Έλεγχος επεξεργαστή για προβλήματα ασφάλειας και απενεργοποίηση mitigations

Η χρονιά των προβλημάτων

Αυτή την χρονιά έχουμε μάθει να ζούμε με τα σημαντικά προβλήματα που έχουν οι επεξεργαστές, κυρίως της Intel, λόγω την σχεδίασης τους. Διαβάζουμε πράγματα σαν το παρακάτω:

Τα προβλήματα αυτά αφορούν τον επεξεργαστή και όχι το λειτουργικό. Αλλά σε συνεργασία με την Intel η αντιμετώπιση είναι άμεση και έχουμε νέους πυρήνες και νέο microcode. Αλλά λόγω της φύσης του προβλήματος λίγα πράγματα μπορούν να γίνουν χωρίς να μειωθούν οι επιδόσεις του επεξεργαστή.

Τι προβλήματα έχει ο επεξεργαστής μου ;

Πρέπει να έχουμε τον τελευταίο πυρήνα να είμαστε σίγουροι πως ξέρει για τα τελευταία προβλήματα. Θα δούμε την λίστα των προβλημάτων στον κατάλογο /sys/devices/system/cpu/vulnerabilities/ και με ένα ls μπορούμε να δούμε για ποιες γνωρίζει ο πυρήνας

ls /sys/devices/system/cpu/vulnerabilities/

Για να ελέγξουμε για την ευπάθεια mds για παράδειγμα θα δώσουμε την εντολή

cat /sys/devices/system/cpu/vulnerabilities/mds

Θα δούμε κάτι από τα παρακάτω

 1. Not affected
 2. Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable
 3. Mitigation: Clear CPU buffers; SMT vulnerable
 4. Mitigation: Clear CPU buffers; SMT disabled
 5. Mitigation: Clear CPU buffers; SMT Host state unknown

Στην πρώτη περίπτωση όλα καλά :grinning: ο επεξεργαστής δεν έχει το πρόβλημα. Στην δεύτερη περίπτωση υπάρχει πρόβλημα (Vulnerable). Ο πυρήνας έχει ενημερωθεί αλλά όχι ο microcode της CPU. Στις άλλες περιπτώσεις έχει εφαρμοστεί η διόρθωση (Mitigation). Αλλά μπορεί να υπάρχει ακόμα πρόβλημα στο SMT. Υπάρχουν και άλλες περιπτώσεις ποιο σπάνιες και η πλήρη λίστα μπορεί να βρεθεί εδώ.

Μπορούμε να έχουμε μια αναφορά για την κατάσταση όλων των προβλημάτων με την εντολή

tail -n +1 /sys/devices/system/cpu/vulnerabilities/*


Στην εικόνα είναι η κατάσταση του υπολογιστή που γράφω το άρθρο. Θα πρέπει να απενεργοποιήσω το SMT για πλήρη ασφάλεια. Η intel έδωσε κάποια στοιχεία για επεξεργαστές Xeon και δείχνει πως δεν υπάρχει “σημαντική” απώλεια απόδοσης, αλλά δεν υπάρχουν ακόμα πολλά στοιχεία για όλους τους επεξεργαστές. Στο επόμενο reboot θα το απενεργοποιήσω.

Απενεργοποίηση των mitigation

Πριν να ξεκαθαρίσω πως δεν θέλεις να το κάνεις αυτό. Να το ξαναπώ: δεν θέλεις να το κάνεις αυτό. Με άλλα λόγια, απλά μην το κάνεις. Αν το κάνεις βεβαιώσου πως ο υπολογιστής είναι σε ένα πλήρες ελεγχόμενο περιβάλλον, ιδανικά χωρίς σύνδεση στο δίκτυο. Αν σε ένα τέτοιο υπολογιστή δώσεις κωδικούς της τράπεζας σου, τότε κάνεις ένα χοντρό λάθος (Αν και μπορείς πάντα να μου στείλεις την IP του να σε βοηθήσω σε ένα εσωτερικό έλεγχο :imp:)

