Spectre/Meltdown and Debian 9.4

Everything about X, Gnome, KDE, ... and everything running on it

Spectre/Meltdown and Debian 9.4

Postby crackerjack » 2018-03-11 13:19

Have updated Debian to 9.4 and decided to see what's the status of Debian and Spectre/Meltdown.

There are two ways of checking to see if you're vulnerable to Spectre/Meltdown.

1. You can run the following command:
Code: Select all
cat /sys/devices/system/cpu/vulnerabilities/*

For me.. it returns:
Mitigation: PTI
Mitigation: __user pointer sanitization
Mitigation: Full generic retpoline

2. Another option that one can do is enable the backports and install spectre-meltdown-checker.
When I run this command it returns:
Code: Select all
Spectre and Meltdown mitigation detection tool v0.35

Checking for vulnerabilities on current system
Kernel is Linux 4.9.0-6-amd64 #1 SMP Debian 4.9.82-1+deb9u3 (2018-03-02) x86_64
CPU is Intel(R) Core(TM) i3-2328M CPU @ 2.20GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available:  NO
    * CPU indicates IBRS capability:  NO
  * Indirect Branch Prediction Barrier (IBPB)
    * PRED_CMD MSR is available:  NO
    * CPU indicates IBPB capability:  NO
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available:  NO
    * CPU indicates STIBP capability:  NO
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO
  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO
  * CPU microcode is known to cause stability problems:  NO  (model 42 stepping 7 ucode 0x28)
* CPU vulnerability to the three speculative execution attacks variants
  * Vulnerable to Variant 1:  YES
  * Vulnerable to Variant 2:  YES
  * Vulnerable to Variant 3:  YES

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel has array_index_mask_nospec:  YES  (1 occurence(s) found of 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch:  NO
> STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  NO
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO
    * IBRS enabled for User space:  NO
    * IBPB enabled:  NO
* Mitigation 2
  * Kernel compiled with retpoline option:  YES
  * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI):  YES
* PTI enabled and active:  YES
* Running as a Xen PV DomU:  NO

A false sense of security is worse than no security at all, see --disclaimer

In the second part - look at the STATUS line and you can see if you're vulnerable.

For me.. I'm not vulnerable to Spectre and Meltdown. So happy with Debian. Love the stability and low maintenance requirements!
Posts: 3
Joined: 2007-06-26 16:23

Re: Spectre/Meltdown and Debian 9.4

Postby phoenix_art » 2018-03-25 07:11

Thanks for the informations! :)
Posts: 62
Joined: 2013-12-08 17:47

Return to Desktop & Multimedia

Who is online

Users browsing this forum: No registered users and 6 guests