The resurgence of Spectre-like malware has pushed the release date for the next iteration of Linux for at least a week, its creator has confirmed.
In the 5.17-rc8 announcement, the kernel development head Linus Torvalds explained that the discovery of CVE-2021-26341 - a vulnerability in some AMD processors that resembles the dreaded Spectre/Meltdown fiasco, meant the team needed to apply certain patches, which complicated things for the 5.17 version of the OS.
“Last weekend, I thought I’d be releasing the final 5.17 today. That was then, this is now,” he writes.
Flurry of fixes
“Last week was somewhat messy, mostly because of embargoed patches we had pending with another variation of specter attacks. And while the patches were mostly fine, we had the usual “because it was hidden, all our normal testing automation did not see it either”.
Once automation sees “things”, all the possible and impossible combinations get tested, resulting in a “(small) flurry of fixes for the fixes.”
Despite the unforeseen circumstances, Torvalds considered releasing 5.17 anyway, but decided against it, in the end.
“As a result we have an -rc8 release today instead of doing a final 5.17,” he concluded.
Detailing the flaw, AMD said the chips "may transiently execute instructions following an unconditional direct branch that may result in detectable cache activity."
The CVE was rated 4.7/10 on the severity scale, and so far - there had been no reported executions in the wild. Still, since the problem is found in 14 client CPUs and both first-gen and second-gen EPYC silicon for servers, it cannot be neglected.
Torvalds also urged the developers not to rely exclusively on automation farms, and to dig into the work themselves.
"Anyway, let's not keep the testing _just_ to automation," he suggested in his weekly kernel progress update. "The more the merrier, and real-life loads are always more interesting than what the automation farms do. So please do give this last rc a quick try," he added.
- Check out our list of the best firewalls out there
Via: The Register
