Bug 12472 - webkitgtk is vulnerable to Meltdown and Spectre defects
Summary: webkitgtk is vulnerable to Meltdown and Spectre defects
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: graphics (show other bugs)
Version: 2.5
Hardware: x86 Multiple
: High normal
Target Milestone: 2.5 M2
Assignee: Alexander Kanavin
QA Contact:
URL:
Whiteboard:
: 12471 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-01-10 17:31 UTC by Randy MacLeod
Modified: 2018-01-15 10:26 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Randy MacLeod 2018-01-10 17:31:55 UTC 
webkit[gtk], is vulnerable to some new CVEs as explained here:
   https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/

   "WebKit is affected because in order to render modern web sites, any web JavaScript engine must allow untrusted JavaScript code to run on the user’s processor." 

and here:
   https://webkitgtk.org/security/WSA-2018-0001.html

There has been an update to webkitgtk:
   https://webkitgtk.org/2018/01/10/webkitgtk2.18.5-released.html
so the master branch should pick that up and see if the high res timer resolution degradations and other changes have any impact on our tests.

We should decide what to do for previous releases since webkit does not appear to provide a git repo and simply recommends upgrading to the latest release to fix CVEs.
Comment 1 Randy MacLeod 2018-01-10 17:34:40 UTC 
*** Bug 12471 has been marked as a duplicate of this bug. ***
Comment 2 Alexander Kanavin 2018-01-12 16:22:45 UTC 
Patches for master, rocko, pyro and morty all sent to oe-core list.