diff options
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/gnuzilla.scm | 6 | ||||
| -rw-r--r-- | gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch | 49 |
3 files changed, 55 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 679c119a5f..d82cbcee26 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -757,6 +757,7 @@ dist_patch_DATA = \ %D%/packages/patches/icecat-bug-1415133.patch \ %D%/packages/patches/icecat-bug-1414945.patch \ %D%/packages/patches/icecat-bug-1424373-pt2.patch \ + %D%/packages/patches/icecat-bug-1427870-spectre-mitigation.patch \ %D%/packages/patches/icu4c-CVE-2017-7867-CVE-2017-7868.patch \ %D%/packages/patches/icu4c-CVE-2017-14952.patch \ %D%/packages/patches/icu4c-reset-keyword-list-iterator.patch \ diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm index a31e93d499..92037326e0 100644 --- a/gnu/packages/gnuzilla.scm +++ b/gnu/packages/gnuzilla.scm @@ -510,7 +510,11 @@ security standards.") (mozilla-patch "icecat-bug-1412145.patch" "66cfc3c4047d" "05j8ic4lv2d2ygr6d62rkdlfyg2rpljalwrkkhllinw2dfi3n15b") (mozilla-patch "icecat-bug-1399400.patch" "3236ffdf0ced" "1kvk4qyslaj1ldgs1wpxnf79zajcihzcd1zvbrg990i3hgyn3gk3") (mozilla-patch "icecat-bug-1424373-pt1.patch" "320032aaa068" "1ch282qibprz1q0f2imvynh4sg7gads6sf3ayhjcd62zjncpgyz7") - (search-patch "icecat-bug-1424373-pt2.patch"))) + (search-patch "icecat-bug-1424373-pt2.patch") + (mozilla-patch "icecat-bug-1412420.patch" "c2945f1249eb" "18p0344w6grpyfiz8dczfw977p0qy37iqv95whgnrjli2ab51kji") + (mozilla-patch "icecat-bug-1395508-pt1.patch" "263165eacc54" "0518xnd9f4qkn7l0z73kldm9dr33y6hf054ril4f8r2j8s9fy33i") + (mozilla-patch "icecat-bug-1395508-pt2.patch" "58e87d9cc44e" "0j9qwjm25bmhw0sj426yl4fqaa6zknf5cjk0yisdd3895652n5i4") + (search-patch "icecat-bug-1427870-spectre-mitigation.patch"))) (modules '((guix build utils))) (snippet '(begin diff --git a/gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch b/gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch new file mode 100644 index 0000000000..6b088286cb --- /dev/null +++ b/gnu/packages/patches/icecat-bug-1427870-spectre-mitigation.patch @@ -0,0 +1,49 @@ +Mitigate Spectre by reducing the resolution of performance.now() to 20 +microseconds. Based on: + + https://hg.mozilla.org/releases/mozilla-release/rev/afa87f9be3a8 + +For more details, see: + + https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ + +This patch was modified to apply cleanly to GNU IceCat. + + +# HG changeset patch +# User Tom Ritter <tom@mozilla.com> +# Date 1514660820 21600 +# Node ID afa87f9be3a8852da3a30f286b15ae599c7874f6 +# Parent 6caa457ebedc915b43dc1d054b8fe22e82ca7447 +Bug 1427870 - Change resolution of .now() to 20us. r=bkelly, a=lizzard + +The comment about workers was introduced in Bug 1186489 but became obsolete some time after that +(definitely by Bug 1278838) + +diff --git a/dom/performance/Performance.cpp b/dom/performance/Performance.cpp +--- a/dom/performance/Performance.cpp ++++ b/dom/performance/Performance.cpp +@@ -234,20 +234,19 @@ Performance::ClearResourceTimings() + { + MOZ_ASSERT(NS_IsMainThread()); + mResourceEntries.Clear(); + } + + DOMHighResTimeStamp + Performance::RoundTime(double aTime) const + { +- // Round down to the nearest 5us, because if the timer is too accurate people +- // can do nasty timing attacks with it. See similar code in the worker +- // Performance implementation. +- const double maxResolutionMs = 0.005; ++ // Round down to the nearest 20us, because if the timer is too accurate people ++ // can do nasty timing attacks with it. ++ const double maxResolutionMs = 0.020; + return floor(aTime / maxResolutionMs) * maxResolutionMs; + } + + + void + Performance::Mark(const nsAString& aName, ErrorResult& aRv) + { + // Don't add the entry if the buffer is full. XXX should be removed by bug 1159003. |