We have all been stunned by the Meltdown and Spectre publications. I like to start this thread to follow updates on this topic. As Raspberry Pi published their hardware is not compromised. The Beaglebone Black, the device we mostly use, is vulnerable to Spectre.
To patch this, if it would be patchable at all, at a lot of places the update needs land. If I would make a list, to come up with the following:
TI or ARM would need to make kernel patches.
Yocto needs to implement these patches.
The host-OS would need updating
The Docker base images need kernel patches?
The Supervisor would have to use an updated base-image
Not to forget our own application.
Anyway, just a topic to list updates. I didn’t look at which of all devices are vulnerable.
We are already looking into the Meltdown and Spectre vulnerabilities. We made a list of all our supported devices, and are trying to get patches into ResinOS as fast as we can.
One thing to keep in mind is that Meltdown and Spectre require code execution on the device, so these vulnerabilities can only be exploited once an attacker is already able to execute code on the device itself.
The base images are not affected by Variant 2, because docker containers do not have their own kernel, but are just “namespaced” within the kernel of the host-OS.
Variant 1 becomes a problem when untrusted code is executed in a sand boxed environment. We are currently trying to find situations where this could be a problem in ResinOS. One example for this would also be the eBPF system in the kernel.
For devices that are affected by Variant 3 of Spectre (aka Meltdown) the same kernel patches (KPTI) will mitigate the problem.
Variant 3a which might leak information from privileged system registers, does not require any additional software mitigation.