Linux Now Disabling TPM Bus Encryption By Default For Performance Reasons

Introduced last year in Linux 6.10 was TPM bus encryption and integration protection for Trusted Platform Module 2 (TPM2) handling. The intent was on better TPM security after a prior security demonstration showed TPM key recovery from Microsoft Windows BitLocker as well as TPM sniffing attacks. Shortly after being merged it was limited to just an x86_64 default where it had been tested the most at the time. Now more than one year later, this feature is being disabled by default in the mainline Linux kernel…

[$] Enhancing FineIBT

At the Linux
Security Summit Europe
(LSS EU), Scott Constable and Sebastian
Österlund gave a talk on an enhancement to a control-flow integrity (CFI)
protection that was added to the kernel several years ago. The “FineIBT: Fine-grain Control-flow
Enforcement with Indirect Branch Tracking
” mechanism was merged for
Linux 6.2 in early 2023 to harden the kernel against CFI attacks of various
sorts, but needed some fixes and
enhancements
more recently. The talk looked at the CFI vulnerability
problem, FineIBT, and an enhanced version that is hoped to be able to unify
all of the disparate hardware and software mitigations to address both
regular and speculative CFI vulnerabilities.

GCC Patches Posted For C++26 SIMD Support

One of the exciting additions on the way for the C++26 programming language is a standardized library around Single Instruction Multiple Data (SIMD) operations. This portable SIMD implementation makes it easier to leverage SIMD and data parallelism in C++ for better performance and to work across SIMD architectures like AVX-512…