BTW, whoever can change the topic from "Meltdown/Spectre: Kernel Memory Leaking":
memory leak sort of means something ("malloc without free").
private memory content leakage or unauthorized memory read may mean something else...
just saying (yeah, I hate this term too, but I think it's well deserved for this topic.)
Meltdown/Spectre: Unauthorized Disclosure of Kernel Memory
Message
Last firmware 20171117_p20171215-r1
Look better today, but still unable to known if I'm still vulnerable by meltdown
6 month they are aware of the problem and yet not capable to give a proper patch...
Code: Select all
[ 0.000000] microcode: microcode updated early to revision 0xba, date = 2017-04-09
[ 2.692722] microcode: sig=0x506e3, pf=0x20, revision=0xba
[ 2.692854] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba6 month they are aware of the problem and yet not capable to give a proper patch...
For meltdown you need a patched kernel (grep secure /proc/cpuinfo)gengreen wrote:Last firmware 20171117_p20171215-r1
Look better today, but still unable to known if I'm still vulnerable by meltdownCode: Select all
[ 0.000000] microcode: microcode updated early to revision 0xba, date = 2017-04-09 [ 2.692722] microcode: sig=0x506e3, pf=0x20, revision=0xba [ 2.692854] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
6 month they are aware of the problem and yet not capable to give a proper patch...
For spectre you need gcc,kernel patching plus microcode for intel (gcc + kernel only for amd)
#define HelloWorld int
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
- Wallsandfences
- Guru
- Posts: 378
- Joined: Mon Mar 29, 2010 11:40 pm
- NeddySeagoon
- Administrator
- Posts: 56088
- Joined: Sat Jul 05, 2003 9:37 am
- Location: 56N 3W
That will be another when the new gcc is out.
Code: Select all
emerge -e @worldRegards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Will it? or will it just be the kernel? I would have thought it would just be the kernel that needs to be rebuild with the new speculative branching mitigation (ie poisoning it)NeddySeagoon wrote:That will be anotherwhen the new gcc is out.Code: Select all
emerge -e @world
#define HelloWorld int
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
- EasterParade
- l33t
- Posts: 938
- Joined: Sat Jul 26, 2003 10:48 am
Got patched kernel and updated microcode
I still see this:
Or is the patch in 4.14.11-r2 not complete yet?
Code: Select all
[ 0.000000] microcode: microcode updated early to revision 0x22, date = 2017-01-27
[ 0.000000] Linux version 4.14.11-gentoo-r2 (root@aldebaran) (gcc version 6.4.0 (Gentoo 6.4.0 p1.1)) #2 SMP Sun Jan 7 10:09:37 CET 2018
Code: Select all
grep secure /proc/cpuinfo
bugs : cpu_insecure
bugs : cpu_insecure
bugs : cpu_insecure
bugs : cpu_insecure
bugs : cpu_insecure
bugs : cpu_insecure
bugs : cpu_insecure
bugs : cpu_insecure
you will see that, that is just a verbose note that your CPU is classified as insecure. dmesg | grep -i isolation should indicate whether the page table isolation is loadedtranssib wrote:Got patched kernel and updated microcodeI still see this:Code: Select all
[ 0.000000] microcode: microcode updated early to revision 0x22, date = 2017-01-27 [ 0.000000] Linux version 4.14.11-gentoo-r2 (root@aldebaran) (gcc version 6.4.0 (Gentoo 6.4.0 p1.1)) #2 SMP Sun Jan 7 10:09:37 CET 2018Or is the patch in 4.14.11-r2 not complete yet?Code: Select all
grep secure /proc/cpuinfo bugs : cpu_insecure bugs : cpu_insecure bugs : cpu_insecure bugs : cpu_insecure bugs : cpu_insecure bugs : cpu_insecure bugs : cpu_insecure bugs : cpu_insecure
#define HelloWorld int
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
IMHO it is needed for Spectre v2 to recompile everything, but I am not sure about Spectre v1 tho:Naib wrote:Will it? or will it just be the kernel? I would have thought it would just be the kernel that needs to be rebuild with the new speculative branching mitigation (ie poisoning it)NeddySeagoon wrote:That will be anotherwhen the new gcc is out.Code: Select all
emerge -e @world
https://security.googleblog.com/2018/01 ... cpu_4.html
- transpetaflops
- Apprentice
- Posts: 160
- Joined: Mon May 16, 2005 3:46 pm
What is the source of these new microcode files? On Intel's website I can only find the original microcode file from 20171117 and none of the updated ones.gengreen wrote:Last firmware 20171117_p20171215-r1
Look better today, but still unable to known if I'm still vulnerable by meltdownCode: Select all
[ 0.000000] microcode: microcode updated early to revision 0xba, date = 2017-04-09 [ 2.692722] microcode: sig=0x506e3, pf=0x20, revision=0xba [ 2.692854] microcode: Microcode Update Driver: v2.01 <tigran@aivazian.fsnet.co.uk>, Peter Oruba
6 month they are aware of the problem and yet not capable to give a proper patch...
https://downloadcenter.intel.com/download/27337
- Wallsandfences
- Guru
- Posts: 378
- Joined: Mon Mar 29, 2010 11:40 pm
I can confirm that the microcode works on meltdown for skylake u/y
Code: Select all
0x000406e3
- Wallsandfences
- Guru
- Posts: 378
- Joined: Mon Mar 29, 2010 11:40 pm
Oops, on the next reboot it's gone. I can only speculate, since I updated my bios (intel nuc) and its revision is January the 3rd, that it got new microcode from bios now, skipping the early microcode patching.Wallsandfences wrote:I can confirm that the microcode works on meltdown for skylake u/y
Code: Select all
0x000406e3
R.