Οι τελευταίοι πυρήνες υποστηρίζουν απενεργοποίηση των mitigation. Αυτό το κάνεις με παραμέτρους πυρήνα, μέσω του grub. Θα πρέπει να δώσεις

mitigations=off

και δεν θα εφαρμοστεί καμία διόρθωση. Αλήθεια σου είπα να μην το κάνεις αυτό ή το ξέχασα; Μπορείς να είσαι και ποιο επιλεκτικός κρατώντας κάποιες για παράδειγμα

mitigations=mitigations=auto,nosmt

ή ακόμα να ρυθμίσεις συγκεκριμένα κάθε μια από αυτές. Για παράδειγμα δες την παράμετρο mds στην τεκμηρίωση των παραμέτρων του πυρήνα.

Η πλήρη λίστα των παραμέτρων του πυρήνα μπορεί να βρεθεί εδώ

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html

3 «Μου αρέσει»

δείτε και αυτό…

A shell script to tell if your system is vulnerable against the several "speculative execution" CVEs that were made public since 2018.

    CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
    CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
    CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
    CVE-2018-3640 [rogue system register read] aka 'Variant 3a'
    CVE-2018-3639 [speculative store bypass] aka 'Variant 4'
    CVE-2018-3615 [L1 terminal fault] aka 'Foreshadow (SGX)'
    CVE-2018-3620 [L1 terminal fault] aka 'Foreshadow-NG (OS)'
    CVE-2018-3646 [L1 terminal fault] aka 'Foreshadow-NG (VMM)'
    CVE-2018-12126 [microarchitectural store buffer data sampling (MSBDS)] aka 'Fallout'
    CVE-2018-12130 [microarchitectural fill buffer data sampling (MFBDS)] aka 'ZombieLoad'
    CVE-2018-12127 [microarchitectural load port data sampling (MLPDS)] aka 'RIDL'
    CVE-2019-11091 [microarchitectural data sampling uncacheable memory (MDSUM)] aka 'RIDL'

Supported operating systems:

    Linux (all versions, flavors and distros)
    BSD (FreeBSD, NetBSD, DragonFlyBSD)
3 «Μου αρέσει»

καλησπερα αρκετα ενδιαφερον το αρθρο .Επειδη χρησιμοποιω τον υπολογιστη για πληρωμες και με ενα test που εκανα με τις εντολες ειδικα με την τριτη ειναι ακριβως τα ιδια αποτελεσματα καποια βοηθεια ευχαριστω.(γνωσεις αρχαριος)

1 «Μου αρέσει»

Καλωσόρισες στο φόρουμ @gung

1 «Μου αρέσει»

Οι εντολές είναι για να ελέγξεις αν ο επεξεργαστής έχει προβλήματα και ποια συγκεκριμένα είναι, καθώς και για ποια προβλήματα γνωρίζει ο πυρήνας που χρησιμοποιείς. Κανένας δεν μπορεί να μας βεβαιώσει πως αύριο δεν θα εμφανιστεί κάποιο καινούργιο.

Δεν λέει το άρθρο για το αν ο υπολογιστής σου είναι προστατευμένος ή όχι, αντίθετα δίνει μια κάκιστη μέθοδο για να αφαιρέσεις τις προστασίες αν υπάρχουν. Για να δεις αν όντως είσαι προστατευμένος ή λύση είναι αυτή που έδωσε ο @ratmole.

