{"id":2277,"date":"2018-01-03T16:23:41","date_gmt":"2018-01-04T00:23:41","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2277"},"modified":"2018-03-22T11:08:08","modified_gmt":"2018-03-22T18:08:08","slug":"mitigations-landing-new-class-timing-attack","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2018\/01\/03\/mitigations-landing-new-class-timing-attack\/","title":{"rendered":"Mitigations landing for new class of timing attack"},"content":{"rendered":"

Several recently-published research<\/a> articles<\/a> have demonstrated a new class of timing attacks (Meltdown and Spectre) that work on modern CPUs. \u00a0Our internal experiments confirm that it is possible to use similar techniques from Web content to read private information between different origins. \u00a0The full extent of this class of attack is still under investigation and we are working with security researchers and other browser vendors to fully understand the threat and fixes. \u00a0Since this new class of attacks involves measuring precise time intervals, as a partial, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. \u00a0This includes both explicit sources, like performance.now()<\/code>, and implicit sources that allow building high-resolution timers, viz., SharedArrayBuffer<\/code>.<\/p>\n

Specifically, in all release channels, starting with 57:<\/p>\n