This is another 3 in 1 meltdown-spectre mitigation checker:
https://github.com/speed47/spectre-meltdown-checker
It checks if any of the mitigations were applied.
On AMD apu , kernel 4.14.12-gentoo, without KPTI enabled in kernel config:
https://github.com/speed47/spectre-meltdown-checker
It checks if any of the mitigations were applied.
On AMD apu , kernel 4.14.12-gentoo, without KPTI enabled in kernel config:
Code: Select all
sh spectre-meltdown-checker.sh
Spectre and Meltdown mitigation detection tool v0.13
Checking vulnerabilities against Linux 4.14.12-gentoo #1 SMP Sun Jan 7 17:54:49 CET 2018 x86_64
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Kernel compiled with LFENCE opcode inserted at the proper places: NO (only 23 opcodes found, should be >= 70)
> STATUS: VULNERABLE
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
* Hardware (CPU microcode) support for mitigation: NO
* Kernel support for IBRS: NO
* IBRS enabled for Kernel space: NO
* IBRS enabled for User space: NO
* Mitigation 2
* Kernel compiled with retpolines: NO
> STATUS: NOT VULNERABLE (your CPU is not vulnerable as per the vendor)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI): NO
* PTI enabled and active: NO
> STATUS: NOT VULNERABLE (your CPU is not vulnerable as per the vendor)latest microcode will be mark stable in a few, you can get it there if you don't want wait :
https://gitweb.gentoo.org/repo/gentoo.g ... 80a1a31b5e
https://gitweb.gentoo.org/repo/gentoo.g ... 80a1a31b5e
Thats not new enough. That is Intels microcode from nov 2017... they have not made avail microcode for spectre ( well maybe to vendors for BIOS updates)krinn wrote:latest microcode will be mark stable in a few, you can get it there if you don't want wait :
https://gitweb.gentoo.org/repo/gentoo.g ... 80a1a31b5e
#define HelloWorld int
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
it's all we have for now, and i didn't myself check, but it's possible that a nov2017 update is indeed the fix.
spectre has been release to public jan2018, it doesn't mean intel has discover the issue that day
and "not quiet sure", but i think devs have find and report the flaw in feb or march 2017.
at least from https://wiki.gentoo.org/wiki/Project:Se ... nd_Spectre
spectre has been release to public jan2018, it doesn't mean intel has discover the issue that day
and "not quiet sure", but i think devs have find and report the flaw in feb or march 2017.
at least from https://wiki.gentoo.org/wiki/Project:Se ... nd_Spectre
and i havecpu:Haswell cpuid: 000306C3 rev need: 0x23
>cpuid -1 | grep serial | tail -n1 | awk '{print $4}' | cut -d\- -f1,2 | sed 's/-//g'
000306C3
>iucode_tool -S -l /lib/firmware/intel-ucode/*
049/001: sig 0x000306c3, pf_mask 0x32, 2017-11-20, rev 0x0023, size 23552
Except...
Intel's PR release on 4th Jan: https://newsroom.intel.com/news-release ... -exploits/
Intel's PR release on 4th Jan: https://newsroom.intel.com/news-release ... -exploits/
Now the nov2017 update may have covered "products introduced within the past five years" as the press statement didn't actually state when that occuredIntel has already issued updates for the majority of processor products introduced within the past five years. By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years. In addition, many operating system vendors, public cloud service providers, device manufacturers and others have indicated that they have already updated their products and services.
#define HelloWorld int
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
#define Int main()
#define Return printf
#define Print return
#include <stdio>
HelloWorld Int {
Return("Hello, world!\n");
Print 0;
This tool is pretty good! Thanks for sharing this. I'm especially glad it's only a shell script - and not a sophisticated C program. So I can see easily what it does.PrSo wrote:This is another 3 in 1 meltdown-spectre mitigation checker:
https://github.com/speed47/spectre-meltdown-checker
I just executed it on a newly updated RHEL 7 server. It looks like they already have implemented LFENCE and IBRS in the kernel - here is the output:
Code: Select all
Spectre and Meltdown mitigation detection tool v0.13
Checking vulnerabilities against Linux 3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Dec 28 14:23:39 EST 2017 x86_64
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Kernel compiled with LFENCE opcode inserted at the proper places: YES (112 opcodes found, which is >= 70)
> STATUS: NOT VULNERABLE
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
* Hardware (CPU microcode) support for mitigation: NO
* Kernel support for IBRS: YES
* IBRS enabled for Kernel space: NO
* IBRS enabled for User space: NO
* Mitigation 2
* Kernel compiled with retpolines: NO
> STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpolines are needed to mitigate the vulnerability)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
> STATUS: NOT VULNERABLE (PTI mitigates the vulnerability)
Last edited by mike155 on Mon Jan 08, 2018 1:32 pm, edited 3 times in total.
- EasterParade
- l33t
- Posts: 938
- Joined: Sat Jul 26, 2003 10:48 am
I wonder if that's a side effect of Gentoo kernels not compiling in thousands of useless drivers. Maybe we're fine there.PrSo wrote:This is another 3 in 1 meltdown-spectre mitigation checker:
https://github.com/speed47/spectre-meltdown-checker
It checks if any of the mitigations were applied.
On AMD apu , kernel 4.14.12-gentoo, without KPTI enabled in kernel config:
Code: Select all
sh spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.13 Checking vulnerabilities against Linux 4.14.12-gentoo #1 SMP Sun Jan 7 17:54:49 CET 2018 x86_64 CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Kernel compiled with LFENCE opcode inserted at the proper places: NO (only 23 opcodes found, should be >= 70) > STATUS: VULNERABLE
Add Snapdragon SoC to the list: Qualcomm Joins The CPU Affected List.