Αυτό που μπορείς να κάνεις σε ένα υπολογιστή για να είσαι προστατευμένος, ειδικά σε τραπεζικές συναλλαγές είναι:

  • Να χρησιμοποιείς μια διανομή Linux και να μην μπαίνεις στην τράπεζα από τα Windows ποτέ
  • Να εφαρμόζεις τις τελευταίες αναβαθμίσεις του λειτουργικού
  • Να έχεις ενημερωμένο BIOS
  • Να χρησιμοποιείς ένα χωριστό profil ή ένα διαφορετικό περιηγητή για την τράπεζα
  • Να μην κάνεις βλακείες στον υπολογιστή.
    Κοινή λογική και όχι τυφλή αντιγραφή συμβουλών και εντολών ή εγκαταστάσεις προγραμμάτων εκτός αποθετηρίων.
  • Να μας διαβάζεις και να μας παρακολουθείς. Αν υπάρξει κάποιο σημαντικό πρόβλημα, θα ενημερώσουμε εδώ, μαι με την λύση. Υποσχόμαστε πως δεν θα βγάζουμε κούφιες ειδήσεις για την ασφάλεια κάθε βδομάδα, ώστε να σου αυξήσουμε την ανασφάλεια σου και να κάνεις κλικ, ώστε να σοθ δείξουμε διαφημίσεις (που δεν έχουμε)
1 «Μου αρέσει»

ευχαριστω για τις πληροφοριες.

1 «Μου αρέσει»
Περίληψη

Spectre and Meltdown mitigation detection tool v0.42

Checking for vulnerabilities on current system
Kernel is Linux 4.15.0-55-generic #60-Ubuntu SMP Tue Jul 2 18:22:20 UTC 2019 x86_64
CPU is Intel(R) Core™ i3-4330 CPU @ 3.50GHz

Hardware check

  • Hardware support (CPU microcode) for mitigation techniques
    • Indirect Branch Restricted Speculation (IBRS)
      • SPEC_CTRL MSR is available: YES
      • CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
    • Indirect Branch Prediction Barrier (IBPB)
      • PRED_CMD MSR is available: YES
      • CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
    • Single Thread Indirect Branch Predictors (STIBP)
      • SPEC_CTRL MSR is available: YES
      • CPU indicates STIBP capability: YES (Intel STIBP feature bit)
    • Speculative Store Bypass Disable (SSBD)
      • CPU indicates SSBD capability: YES (Intel SSBD)
    • L1 data cache invalidation
      • FLUSH_CMD MSR is available: YES
      • CPU indicates L1D flush capability: YES (L1D flush feature bit)
    • Microarchitecture Data Sampling
      • VERW instruction is available: YES (MD_CLEAR feature bit)
    • Enhanced IBRS (IBRS_ALL)
      • CPU indicates ARCH_CAPABILITIES MSR availability: NO
      • ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
    • CPU explicitly indicates not being vulnerable to Meltdown/L1TF (RDCL_NO): NO
    • CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): NO
    • CPU/Hypervisor indicates L1D flushing is not necessary on this system: NO
    • Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): NO
    • CPU explicitly indicates not being vulnerable to Microarchitectural Data Sampling (MDS_NO): NO
    • CPU supports Software Guard Extensions (SGX): NO
    • CPU microcode is known to cause stability problems: NO (model 0x3c family 0x6 stepping 0x3 ucode 0x27 cpuid 0x306c3)
    • CPU microcode is the latest known available version: YES (latest version is 0x27 dated 2019/02/26 according to builtin MCExtractor DB v112 - 2019/05/22)
  • CPU vulnerability to the speculative execution attack variants
    • Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
    • Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
    • Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
    • Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
    • Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
    • Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO
    • Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
    • Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES
    • Vulnerable to CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): YES
    • Vulnerable to CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): YES
    • Vulnerable to CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): YES
    • Vulnerable to CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): YES

CVE-2017-5753 aka ‘Spectre Variant 1, bounds check bypass’

  • Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
  • Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
  • Kernel has the Red Hat/Ubuntu patch: NO
  • Kernel has mask_nospec64 (arm64): NO

STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 aka ‘Spectre Variant 2, branch target injection’

  • Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
  • Mitigation 1
    • Kernel is compiled with IBRS support: YES
      • IBRS enabled and active: YES (for firmware code only)
    • Kernel is compiled with IBPB support: YES
      • IBPB enabled and active: YES
  • Mitigation 2
    • Kernel has branch predictor hardening (arm): NO
    • Kernel compiled with retpoline option: YES
      • Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)

STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka ‘Variant 3, Meltdown, rogue data cache load’

  • Mitigated according to the /sys interface: YES (Mitigation: PTI)
  • Kernel supports Page Table Isolation (PTI): YES
    • PTI enabled and active: YES
    • Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
  • Running as a Xen PV DomU: NO

STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka ‘Variant 3a, rogue system register read’

  • CPU microcode mitigates the vulnerability: YES

STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 aka ‘Variant 4, speculative store bypass’

  • Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
  • Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
  • SSB mitigation is enabled and active: YES (per-thread through prctl)
  • SSB mitigation currently active for selected processes: YES (firefox ModemManager systemd-journald systemd-logind systemd-resolved systemd-timesyncd systemd-udevd tor)

STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka ‘Foreshadow (SGX), L1 terminal fault’

  • CPU microcode mitigates the vulnerability: N/A

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3620 aka ‘Foreshadow-NG (OS), L1 terminal fault’

  • Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
  • Kernel supports PTE inversion: YES (found in kernel image)
  • PTE inversion enabled and active: YES

STATUS: NOT VULNERABLE (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)

CVE-2018-3646 aka ‘Foreshadow-NG (VMM), L1 terminal fault’

  • Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
  • This system is a host running a hypervisor: NO
  • Mitigation 1 (KVM)
    • EPT is disabled: NO
  • Mitigation 2
    • L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
    • L1D flush enabled: YES (conditional flushes)
    • Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
    • Hyper-Threading (SMT) is enabled: YES

STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2018-12126 aka ‘Fallout, microarchitectural store buffer data sampling (MSBDS)’

  • Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
  • Kernel mitigation is enabled and active: YES
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT vulnerable)

CVE-2018-12130 aka ‘ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)’

  • Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
  • Kernel mitigation is enabled and active: YES
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT vulnerable)

CVE-2018-12127 aka ‘RIDL, microarchitectural load port data sampling (MLPDS)’

  • Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
  • Kernel mitigation is enabled and active: YES
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT vulnerable)

CVE-2019-11091 aka ‘RIDL, microarchitectural data sampling uncacheable memory (MDSUM)’

  • Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
  • Kernel mitigation is enabled and active: YES
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers; SMT vulnerable)

SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer

μπορει καποιος να διαβαση τα αποτελεσματα και να μου πει κατι .Ευχαριστω

Στο λέει

Όλα καλά, no problem

ευχαριστω για την απαντηση

Περίληψη

Spectre and Meltdown mitigation detection tool v0.42

Checking for vulnerabilities on current system
Kernel is Linux 5.2.3-050203-generic #201907260838 SMP Fri Jul 26 08:41:32 UTC 2019 x86_64
CPU is Intel(R) Core™ i7-8750H CPU @ 2.20GHz

Hardware check

  • Hardware support (CPU microcode) for mitigation techniques
    • Indirect Branch Restricted Speculation (IBRS)
      • SPEC_CTRL MSR is available: YES
      • CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
    • Indirect Branch Prediction Barrier (IBPB)
      • PRED_CMD MSR is available: YES
      • CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
    • Single Thread Indirect Branch Predictors (STIBP)
      • SPEC_CTRL MSR is available: YES
      • CPU indicates STIBP capability: YES (Intel STIBP feature bit)
    • Speculative Store Bypass Disable (SSBD)
      • CPU indicates SSBD capability: YES (Intel SSBD)
    • L1 data cache invalidation
      • FLUSH_CMD MSR is available: YES
      • CPU indicates L1D flush capability: YES (L1D flush feature bit)
    • Microarchitecture Data Sampling
      • VERW instruction is available: NO
    • Enhanced IBRS (IBRS_ALL)
      • CPU indicates ARCH_CAPABILITIES MSR availability: NO
      • ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
    • CPU explicitly indicates not being vulnerable to Meltdown/L1TF (RDCL_NO): NO
    • CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): NO
    • CPU/Hypervisor indicates L1D flushing is not necessary on this system: NO
    • Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): NO
    • CPU explicitly indicates not being vulnerable to Microarchitectural Data Sampling (MDS_NO): NO
    • CPU supports Software Guard Extensions (SGX): YES
    • CPU microcode is known to cause stability problems: NO (model 0x9e family 0x6 stepping 0xa ucode 0x96 cpuid 0x906ea)
    • CPU microcode is the latest known available version: NO (latest version is 0xb4 dated 2019/04/01 according to builtin MCExtractor DB v112 - 2019/05/22)
  • CPU vulnerability to the speculative execution attack variants
    • Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
    • Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
    • Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
    • Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
    • Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
    • Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES
    • Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
    • Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES
    • Vulnerable to CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): YES
    • Vulnerable to CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): YES
    • Vulnerable to CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): YES
    • Vulnerable to CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): YES

