Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Alles rund um sicherheitsrelevante Fragen und Probleme.
Benutzeravatar
towo
Beiträge: 4403
Registriert: 27.02.2007 19:49:44
Lizenz eigener Beiträge: GNU Free Documentation License

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von towo » 22.03.2018 12:33:49

Da kann auch kein intree stehenm, weil vboxdrv ein Out of Tree Modul ist.

clue
Beiträge: 943
Registriert: 08.07.2007 17:36:57

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von clue » 23.03.2018 16:47:57

ingo2 hat geschrieben: ↑ zum Beitrag ↑
21.03.2018 18:45:30
@fireburner
Wo ist da das Problem?
1. Freiwillig installieren die sich sowieso nicht, mußt schon apt bemühen.
2. Und die zusätzliche Tipparbeit (-t stretch-backports) hält sich doch in Genzen ;-)
3. Ist unwahrscheinlich, da es ein proprietärer Blob ist, der nur in "contrib" liegt.
Wie, der wird nicht über die normalen security updates installiert? :?: :!:
Offenbarung 13 erfüllt sich gerade vor unseren Augen, genießen wir also die letzten Jahre unserer Scheinfreiheit

Benutzeravatar
ingo2
Beiträge: 1124
Registriert: 06.12.2007 18:25:36
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Wo der gute Riesling wächst

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von ingo2 » 23.03.2018 17:04:41

Hatte mich oben geirrt:
Das Paket liegt in "stretch-backports non-free" (nicht contrib). In stretch findest du nur die alte Version 3.20170707.1~deb9u1.

fireburner
Beiträge: 140
Registriert: 01.12.2017 20:51:31
Lizenz eigener Beiträge: neue BSD Lizenz
Wohnort: Dänenland

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von fireburner » 23.03.2018 18:49:19

clue hat geschrieben: ↑ zum Beitrag ↑
23.03.2018 16:47:57
Wie, der wird nicht über die normalen security updates installiert? :?: :!:
Bisher zumindest nicht. Siehe: https://packages.debian.org/search?keyw ... lla-search

NAB
Beiträge: 5501
Registriert: 06.03.2011 16:02:23
Lizenz eigener Beiträge: MIT Lizenz

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von NAB » 23.03.2018 18:59:47

clue hat geschrieben: ↑ zum Beitrag ↑
23.03.2018 16:47:57
Wie, der wird nicht über die normalen security updates installiert? :?: :!:
Solange nichts in Debian die neuen Intel Microcodes nutzt (sondern Retpoline und LFENCE), solange wäre es ja kein Security Update, sondern einfach nur zusätzliche (ungenutzte) Funktion.

Die Microcode Updates machen nichts "heil" sondern stellen einfach nur zusätzliche Funktionen bereit, die man gegen Spectre nutzen könnte, wenn man es denn täte.

Meltdown und Spectre sind weiterhin "unreparierbar". Man kann nur versuchen, sie mit Softwareanpassungen zu umgehen bzw. Gelegenheiten dazu zu vermeiden.
Never change a broken system. It could be worse afterwards.

"No computer system can be absolutely secure." Intel Document Number: 336983-001

Nice
Beiträge: 416
Registriert: 14.06.2017 19:36:20

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von Nice » 23.03.2018 21:45:03

@NAB:
Vielen Dank für diese klare Information. :THX:

Mir scheint, dass vielen Menschen echte Gefahren auch auf anderen aktuellen Gebieten nicht realisieren wollen, sondern sie immer wieder glauben, sie könnten auf irgend einem Sonderweg ihnen entgehen.

Weniger dramatisch auf des Thread-Thema beschränkt formuliert: Erst neue Hardware kann das Problem Spectre und Meltdown lösen.
Aber dann gibt es wieder andere Probleme... :roll:

Benutzeravatar
ingo2
Beiträge: 1124
Registriert: 06.12.2007 18:25:36
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Wo der gute Riesling wächst

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von ingo2 » 23.03.2018 21:59:23

Ich bin positiv überrascht:
Lenovo hat heute das BIOS-Update für meinem T520 (Baujahr 2011) verteilt.
Aktuelle Version: 8AET67WW 1.47 vom 14.03.2018.

