Hacker News Reader

Comment by smegsicle | Hacker News Reader

i heard everyone is calling it AVXECUTIONER

> Note that on a vulnerable machine, proper testing of OpenSSL would fail and should be noticed before deployment.

so is 'proper testing' included in the default build script or..?

It's been a while since I've looked at OpenSSL source, or read its compilation instructions in particular, but I remember it tells you to "make test" or similar to run the tests before installing.

Even on systems like Gentoo which build everything the make test option isn't default.

This statement really rubs me the wrong way.

It sounds an awful lot like “you’re responsible for catching our screw-ups” and it’s a bit rich to tell people to do proper testing while the project itself failed to do so before letting this land.

Not at all.

To be vulnerable, you need to build on a non-vulnerable machine which passes the built in tests, then you need to deploy to a vulnerable one and finally you have to not verify that the deployment works.

Absolutely not what you are implying.

I agree about the chain, but it’s incredible easy for this to happen with how most things are distributed as binary packages. Most folks won’t be running the test suites on the end system.

Wouldn’t building on non-vulnerable system also compile the bibary with non-vulnerable instructions? Does a non AVX512 system really build an executable that calls AVX512?

OpenSSL does a lot of runtime detection of what a system is capable of, so I would suspect this can happen.

I don't know if it's in the default build script, but it doesn't really matter -- most people install precompiled binaries.

So nobody running a precompiled binary of their favorite Linux distribution should be affected because distributors should run the full test suite across all supported architectures when they package the binary?

Debian for example shipped vulnerable packages: https://security-tracker.debian.org/tracker/CVE-2022-2274

What the heck, Debian?

"openssl security team accuses debian of not performing proper testing"

Should be noted that the only version marked as vulnerable, "Bookworm", is the "testing" version that has not been officially released yet and has no "security policy" other than best-effort. Its purpose is for testing the next stable release, not for everyday use. Vulnerabilities in the stable or even oldstable releases are fixed much faster and tested much more thoroughly.

still seems like they should run build testing as part of that 'best-effort' (assuming that's what is meant by the advisory's 'proper testing')

It's one thing to run the full test suite across all supported architectures. It's quite another to run the full test suite across all supported CPUs. The vast majority of x86-64 CPUs do not trigger this bug.

If you build on the machine you will deploy to, the tests won't pass. Problem solved.

If you build on an earlier machine where the tests pass and deploy to a later one and then don't check that the deployment works, you are at risk.

I think proper testing covers both options.

Reply on news.ycombinator.com