CVE-2017-5753 aka ‘Spectre Variant 1, bounds check bypass’

  • Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
  • Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
  • Kernel has the Red Hat/Ubuntu patch: NO
  • Kernel has mask_nospec64 (arm64): NO

STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5715 aka ‘Spectre Variant 2, branch target injection’

  • Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
  • Mitigation 1
    • Kernel is compiled with IBRS support: YES
      • IBRS enabled and active: YES (for firmware code only)
    • Kernel is compiled with IBPB support: YES
      • IBPB enabled and active: YES
  • Mitigation 2
    • Kernel has branch predictor hardening (arm): NO
    • Kernel compiled with retpoline option: YES
      • Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
    • Kernel supports RSB filling: YES

STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka ‘Variant 3, Meltdown, rogue data cache load’

  • Mitigated according to the /sys interface: YES (Mitigation: PTI)
  • Kernel supports Page Table Isolation (PTI): YES
    • PTI enabled and active: YES
    • Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
  • Running as a Xen PV DomU: NO

STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka ‘Variant 3a, rogue system register read’

  • CPU microcode mitigates the vulnerability: YES

STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 aka ‘Variant 4, speculative store bypass’

  • Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
  • Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
  • SSB mitigation is enabled and active: YES (per-thread through prctl)
  • SSB mitigation currently active for selected processes: YES (firefox-esr systemd-journald systemd-logind systemd-udevd)

STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka ‘Foreshadow (SGX), L1 terminal fault’

  • CPU microcode mitigates the vulnerability: YES

STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability)

CVE-2018-3620 aka ‘Foreshadow-NG (OS), L1 terminal fault’

  • Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
  • Kernel supports PTE inversion: YES (found in kernel image)
  • PTE inversion enabled and active: YES

STATUS: NOT VULNERABLE (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)

CVE-2018-3646 aka ‘Foreshadow-NG (VMM), L1 terminal fault’

  • Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
  • This system is a host running a hypervisor: NO
  • Mitigation 1 (KVM)
    • EPT is disabled: NO
  • Mitigation 2
    • L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
    • L1D flush enabled: YES (conditional flushes)
    • Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
    • Hyper-Threading (SMT) is enabled: YES

STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2018-12126 aka ‘Fallout, microarchitectural store buffer data sampling (MSBDS)’

  • Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: VULNERABLE (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)

CVE-2018-12130 aka ‘ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)’

  • Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: VULNERABLE (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)

CVE-2018-12127 aka ‘RIDL, microarchitectural load port data sampling (MLPDS)’

  • Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: VULNERABLE (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)

CVE-2019-11091 aka ‘RIDL, microarchitectural data sampling uncacheable memory (MDSUM)’

  • Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
  • Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: VULNERABLE (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)

SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer

Εμένα δεν είναι όλα NOT VULNERABLE τι πρέπει να κάνω;
Οι αλλαγές αυτές θα επηρεάσουν και τα υπόλοιπα λειτουργικά συστήματα σε περίπτωση π.χ. dual boot με windows 10;

Παιδιά καλύτερα στα μεγάλα post να βάζετε hide tags

1 «Μου αρέσει»

Εδώ λέει πως έχει πρόβλημα. Και λέει πως δεν έχει την αναβάθμιση microcode. Update BIOS και εγκατάστασή του microcode (intel-microcode ή amd64-microcode) . Αναβάθμιση πυρήνα αν είναι παλιός.