Ich gehe mal davon aus, daß dort die aktuellen IBRS-Patches für Sandy-Bridge enthalten sind (sowas wie ein ehrliches changelog kennen Firmen offenbar nicht). Das Updaten aus dem Win7-Pro heraus ging völlig problemlos. Ich nutze Win7 praktisch nicht - war eine kostenlose Beigabe - höchstens mal ums Navi upzudaten. Ansonsten läuft Stretch praktisch ohne große Nacharbeit völlig problemlos.

RobertDebiannutzer
Beiträge: 385
Registriert: 16.06.2017 09:52:36

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von RobertDebiannutzer » 25.03.2018 23:45:20

Gibt es eigentlich einen Grund dafür, dass man den stretch-backports keinen gefixten Kernel zukommen lässt?

Der check, als ich mal den Backport-Kernel gestestet hatte (war am 17.02., deshalb noch mit check-tool v.034, aber wird wohl egal sein):

Code: Alles auswählen

Spectre and Meltdown mitigation detection tool v0.34

Checking for vulnerabilities on current system
Kernel is Linux 4.14.0-0.bpo.3-amd64 #1 SMP Debian 4.14.13-1~bpo9+1 (2018-01-14) x86_64
CPU is Intel(R) Celeron(R) CPU          900  @ 2.20GHz

[...]

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Kernel has array_index_mask_nospec:  NO 
* Checking count of LFENCE instructions following a jump in kernel:  NO  (only 2 jump-then-lfence instructions found, should be >= 30 (heuristic))
> STATUS:  VULNERABLE  (Kernel source needs to be patched to mitigate the vulnerability)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  NO 
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO 
    * IBRS enabled for User space:  NO 
    * IBPB enabled:  NO 
* Mitigation 2
  * Kernel compiled with retpoline option:  NO 
  * Kernel compiled with a retpoline-aware compiler:  NO 
  * Retpoline enabled:  NO 
> STATUS:  VULNERABLE  (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI):  YES 
* PTI enabled and active:  YES 
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (PTI mitigates the vulnerability)

A false sense of security is worse than no security at all, see --disclaimer
Die Kernel-Version in den backports ist immer noch die selbe!

Mit dem aktuellen stretch-Kernel (und dem aktuellen check-tool) am 05.03. getestet:

Code: Alles auswählen

Spectre and Meltdown mitigation detection tool v0.35

Checking for vulnerabilities on current system
Kernel is Linux 4.9.0-6-amd64 #1 SMP Debian 4.9.82-1+deb9u3 (2018-03-02) x86_64
CPU is Intel(R) Celeron(R) CPU          900  @ 2.20GHz

[...]

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel has array_index_mask_nospec:  YES  (1 occurence(s) found of 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  NO 
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO 
    * IBRS enabled for User space:  NO 
    * IBPB enabled:  NO 
* Mitigation 2
  * Kernel compiled with retpoline option:  YES 
  * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI):  YES 
* PTI enabled and active:  YES 
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: PTI)

A false sense of security is worse than no security at all, see --disclaimer

Benutzeravatar
schorsch_76
Beiträge: 2535
Registriert: 06.11.2007 16:00:42
Lizenz eigener Beiträge: MIT Lizenz

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von schorsch_76 » 26.03.2018 07:30:55

backports wird nicht vom security Team gepflegt. [1]
FAQ hat geschrieben: Q: Is there security support for packages from backports.debian.org?

A: Unfortunately not. This is done on a best effort basis by the people who track the package, usually the ones who originally did upload the package into backports. When security related bugs are fixed in Debian unstable the backporter is permitted to upload the package from directly there instead of having to wait until the fix hits testing. You can see the open issues for jessie-backports in the security tracker (though there may be false positives too, the version compare isn't perfect yet)
[1] https://backports.debian.org/FAQ/

RobertDebiannutzer
Beiträge: 385
Registriert: 16.06.2017 09:52:36

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von RobertDebiannutzer » 26.03.2018 13:33:34

Ja schon, aber bisher schien es mir immer so, wie wenn die Entwicklung der Backports beim Kernel eng an der aktuellen Entwicklung läuft:

