to the latest version provided by the
| system manufacturer that addresses these issues.

There could be a way to ease updating system firmware by integrating
fwupd, but it isn't done yet:
https://github.com/QubesOS/qubes-issues/issues/4855

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEhrpukzGPukRmQqkK24/THMrX1ywFAl3PEHUACgkQ24/THMrX
1yy5rAf+OUCwS/oIGN04ps6Skv19pwCL8gkKizEoncXduI5nXUI1hBcqtmfBPbUj
orJqWt65YKQPeCnWubbJHHA5cIe0KtG/yPTtMcG98caU8Qi1y/vi2Nv7lt6+y1GL
BbGe/O2ZHYuZAMGLg9bbk3ZXmQ8hrAyHCB+3vvVxIlrPHkOShjpHztsgguug00MI
sPNdg9IHurPNwbwbMgwHGIUDOgFr7MilGT1y3afzBEIrHZCT5SaPHernUYGd7oD9
PmhGsb5grJo5eYDO+wiizrW/by2BUXH+4Qeimtxk+N7xqqk7/btQXl77dOGQ5k/t
1uNcXNluSAXVspKvKJTIXhGlpJmAMQ==
=cXye
-----END PGP SIGNATURE-----

[rec wins]

so, are there people running Q4.x on AMD machines? if so which ones?

[Michael Andersson]

Yes we are running qubes R4.0.1-RC2 on  thinkpad T495 with AMD Ryzen pro
Needs ‎R4.1-testing kernel and xen but otherwise works flawless

Lähetetty Jolla Sailfish -älypuhelimestani.
  Alkuperäinen viesti  
Lähettäjä: rec wins
Lähetetty: lauantaina 16. marraskuuta 2019 23.51
Päättymisaika: qubes...@googlegroups.com
Aihe: [qubes-users] Re: 2 new Intel vulnerabilites

--
You received this message because you are subscribed to the Google Groups "qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e15049ac-149f-a053-9bd5-3dbaa323931c%40riseup.net.

[reg...@gmail.com]

Hi Michael!

Do you have a link or could you please write me few lines about the T495 installation description?

I have stuck in the encryption settings after the GUI installer did not started.

Thanks in advance!

To unsubscribe from this group and stop receiving emails from it, send an email to qubes...@googlegroups.com.

[unman]

On Mon, Feb 03, 2020 at 05:13:55AM -0800, reg...@gmail.com wrote:
> Hi Michael!
>
> Do you have a link or could you please write me few lines about the T495
> installation description?
> I have stuck in the encryption settings after the GUI installer did not
> started.
>
> Thanks in advance!
>

> 2019. november 17., vas??rnap 8:37:06 UTC id??pontban Michael Andersson a
> k??vetkez??t ??rta:

> >
> > Yes we are running qubes R4.0.1-RC2 on thinkpad T495 with AMD Ryzen pro

> > Needs ???R4.1-testing kernel and xen but otherwise works flawless
> >
> > L??hetetty Jolla Sailfish -??lypuhelimestani.
> > Alkuper??inen viesti
> > L??hett??j??: rec wins
> > L??hetetty: lauantaina 16. marraskuuta 2019 23.51
> > P????ttymisaika: qubes...@googlegroups.com <javascript:>

Hi
The convention here is not to top-post.
Please scroll to the bottom of the message before you start typing. Or
reply inline.
It only takes you seconds, and makes it much easier to follow threads.
Thanks.
unman

[Anac]

On 2/3/20 8:31 PM, unman wrote:
> On Mon, Feb 03, 2020 at 05:13:55AM -0800, reg...@gmail.com wrote:

>> [a lot of text, quotes and blah]

> Hi
> The convention here is not to top-post.
> Please scroll to the bottom of the message before you start typing. Or
> reply inline.
> It only takes you seconds, and makes it much easier to follow threads.
> Thanks.
> unman
>

Yes. And please, reggelo, remove the text areas that you are not
referring to. This can save a lot of people a lot of time.

[reg...@gmail.com]

2020. február 3., hétfő 16:52:16 UTC időpontban Anac a következőt írta:

On 2/3/20 8:31 PM, unman wrote:
> On Mon, Feb 03, 2020 at 05:13:55AM -0800, reg...@gmail.com wrote:
> The convention here is not to top-post.

 

Yes. And please, reggelo, remove the text areas that you are not

referring to. This can save a lot of people a lot of time.

Thanks for the info! I will keep that in mind!

If somebody else could help with this too, please don't be shy! ;)

[reg...@gmail.com]

> Do you have a link or could you please write me few lines about the T495 installation description?

Meanwhile i have found the solution how can i install, maybe could helps if somebody stuck like me...

Firstly i try with the 'legacy boot', but the GUI could not worked (probably because of the new VGA). The text installer could not worked too, because of the autopart problem with encrypted volume.
But with EFI the installation worked! Only few problem appeared:
- sys-net (and sys-firewall) could not started because of a network interface (bus 03:maybe the IPMI?!?), but when i removed, sys-net (and sys-firewall) started without problem.
- Could not adjust the backlight
- After the system went to suspend state, can not come back. It shows only blank screen
- When the system reboot or shutdown the watchdog delays the process (~0.5-2 min!), because it is not stop.

The first two problem solved by kernel upgrade (5.4.10), but the second two still exists...

---

Lenovo T495 Version: AMD Ryzen 7 PRO 3700U w/ Radeon Vega Mobile Gfx

[zach...@gmail.com]

I've got the same exact setup and same issues with suspend/resume :(

Haven't found any solution so far, have you?

[reg...@gmail.com]

 

I've got the same exact setup and same issues with suspend/resume :(

Haven't found any solution so far, have you?

Not yet, but i think the key is the xen upgrade. Could somebody tell me how can i upgrade it?

[reg...@gmail.com]

I've got the same exact setup and same issues with suspend/resume :(

Haven't found any solution so far, have you?

I have tried with 4.1 (Build4.1-20200131) but the result is the same: suspend/resume not working :(

With Debian (Bullseye) works! But after i install the xen, same suspend issue appear again...

Related lines from dmesg:

'

[    4.957422] kfd kfd: Allocated 3969056 bytes on gart
[    4.957512] kfd kfd: error getting iommu info. is the iommu enabled?
[    4.957514] kfd kfd: Error initializing iommuv2
[    4.961211] kfd kfd: device 1002:15d8 NOT added due to errors

'

@Michael Andersson: Could you please tell us which configuration works to you?