Το micocode μπορεί να το περνάει το BIOS ή το λειτουργικό. Το microcode παρέχει στο λειτουργικό το μέσο να φτιάξει το πρόβλημα, αλλά δεν το φτιάχνει μόνο του. Για άλλα λειτουργικά επικοινώνησε με το τμήμα υποστήριξης πελατών τους ή με την κοινότητα τους.

1 «Μου αρέσει»

spectre-meltdown-checker v0.44
Checking for vulnerabilities on current system
Kernel is Linux 5.11.8-200.fc33.x86_64 #1 SMP Mon Mar 22 01:35:01 UTC 2021 x86_64
CPU is AMD Ryzen 9 5950X 16-Core Processor

Περίληψη

Hardware check

  • Hardware support (CPU microcode) for mitigation techniques
    • Indirect Branch Restricted Speculation (IBRS)
      • SPEC_CTRL MSR is available: YES
      • CPU indicates IBRS capability: YES (IBRS_SUPPORT feature bit)
      • CPU indicates preferring IBRS always-on: NO
      • CPU indicates preferring IBRS over retpoline: YES
    • Indirect Branch Prediction Barrier (IBPB)
      • PRED_CMD MSR is available: YES
      • CPU indicates IBPB capability: YES (IBPB_SUPPORT feature bit)
    • Single Thread Indirect Branch Predictors (STIBP)
      • SPEC_CTRL MSR is available: YES
      • CPU indicates STIBP capability: YES (AMD STIBP feature bit)
      • CPU indicates preferring STIBP always-on: YES
    • Speculative Store Bypass Disable (SSBD)
      • CPU indicates SSBD capability: YES (AMD SSBD in SPEC_CTRL)
    • L1 data cache invalidation
      • FLUSH_CMD MSR is available: NO
      • CPU indicates L1D flush capability: NO
    • CPU supports Transactional Synchronization Extensions (TSX): NO
    • CPU supports Software Guard Extensions (SGX): NO
    • CPU supports Special Register Buffer Data Sampling (SRBDS): NO
    • CPU microcode is known to cause stability problems: NO (family 0x19 model 0x21 stepping 0x0 ucode 0xa201009 cpuid 0xa20f10)
    • CPU microcode is the latest known available version: YES (latest version is 0xa201009 dated 2020/08/21 according to builtin firmwares DB v165.20201021+i20200616)
  • CPU vulnerability to the speculative execution attack variants
    • Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
    • Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
    • Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO
    • Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): NO
    • Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
    • Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO
    • Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO
    • Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO
    • Vulnerable to CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO
    • Vulnerable to CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO
    • Vulnerable to CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO
    • Vulnerable to CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO
    • Vulnerable to CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO
    • Vulnerable to CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): NO
    • Vulnerable to CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO

CVE-2017-5753 aka ‘Spectre Variant 1, bounds check bypass’

  • Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
  • Kernel has array_index_mask_nospec: UNKNOWN (couldn’t check (kernel compression format is unknown or image is invalid))
  • Kernel has the Red Hat/Ubuntu patch: UNKNOWN (couldn’t check (kernel compression format is unknown or image is invalid))
  • Kernel has mask_nospec64 (arm64): UNKNOWN (couldn’t check (kernel compression format is unknown or image is invalid))
  • Kernel has array_index_nospec (arm64): UNKNOWN (couldn’t check (kernel compression format is unknown or image is invalid))
  • Checking count of LFENCE instructions following a jump in kernel… UNKNOWN (couldn’t check (kernel compression format is unknown or image is invalid))

STATUS: NOT VULNERABLE (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)

CVE-2017-5715 aka ‘Spectre Variant 2, branch target injection’