Code: Alles auswählen

[2018-01-20] linux 4.14.13-1 MIGRATED to testing (Debian testing watch)
[2018-01-16] Accepted linux 4.14.13-1~bpo9+1 (all source) into stretch-backports, stretch-backports (Ben Hutchings)
[...]
[2018-01-15] Accepted linux 4.14.13-1 (source) into unstable (Ben Hutchings) 
[...]
[2017-12-27] linux 4.14.7-1 MIGRATED to testing (Debian testing watch)
[...]
[2017-12-23] Accepted linux 4.14.7-1~bpo9+1 (all source) into stretch-backports, stretch-backports (Ben Hutchings)
[...]
[2017-12-22] Accepted linux 4.14.7-1 (all source) into unstable, unstable (Ben Hutchings)
[...]
[2017-11-22] Accepted linux 4.13.13-1~bpo9+1 (source) into stretch-backports (Ben Hutchings)
[2017-11-22] linux 4.13.13-1 MIGRATED to testing (Debian testing watch)
[...]
[2017-11-16] Accepted linux 4.13.13-1 (source) into unstable (Ben Hutchings) 
[...]
[2017-10-25] Accepted linux 4.13.4-2~bpo9+1 (all source) into stretch-backports, stretch-backports (Ben Hutchings)
[...]
[2017-10-19] linux 4.13.4-2 MIGRATED to testing (Debian testing watch)
[...]
[2017-10-15] Accepted linux 4.13.4-2 (source) into unstable (Salvatore Bonaccorso) 
Deswegen dachte ich, es gibt vielleicht spezielle Gründe, denn ansonsten würde man bei so wichtigen Veränderungen ja denken, dass es eher schneller als üblich geht.

Benutzeravatar
hikaru
Moderator
Beiträge: 13559
Registriert: 09.04.2008 12:48:59

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von hikaru » 28.03.2018 11:51:31

Ich bin gerade über "BranchScope" gestolpert. [1][2] Es soll wohl Ähnlichkeiten zu Spectre Variant 2 (CVE-2017-5715 Branch Target Injection) haben.

[1] http://www.cs.ucr.edu/~nael/pubs/asplos18.pdf
[2] https://arstechnica.com/gadgets/2018/03 ... n-attacks/

Benutzeravatar
schorsch_76
Beiträge: 2535
Registriert: 06.11.2007 16:00:42
Lizenz eigener Beiträge: MIT Lizenz

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von schorsch_76 » 28.03.2018 14:53:54

Ups ...... Total Meltdown bei Windows [1]

https://heise.de/-4006862

NAB
Beiträge: 5501
Registriert: 06.03.2011 16:02:23
Lizenz eigener Beiträge: MIT Lizenz

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von NAB » 05.04.2018 18:53:46

Intel hat sich wohl entschlossen, alle Prozessoren, die älter als ca. 2010 (Erscheinungsjahr, nicht Kaufdatum!) sind, nicht mit neuen Microcodes auszurüsten:
https://www.heise.de/security/meldung/S ... 10772.html
Immerhin gibt es eine vollständige(?) Liste:
https://newsroom.intel.com/wp-content/u ... idance.pdf

Für die betroffenen Prozessoren bleibt dann wohl nur Linux (oder BSD), wenn man zumindest auf Betriebssystemebene einen gewissen Schutz gegen Spectre haben möchte.
Never change a broken system. It could be worse afterwards.

"No computer system can be absolutely secure." Intel Document Number: 336983-001

KP97
Beiträge: 3403
Registriert: 01.02.2013 15:07:36

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von KP97 » 05.04.2018 19:42:48

So sieht es mit 4.16.0 aus:
root@SID_A:/home/MB/Progs# ./spectre-meltdown-checker.sh
Spectre and Meltdown mitigation detection tool v0.35

Checking for vulnerabilities on current system
Kernel is Linux 4.16.0 #1 SMP Thu Apr 5 18:09:57 CEST 2018 x86_64
CPU is Intel(R) Core(TM) i3-7100U CPU @ 2.40GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: YES
* CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: YES
* CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: YES
* CPU indicates STIBP capability: YES
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: NO
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): NO
* CPU microcode is known to cause stability problems: NO (model 142 stepping 9 ucode 0x84)
* CPU vulnerability to the three speculative execution attacks variants
* Vulnerable to Variant 1: YES
* Vulnerable to Variant 2: YES
* Vulnerable to Variant 3: YES

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel has array_index_mask_nospec: YES (1 occurence(s) found of 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Mitigation 1
* Kernel is compiled with IBRS/IBPB support: YES
* Currently enabled features
* IBRS enabled for Kernel space: UNKNOWN
* IBRS enabled for User space: UNKNOWN
* IBPB enabled: UNKNOWN
* Mitigation 2
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
> STATUS: NOT VULNERABLE (Mitigation: Full generic retpoline, IBPB, IBRS_FW)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

Benutzeravatar
ingo2
Beiträge: 1124
Registriert: 06.12.2007 18:25:36
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Wo der gute Riesling wächst

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von ingo2 » 09.05.2018 22:54:17

Fortsetzung folgt - oder "the never ending story"?
https://www.heise.de/security/meldung/S ... 43790.html
Spectre NG mit 8 weiteren Lücken!
Und wieder sind die Software-Entwickler die, die es ausbaden müssen :hail:

dufty2
Beiträge: 1709
Registriert: 22.12.2013 16:41:16

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von dufty2 » 22.05.2018 06:54:54

Spectre 3a [1] und Spectre 4 [2] sind jetzt da, vgl. auch https://www.heise.de/security/meldung/C ... 51900.html

Im Gegensatz zur Heise-Aussage ist zumindest für Linus' Kernel tree schon ein patch eingearbeitet [3].
Für Kernel.org und debian Kernel wird man sich wohl noch ein wenig gedulden müssen,
wie auch für ein spectre-meltdown-checker.sh-Update ;)

[1] https://www.intel.com/content/www/us/en ... 00115.html
[2] https://www.redhat.com/en/blog/speculat ... w-it-works
[2a] https://bugs.chromium.org/p/project-zer ... il?id=1528
[3] https://git.kernel.org/pub/scm/linux/ke ... 4019ff1a8f

dufty2
Beiträge: 1709
Registriert: 22.12.2013 16:41:16

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von dufty2 » 17.06.2018 21:23:06

phoronix [1] hat auf eine slideshare-Präsentation [2] eines Ubuntu-MA hingewiesen:
A Complete Look At Spectre V1/V2/V4 & Meltdown

Da ich schon die Folien nicht verstanden habe, habe ich mir die vollständige Präsentation in Form eines Youtube-Video [3] in Chinesisch erspart ;)

[1] https://www.phoronix.com/scan.php?page= ... e-Meltdown
[2] https://www.slideshare.net/GavinGuo3/sp ... -102527086
[3] https://www.youtube.com/watch?v=zYRI60uAwYc

Benutzeravatar
hikaru
Moderator
Beiträge: 13559
Registriert: 09.04.2008 12:48:59

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von hikaru » 27.08.2018 12:34:52

Im Zuge der Microcode-Lizenz-Geschichte [1] hatte ich am Freitag auf einem Ivy-Bridge-Notebook mit Stretch/amd64 mal nachgeschaut und gesehen, dass das System immer noch als anfällig für Spectre V4 ausgewiesen ist:

Code: Alles auswählen

# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
Vulnerable
Dabei ist es egal, ob ich dem Kernel nach [2] den Parameter spec_store_bypass_disable=on mitgebe oder nicht. Das war vor und nach dem Update von Debianintel-microcode so und es spielt auch keine Rolle ob ich Kernel 4.9 oder 4.17 aus den Backports boote.

Kann das jemand erklären?


[1] viewtopic.php?f=1&t=170640
[2] https://wiki.ubuntu.com/SecurityTeam/Kn ... e/Variant4

Nice
Beiträge: 416
Registriert: 14.06.2017 19:36:20

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von Nice » 20.09.2018 11:12:07

Neueste Informationen zum Thema.
Intel Microcode für Debian Stable aktualisiert: https://linuxnews.de/2018/09/intel-micr ... ualisiert/

Benutzeravatar
Par@noid
Beiträge: 244
Registriert: 09.11.2005 13:33:35
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Schwarzwald

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von Par@noid » 23.09.2018 14:53:19

hikaru hat geschrieben: ↑ zum Beitrag ↑
27.08.2018 12:34:52
Im Zuge der Microcode-Lizenz-Geschichte [1] hatte ich am Freitag auf einem Ivy-Bridge-Notebook mit Stretch/amd64 mal nachgeschaut und gesehen, dass das System immer noch als anfällig für Spectre V4 ausgewiesen ist:

Code: Alles auswählen

# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
Vulnerable
Dabei ist es egal, ob ich dem Kernel nach [2] den Parameter spec_store_bypass_disable=on mitgebe oder nicht. Das war vor und nach dem Update von Debianintel-microcode so und es spielt auch keine Rolle ob ich Kernel 4.9 oder 4.17 aus den Backports boote.

Kann das jemand erklären?


[1] viewtopic.php?f=1&t=170640
[2] https://wiki.ubuntu.com/SecurityTeam/Kn ... e/Variant4
So sieht es mit 4.18. aus:
# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
Mitigation: Speculative Store Bypass disabled via prctl and seccomp

Erklärung:
The processor is vulnerable and the mitigation needs to be enabled by using prctl() or seccomp().

spectre-meltdown-checker
Spectre and Meltdown mitigation detection tool v0.39

Checking for vulnerabilities on current system
Kernel is Linux 4.18.0-1-amd64 #1 SMP Debian 4.18.8-1 (2018-09-18) x86_64
CPU is Intel(R) Core(TM) i5-7600K CPU @ 3.80GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: YES
* CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: YES
* CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: YES
* CPU indicates STIBP capability: YES (Intel STIBP feature bit)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: YES (Intel SSBD)
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: NO
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): NO
* CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): NO
* Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): NO
* CPU microcode is known to cause stability problems: NO (model 0x9e family 0x6 stepping 0x9 ucode 0x8e cpuid 0x906e9)
* CPU vulnerability to the speculative execution attack variants
* Vulnerable to Variant 1: YES
* Vulnerable to Variant 2: YES
* Vulnerable to Variant 3: YES
* Vulnerable to Variant 3a: YES
* Vulnerable to Variant 4: YES

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
* Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB, IBRS_FW)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: YES (for kernel and firmware code)
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
* Kernel supports RSB filling: YES
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 [rogue system register read] aka 'Variant 3a'
* CPU microcode mitigates the vulnerability: YES
> STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 [speculative store bypass] aka 'Variant 4'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports speculation store bypass: YES (found in /proc/self/status)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
MfG Par@noid
Man hilft den Menschen nicht, wenn man für sie tut, was sie selbst tun können .....

Debian GNU/Linux Bookworm/sid 64-bit| GNOME Version 43 :THX:

Benutzeravatar
hikaru
Moderator
Beiträge: 13559
Registriert: 09.04.2008 12:48:59

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von hikaru » 25.09.2018 12:53:44

Par@noid hat geschrieben: ↑ zum Beitrag ↑
23.09.2018 14:53:19
So sieht es mit 4.18. aus:
# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
Mitigation: Speculative Store Bypass disabled via prctl and seccomp
Nach dem letzten Microcode-Update sieht es mit 4.17-bpo genauso aus.

Benutzeravatar
Par@noid
Beiträge: 244
Registriert: 09.11.2005 13:33:35
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Schwarzwald

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von Par@noid » 05.12.2018 15:30:53

Info linux kernel 4.20.0-rc5 :
spectre-meltdown-checker
Spectre and Meltdown mitigation detection tool v0.40

Checking for vulnerabilities on current system
Kernel is Linux 4.20.0-rc5 #1 SMP Wed Dec 5 14:40:40 CET 2018 x86_64
CPU is Intel(R) Core(TM) i5-7600K CPU @ 3.80GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBRS capability: UNKNOWN (is cpuid kernel module available?)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBPB capability: UNKNOWN (is cpuid kernel module available?)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates STIBP capability: UNKNOWN (is cpuid kernel module available?)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: UNKNOWN (is cpuid kernel module available?)
* L1 data cache invalidation
* FLUSH_CMD MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates L1D flush capability: UNKNOWN (is cpuid kernel module available?)
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: UNKNOWN (is cpuid kernel module available?)
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: UNKNOWN
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): UNKNOWN
* CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): UNKNOWN
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: UNKNOWN
* Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): UNKNOWN
* CPU supports Software Guard Extensions (SGX): UNKNOWN (is cpuid kernel module available?)
* CPU microcode is known to cause stability problems: NO (model 0x9e family 0x6 stepping 0x9 ucode 0x8e cpuid 0x0)
* CPU microcode is the latest known available version: UNKNOWN (couldn't get your cpuid)
* CPU vulnerability to the speculative execution attack variants
* Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
* Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
* Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
* Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
* Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
* Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES
* Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
* Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
* Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: YES (for kernel and firmware code)
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
* Kernel supports RSB filling: YES
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: NO
> STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports speculation store bypass: YES (found in /proc/self/status)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability: N/A
> STATUS: VULNERABLE (your CPU supports SGX and the microcode is not up to date)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion)
* Kernel supports PTE inversion: YES (found in kernel image)
* PTE inversion enabled and active: YES
> STATUS: NOT VULNERABLE (Mitigation: PTE Inversion)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: VMX: conditional cache flushes, SMT disabled
* This system is a host running an hypervisor: NO
* Mitigation 1 (KVM)
* EPT is disabled: NO
* Mitigation 2
* L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: YES (conditional flushes)
* Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: NO
> STATUS: NOT VULNERABLE (this system is not running an hypervisor)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:KO CVE-2018-3639:OK CVE-2018-3615:KO CVE-2018-3620:OK CVE-2018-3646:OK

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer

MfG Par@noid :THX:
Man hilft den Menschen nicht, wenn man für sie tut, was sie selbst tun können .....

Debian GNU/Linux Bookworm/sid 64-bit| GNOME Version 43 :THX:

Benutzeravatar
Par@noid
Beiträge: 244
Registriert: 09.11.2005 13:33:35
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Schwarzwald

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von Par@noid » 12.03.2019 13:20:01

Info linux kernel 5.0
spectre-meltdown-checker
Spectre and Meltdown mitigation detection tool v0.40

Checking for vulnerabilities on current system
Kernel is Linux 5.0.0 #1 SMP Tue Mar 5 12:57:06 CET 2019 x86_64
CPU is Intel(R) Core(TM) i5-7600K CPU @ 3.80GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBRS capability: UNKNOWN (is cpuid kernel module available?)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBPB capability: UNKNOWN (is cpuid kernel module available?)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates STIBP capability: UNKNOWN (is cpuid kernel module available?)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: UNKNOWN (is cpuid kernel module available?)
* L1 data cache invalidation
* FLUSH_CMD MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates L1D flush capability: UNKNOWN (is cpuid kernel module available?)
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: UNKNOWN (is cpuid kernel module available?)
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: UNKNOWN
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): UNKNOWN
* CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): UNKNOWN
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: UNKNOWN
* Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): UNKNOWN
* CPU supports Software Guard Extensions (SGX): UNKNOWN (is cpuid kernel module available?)
* CPU microcode is known to cause stability problems: NO (model 0x9e family 0x6 stepping 0x9 ucode 0x8e cpuid 0x0)
* CPU microcode is the latest known available version: UNKNOWN (couldn't get your cpuid)
* CPU vulnerability to the speculative execution attack variants
* Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
* Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
* Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
* Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
* Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
* Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES
* Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
* Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
* Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: YES (for kernel and firmware code)
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
* Kernel supports RSB filling: YES
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: NO
> STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports speculation store bypass: YES (found in /proc/self/status)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability: N/A
> STATUS: VULNERABLE (your CPU supports SGX and the microcode is not up to date)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion)
* Kernel supports PTE inversion: YES (found in kernel image)
* PTE inversion enabled and active: YES
> STATUS: NOT VULNERABLE (Mitigation: PTE Inversion)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: VMX: conditional cache flushes, SMT disabled
* This system is a host running an hypervisor: NO
* Mitigation 1 (KVM)
* EPT is disabled: NO
* Mitigation 2
* L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: YES (conditional flushes)
* Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: NO
> STATUS: NOT VULNERABLE (this system is not running an hypervisor)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:KO CVE-2018-3639:OK CVE-2018-3615:KO CVE-2018-3620:OK CVE-2018-3646:OK

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer

MfG Par@noid
Man hilft den Menschen nicht, wenn man für sie tut, was sie selbst tun können .....

Debian GNU/Linux Bookworm/sid 64-bit| GNOME Version 43 :THX:

Benutzeravatar
Par@noid
Beiträge: 244
Registriert: 09.11.2005 13:33:35
Lizenz eigener Beiträge: GNU Free Documentation License
Wohnort: Schwarzwald

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von Par@noid » 08.07.2019 08:53:54

Info linux kernel 5.2
pectre-meltdown-checker
Spectre and Meltdown mitigation detection tool v0.42

Checking for vulnerabilities on current system
Kernel is Linux 5.2.0 #1 SMP Mon Jul 8 08:02:20 CEST 2019 x86_64
CPU is Intel(R) Core(TM) i5-7600K CPU @ 3.80GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBRS capability: UNKNOWN (is cpuid kernel module available?)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBPB capability: UNKNOWN (is cpuid kernel module available?)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates STIBP capability: UNKNOWN (is cpuid kernel module available?)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: UNKNOWN (is cpuid kernel module available?)
* L1 data cache invalidation
* FLUSH_CMD MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates L1D flush capability: UNKNOWN (is cpuid kernel module available?)
* Microarchitecture Data Sampling
* VERW instruction is available: UNKNOWN (is cpuid kernel module available?)
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: UNKNOWN (is cpuid kernel module available?)
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: UNKNOWN
* CPU explicitly indicates not being vulnerable to Meltdown/L1TF (RDCL_NO): UNKNOWN
* CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): UNKNOWN
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: UNKNOWN
* Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): UNKNOWN
* CPU explicitly indicates not being vulnerable to Microarchitectural Data Sampling (MDS_NO): UNKNOWN
* CPU supports Software Guard Extensions (SGX): UNKNOWN (is cpuid kernel module available?)
* CPU microcode is known to cause stability problems: NO (model 0x9e family 0x6 stepping 0x9 ucode 0xb4 cpuid 0x0)
* CPU microcode is the latest known available version: UNKNOWN (couldn't get your cpuid)
* CPU vulnerability to the speculative execution attack variants
* Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
* Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
* Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
* Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
* Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
* Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES
* Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
* Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES
* Vulnerable to CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): YES
* Vulnerable to CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): YES
* Vulnerable to CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): YES
* Vulnerable to CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): YES

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
* Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: YES (for firmware code only)
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
* Kernel supports RSB filling: YES
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: NO
> STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
* SSB mitigation is enabled and active: YES (per-thread through prctl)
* SSB mitigation currently active for selected processes: YES (boltd firefox fwupd geoclue haveged irqbalance ModemManager redis-check-rdb systemd-journald systemd-logind systemd-udevd upowerd vnstatd)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability: N/A
> STATUS: VULNERABLE (your CPU supports SGX and the microcode is not up to date)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT disabled)
* Kernel supports PTE inversion: YES (found in kernel image)
* PTE inversion enabled and active: YES
> STATUS: NOT VULNERABLE (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT disabled)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT disabled
* This system is a host running a hypervisor: NO
* Mitigation 1 (KVM)
* EPT is disabled: NO
* Mitigation 2
* L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: YES (conditional flushes)
* Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: NO
> STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT disabled)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: YES
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT disabled)

CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT disabled)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: YES
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT disabled)

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT disabled)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: YES
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT disabled)

CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT disabled)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: YES
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT disabled)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:KO CVE-2018-3639:OK CVE-2018-3615:KO CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer
MfG Par@noid
Man hilft den Menschen nicht, wenn man für sie tut, was sie selbst tun können .....

Debian GNU/Linux Bookworm/sid 64-bit| GNOME Version 43 :THX:

nudgegoonies
Beiträge: 939
Registriert: 16.02.2009 09:35:10

Re: Hardware-Sicherheitslücken: Meltdown und Spectre: ehem. Intel-Bug

Beitrag von nudgegoonies » 15.07.2019 14:43:36

@Par@noid
Solange Du das Skript nicht als "root" ausführst sind die Ausgaben in der Sektion "Hardware check" ziemlich sinnfrei wegen der vielen "unknown"!

Aber generell ist die Ausgabe je nach verwendeter CPU/Firmware unterschiedlich. Darum verstehe ich ehrlich gesagt nicht, warum Du die Ausgabe von Deinem i5-7600K von jeder Kernelversion hier veröffentlichst.
Soft: Bullseye AMD64, MATE Desktop. Repo's: Backports, kein Proposed, eigene Backports. Grafik: Radeon R7 360 MESA.
Hardware: Thinkstation S20, Intel X58, 16GB, Xeon W3530, BCM5755 NIC, EMU10K1 SND, SATA SSD+HDS und DVD+RW.

Antworten