  • Mitigated according to the /sys interface: YES (Mitigation: Full AMD retpoline, IBPB: conditional, IBRS_FW, STIBP: always-on, RSB filling)
  • Mitigation 1
    • Kernel is compiled with IBRS support: YES
      • IBRS enabled and active: YES (for firmware code only)
    • Kernel is compiled with IBPB support: YES
      • IBPB enabled and active: YES
  • Mitigation 2
    • Kernel has branch predictor hardening (arm): NO
    • Kernel compiled with retpoline option: YES
      • Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)

STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka ‘Variant 3, Meltdown, rogue data cache load’

  • Mitigated according to the /sys interface: YES (Not affected)
  • Kernel supports Page Table Isolation (PTI): YES
    • PTI enabled and active: NO
    • Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
  • Running as a Xen PV DomU: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3640 aka ‘Variant 3a, rogue system register read’

  • CPU microcode mitigates the vulnerability: YES

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3639 aka ‘Variant 4, speculative store bypass’

  • Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
  • Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
  • SSB mitigation is enabled and active: YES (per-thread through prctl)
  • SSB mitigation currently active for selected processes: YES (auditd bluetoothd bwrap dbus-broker dbus-broker-launch earlyoom firefox fwupd gconf-helper irqbalance ModemManager pipewire pipewire-media-session pulseaudio systemd-homed systemd-journald systemd-logind systemd-resolved systemd-userdbd systemd-userwork udevadm upowerd)

STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka ‘Foreshadow (SGX), L1 terminal fault’

  • CPU microcode mitigates the vulnerability: N/A

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3620 aka ‘Foreshadow-NG (OS), L1 terminal fault’

  • Mitigated according to the /sys interface: YES (Not affected)
  • Kernel supports PTE inversion: UNKNOWN (kernel compression format is unknown or image is invalid)
  • PTE inversion enabled and active: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3646 aka ‘Foreshadow-NG (VMM), L1 terminal fault’

  • Information from the /sys interface: Not affected
  • This system is a host running a hypervisor: NO
  • Mitigation 1 (KVM)
    • EPT is disabled: N/A (the kvm_intel module is not loaded)
  • Mitigation 2
    • L1D flush is supported by kernel: UNKNOWN (kernel compression format is unknown or image is invalid)
    • L1D flush enabled: NO
    • Hardware-backed L1D flush supported: NO (flush will be done in software, this is slower)
    • Hyper-Threading (SMT) is enabled: YES

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-12126 aka ‘Fallout, microarchitectural store buffer data sampling (MSBDS)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • Kernel supports using MD_CLEAR mitigation: UNKNOWN
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-12130 aka ‘ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • Kernel supports using MD_CLEAR mitigation: UNKNOWN
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-12127 aka ‘RIDL, microarchitectural load port data sampling (MLPDS)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • Kernel supports using MD_CLEAR mitigation: UNKNOWN
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2019-11091 aka ‘RIDL, microarchitectural data sampling uncacheable memory (MDSUM)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • Kernel supports using MD_CLEAR mitigation: UNKNOWN
  • Kernel mitigation is enabled and active: NO
  • SMT is either mitigated or disabled: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2019-11135 aka ‘ZombieLoad V2, TSX Asynchronous Abort (TAA)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • TAA mitigation is supported by kernel: UNKNOWN (kernel compression format is unknown or image is invalid)
  • TAA mitigation enabled and active: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-12207 aka ‘No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • This system is a host running a hypervisor: NO
  • iTLB Multihit mitigation is supported by kernel: UNKNOWN (kernel compression format is unknown or image is invalid)
  • iTLB Multihit mitigation enabled and active: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2020-0543 aka ‘Special Register Buffer Data Sampling (SRBDS)’

  • Mitigated according to the /sys interface: YES (Not affected)
  • SRBDS mitigation control is supported by the kernel: UNKNOWN (kernel compression format is unknown or image is invalid)
  • SRBDS mitigation control is enabled and active: NO

STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK