Gentoo Forums :: View topic - [Kernel] Vulnérabilités i7 4790 (résolu)

[Kernel] Vulnérabilités i7 4790 (résolu)

View unanswered posts
View posts from last 24 hours

Gentoo Forums Forum Index

French

View previous topic :: View next topic

Author

Message

Anard
Apprentice

Joined: 01 Oct 2020
Posts: 235

Posted: Wed Aug 28, 2024 10:52 am Post subject: [Kernel] Vulnérabilités i7 4790 (résolu)

Bonjour,
Ayant changé de processeur (i5-4460 -> i7-4790), j'ai relancé spectre-meltdown-checker qui me retourne quelques vulnérabilités :

Code:

Mon Intel-microcode est pourtant à jour et bien chargé par le noyau.
Y a-t-il lieu de s'inquiéter et savez-vous ce que je peux faire pour corriger le souci ?
Merci pour vos conseils.

Code:

$ emerge --info intel-microcode
Portage 3.0.65 (python 3.12.3-final-0, default/linux/amd64/23.0/desktop, gcc-13, glibc-2.39-r6, 6.6.47-gentoo-intel x86_64)
=================================================================
System Settings
=================================================================
System uname: Linux-6.6.47-gentoo-intel-x86_64-Intel-R-_Core-TM-_i7-4790_CPU_@_3.60GHz-with-glibc2.39
KiB Mem: 15805164 total, 6612700 free
KiB Swap: 15749116 total, 15749116 free
Timestamp of repository gentoo: Wed, 28 Aug 2024 05:15:00 +0000
Head commit of repository gentoo: f4b9e7dab3be1b4bbea21797955c765359e89c95
Timestamp of repository 4nykey: Thu, 22 Aug 2024 15:34:12 +0000
Head commit of repository 4nykey: ffc888135c0d11e3b3c549c7d4206ea63e1d7ed8

Head commit of repository anard: 45e46f1e620f72546d574ff9ff54d96816876995

Head commit of repository brother-overlay: 8e2734200e828711321834a549b32e6819210f5e

Timestamp of repository guru: Tue, 27 Aug 2024 10:04:04 +0000
Head commit of repository guru: 20fa21e872c38b129aa0d61a7ec82aac1996c349

Timestamp of repository haarp: Mon, 26 Aug 2024 13:19:00 +0000
Head commit of repository haarp: 6b31d74600a9c818a2869d1f167486aeafbb78ac

Head commit of repository kodi-overlay: 1a2fbb16f2defcce621b94dbe920ee5b4c5fc5f1

Timestamp of repository steam-overlay: Mon, 30 Jan 2023 17:48:24 +0000
Head commit of repository steam-overlay: cb2e509008f4686631582637696f9f98d10588d6

sh bash 5.2_p26-r6
ld GNU ld (Gentoo 2.42 p3) 2.42.0
distcc 3.4 x86_64-pc-linux-gnu [disabled]
ccache version 4.9.1 [disabled]
app-misc/pax-utils: 1.3.7::gentoo
app-shells/bash: 5.2_p26-r6::gentoo
dev-build/autoconf: 2.13-r8::gentoo, 2.71-r7::gentoo
dev-build/automake: 1.16.5-r2::gentoo
dev-build/cmake: 3.28.5::gentoo
dev-build/libtool: 2.4.7-r4::gentoo
dev-build/make: 4.4.1-r1::gentoo
dev-build/meson: 1.5.1::gentoo
dev-java/java-config: 2.3.4::gentoo
dev-lang/perl: 5.38.2-r3::gentoo
dev-lang/python: 3.11.9_p2::gentoo, 3.12.3-r1::gentoo
dev-lang/rust: 1.79.0::gentoo
dev-util/ccache: 4.9.1-r1::gentoo
sys-apps/baselayout: 2.15::gentoo
sys-apps/openrc: 0.54.2::gentoo
sys-apps/sandbox: 2.38::gentoo
sys-devel/binutils: 2.42-r1::gentoo
sys-devel/binutils-config: 5.5::gentoo
sys-devel/clang: 18.1.8::gentoo
sys-devel/gcc: 13.3.1_p20240614::gentoo
sys-devel/gcc-config: 2.11::gentoo
sys-devel/lld: 18.1.8::gentoo
sys-devel/llvm: 18.1.8-r1::gentoo
sys-kernel/linux-headers: 6.6-r1::gentoo (virtual/os-headers)
sys-libs/glibc: 2.39-r6::gentoo
Repositories:

gentoo
location: /var/db/repos/gentoo
sync-type: rsync
sync-uri: rsync://rsync1.fr.gentoo.org/gentoo-portage
priority: -1000
volatile: False
sync-rsync-extra-opts:
sync-rsync-verify-max-age: 24
sync-rsync-verify-metamanifest: yes
sync-rsync-verify-jobs: 1

4nykey
location: /var/db/repos/4nykey
sync-type: git
sync-uri: https://github.com/gentoo-mirror/4nykey.git
masters: gentoo
volatile: False

anard
location: /var/db/repos/anard
sync-type: git
sync-uri: https://github.com/Anard/anard-overlay.git
masters: gentoo
volatile: False

brother-overlay
location: /var/db/repos/brother-overlay
sync-type: git
sync-uri: https://github.com/stefan-langenmaier/brother-overlay.git
masters: gentoo
volatile: False

guru
location: /var/db/repos/guru
sync-type: git
sync-uri: https://github.com/gentoo-mirror/guru.git
masters: gentoo
volatile: False

haarp
location: /var/db/repos/haarp
sync-type: git
sync-uri: https://github.com/gentoo-mirror/haarp.git
masters: gentoo
volatile: False

kodi-overlay
location: /var/db/repos/kodi-overlay
sync-type: git
sync-uri: https://github.com/kodi-overlay/kodi-overlay.git
masters: gentoo
volatile: False

steam-overlay
location: /var/db/repos/steam-overlay
sync-type: git
sync-uri: https://github.com/gentoo-mirror/steam-overlay.git
masters: gentoo
volatile: False

crossdev
location: /var/db/repos/crossdev
masters: gentoo
priority: 10
volatile: False

Installed sets: @basesystem, @desktop, @development, @games, @multimedia, @office
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="@BINARY-REDISTRIBUTABLE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=haswell -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php8.2/ext-active/ /etc/php/cgi-php8.2/ext-active/ /etc/php/cli-php8.2/ext-active/ /etc/php/fpm-php8.2/ext-active/ /etc/php/phpdbg-php8.2/ext-active/ /etc/revdep-rebuild /etc/sandbox.d"
CXXFLAGS="-march=haswell -O2 -pipe"
DISTDIR="/var/cache/distfiles"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME"
FCFLAGS="-march=haswell -O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg-live config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync merge-wait multilib-strict network-sandbox news parallel-fetch pid-sandbox pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-march=haswell -O2 -pipe"
GENTOO_MIRRORS="ftp://ftp.free.fr/mirrors/ftp.gentoo.org/ http://ftp.free.fr/mirrors/ftp.gentoo.org/ http://mirrors.soeasyto.com/distfiles.gentoo.org/ https://mirrors.ircam.fr/pub/gentoo-distfiles/ http://mirror.leaseweb.com/gentoo/ https://mirrors.soeasyto.com/distfiles.gentoo.org/"
LANG="fr_FR.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
LEX="flex"
LINGUAS="fr en es"
MAKEOPTS="-j7"
PKGDIR="/var/cache/binpkgs"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
SHELL="/bin/bash"
USE="X a52 aac acl acpi alsa amd64 apache2 bluetooth branding bzip2 cairo cdda cdr cet crypt cups dbus dri dts dvd dvdr elogind encode exif flac fr gdbm gif gpm gtk gui iconv icu ipv6 jpeg kf6compat lcms libnotify libtirpc mad mng mp3 mp4 mpeg multilib ncurses nls ogg opengl openmp pam pango pcre pdf png policykit ppds pulseaudio qt5 readline sdl seccomp sound spell ssl startup-notification svg test-rust tiff truetype udev udisks unicode upower usb vorbis vulkan wxwidgets x264 xattr xcb xft xml xv xvid zlib" ABI_X86="64" ADA_TARGET="gcc_12" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt rdrand sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 ntrip navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" GRUB_PLATFORMS="efi-64" GUILE_SINGLE_TARGET="3-0" GUILE_TARGETS="3-0" INPUT_DEVICES="libinput" KERNEL="linux" L10N="fr" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php8-2" POSTGRES_TARGETS="postgres15" PYTHON_SINGLE_TARGET="python3_12" PYTHON_TARGETS="python3_12 python3_11" RUBY_TARGETS="ruby31 ruby32" VIDEO_CARDS="intel i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account"
Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EMERGE_DEFAULT_OPTS, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LFLAGS, LIBTOOL, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PYTHONPATH, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS

=================================================================
Package Settings
=================================================================

sys-firmware/intel-microcode-20240514_p20240514::gentoo was built with the following:
USE="initramfs split-ucode -dist-kernel -hostonly -vanilla" ABI_X86="(64)"

$ dmesg | grep microcode
[ 0.000000] microcode: updated early: 0x1c -> 0x28, date = 2019-11-12
[ 0.462800] microcode: Microcode Update Driver: v2.2.

_________________
"iMack" : GA-H97M-D3H, Intel i7 4790, 16Go DDR3, Intel HD4600, 2x SSD 256Go, HDD 500Go+2To / Clover - macOS Mojave / Gentoo-Xfce
"Portable" : HP 350G3, HDD 500Go / rEFInd - Xubuntu 20.04 / Windows 10

Last edited by Anard on Sat Aug 31, 2024 1:12 pm; edited 1 time in total

nicop
n00b
n00b

Joined: 10 Apr 2014
Posts: 68

Posted: Wed Aug 28, 2024 12:32 pm Post subject:

Que donne :

Code:

grep . /sys/devices/system/cpu/vulnerabilities/*

Ce qui est bizarre c'est que la version 0x28 (juin 2020) est la dernière mais la date ne correspond pas.

De quelle manière charges-tu le microcode, GRUB, initrd, EXTRA_FIRMWARE ?

Anard
Apprentice

Joined: 01 Oct 2020
Posts: 235

Posted: Wed Aug 28, 2024 6:46 pm Post subject:

D'abord merci pour ton intérêt

Quote:

Ce qui est bizarre c'est que la version 0x28 (juin 2020) est la dernière mais la date ne correspond pas.

C'est aussi ce que j'ai noté dans mes resutats...

Code:

$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
/sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: VMX disabled
/sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Unknown: No mitigations
/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected
/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines; IBPB: conditional; IBRS_FW; STIBP: conditional; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected
/sys/devices/system/cpu/vulnerabilities/srbds:Mitigation: Microcode
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
$

J'utilise un autre bootloader (Clover) qui me permet de booter sur macOS si besoin. Dans sa config, je lui donne l'initramfs créé par dracut et le intel-uc.img créé par intel-microcode (que je mets à jour manuellement à chaque update du noyau ou de intel-microcode):

Code:

$ cat /mnt/EFI/EFI/CLOVER/config.plist
[...]
<dict>
<key>Arguments</key>
<string>initrd=\EFI\GENTOO\intel-uc.img initrd=\EFI\GENTOO\initramfs.img root=PARTUUID=dda7f02b-b74d-4127-b0f8-ce989863a87b rw quiet splash</string>
<key>Disabled</key>
<false/>
<key>FullTitle</key>
<string>Gentoo</string>
<key>Hidden</key>
<false/>
<key>Path</key>
<string>\EFI\GENTOO\vmlinuz</string>
<key>Type</key>
<string>Linux</string>
<key>Volume</key>
<string>802D4D2B-F222-4A1C-8CAD-7B006DCE6780</string>
<key>VolumeType</key>
<string>Internal</string>
</dict>
[...]

Pour checker que le intel-uc.img est bien à jour dans la partition EFI de Clover :

Code:

$ diff /mnt/EFI/EFI/GENTOO/intel-uc.img /boot/intel-uc.img
$

Mais je peux aussi démarrer en passant par Grub et d'après mes souvenirs, le souci est le même :

Code:

$ cat /boot/grub/grub.cfg
[...]
### BEGIN /etc/grub.d/10_linux ###
menuentry 'Gentoo GNU/Linux' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-212ee51b-9e79-4c13-b7a6-ff8604b0c941' {
savedefault
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod ext2
set root='hd0,gpt2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt2 --hint-efi=hd0,gpt2 --hint-baremetal=ahci0,gpt2 212ee51b-9e79-4c13-b7a6-ff8604b0c941
else
search --no-floppy --fs-uuid --set=root 212ee51b-9e79-4c13-b7a6-ff8604b0c941
fi
echo 'Chargement de Linux 6.6.47-gentoo-intel…'
linux /boot/vmlinuz-6.6.47-gentoo-intel root=UUID=212ee51b-9e79-4c13-b7a6-ff8604b0c941 ro quiet splash
echo 'Chargement du disque mémoire initial…'
initrd /boot/intel-uc.img /boot/amd-uc.img /boot/initramfs-6.6.47-gentoo-intel.img
}
[...]

Anard
Apprentice

Joined: 01 Oct 2020
Posts: 235

Posted: Wed Aug 28, 2024 6:53 pm Post subject:

Je viens de redémarrer en faisant un chainload sur Grub (Clover boote Gentoo en repassant par Grub plutôt qu'en démarrant directement sur le dernier noyau) et j'obtiens strictement les mêmes résultats, que ce soit sur "spectre-meltdown-checker" ou "grep . /sys/devices/system/cpu/vulnerabilities/*" _________________ "iMack" : GA-H97M-D3H, Intel i7 4790, 16Go DDR3, Intel HD4600, 2x SSD 256Go, HDD 500Go+2To / Clover - macOS Mojave / Gentoo-Xfce "Portable" : HP 350G3, HDD 500Go / rEFInd - Xubuntu 20.04 / Windows 10

nicop
n00b
n00b

Joined: 10 Apr 2014
Posts: 68

Posted: Thu Aug 29, 2024 1:59 am Post subject:

Il y a forcément un soucis quelque part dans la version réellement chargée. Dans le doute, j'essaierai la méthode avec le microcode intégré dans le noyau au lieu de passer par l'initrd : https://wiki.gentoo.org/wiki/Intel_microcode#New_method_without_initram-fs.2Fdisk_.28efistub_compatible.29.

Anard
Apprentice

Joined: 01 Oct 2020
Posts: 235

Posted: Thu Aug 29, 2024 6:15 am Post subject:

Eh bien... ça ne change rien.

Code:

$ grep microcode /proc/cpuinfo
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
$ dmesg | grep microcode
[ 0.000000] microcode: updated early: 0x1c -> 0x28, date = 2019-11-12
[ 0.456078] microcode: Microcode Update Driver: v2.2.
$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
/sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: VMX disabled
/sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Unknown: No mitigations
/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected
/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines; IBPB: conditional; IBRS_FW; STIBP: conditional; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected
/sys/devices/system/cpu/vulnerabilities/srbds:Mitigation: Microcode
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
$

C'est quand même surprenant ce "date=2019-11-12" alors que intel-microcode est daté du 14-05-2024 ... ???
_________________
"iMack" : GA-H97M-D3H, Intel i7 4790, 16Go DDR3, Intel HD4600, 2x SSD 256Go, HDD 500Go+2To / Clover - macOS Mojave / Gentoo-Xfce
"Portable" : HP 350G3, HDD 500Go / rEFInd - Xubuntu 20.04 / Windows 10

nicop
n00b
n00b

Joined: 10 Apr 2014
Posts: 68

Posted: Thu Aug 29, 2024 8:03 am Post subject:

Anard wrote:

C'est quand même surprenant ce "date=2019-11-12" alors que intel-microcode est daté du 14-05-2024 ... ???

C'est effectivement bizarre. La publication du 2019-11-12 ne liste pas ton processeur : https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20191112 et je ne le trouve pas non plus dans cette table : https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html

Anard wrote:

$ grep microcode /proc/cpuinfo
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28
microcode : 0x28

On voit bien que tous les coeurs ont bien la dernière version chargée, c'est le principal.

Anard
Apprentice

Joined: 01 Oct 2020
Posts: 235

Posted: Sat Aug 31, 2024 12:57 pm Post subject:

Voici le résultat complet de spectre-meltdown-checker, je trouve étrancge qu'il ne parvienne pas à lire mon cpuid puisque quand je lance ccette commande, elle parvient à lire les caractéristiques de mon processeur...

Code:

$ sudo spectre-meltdown-checker
Mot de passe :
Spectre and Meltdown mitigation detection tool v0.46

Checking for vulnerabilities on current system
Kernel is Linux 6.6.47-gentoo-intel #2 SMP PREEMPT_DYNAMIC Thu Aug 29 08:01:40 CEST 2024 x86_64
CPU is Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates IBRS capability: UNKNOWN (Found no way to read cpuid info)
* Indirect Branch Prediction Barrier (IBPB)
* CPU indicates IBPB capability: UNKNOWN (is cpuid kernel module available?)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: UNKNOWN (is msr kernel module available?)
* CPU indicates STIBP capability: UNKNOWN (Found no way to read cpuid info)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: UNKNOWN (Found no way to read cpuid info)
* L1 data cache invalidation
* CPU indicates L1D flush capability: UNKNOWN (Found no way to read cpuid info)
* Microarchitectural Data Sampling
* VERW instruction is available: UNKNOWN (Found no way to read cpuid info)
* Indirect Branch Predictor Controls
* Indirect Predictor Disable feature is available: UNKNOWN (Found no way to read cpuid info)
* Bottomless RSB Disable feature is available: UNKNOWN (Found no way to read cpuid info)
* BHB-Focused Indirect Predictor Disable feature is available: UNKNOWN (Found no way to read cpuid info)
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: UNKNOWN (Found no way to read cpuid info)
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: UNKNOWN
* CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): UNKNOWN
* CPU explicitly indicates not being affected by Variant 4 (SSB_NO): UNKNOWN
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: UNKNOWN
* Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): UNKNOWN
* CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): UNKNOWN
* CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): UNKNOWN
* CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): UNKNOWN
* CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): UNKNOWN
* CPU supports Transactional Synchronization Extensions (TSX): UNKNOWN (Found no way to read cpuid info)
* CPU supports Software Guard Extensions (SGX): UNKNOWN (Found no way to read cpuid info)
* CPU supports Special Register Buffer Data Sampling (SRBDS): UNKNOWN (Found no way to read cpuid info)
* CPU microcode is known to cause stability problems: NO (family 0x6 model 0x3c stepping 0x3 ucode 0x28 cpuid 0x0)
* CPU microcode is the latest known available version: UNKNOWN (couldn't get your cpuid)
* CPU vulnerability to the speculative execution attack variants
* Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
* Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
* Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
* Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES
* Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES
* Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES
* Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
* Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES
* Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): YES
* Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): YES
* Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): YES
* Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): YES
* Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): YES
* Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES
* Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): YES
* Affected by CVE-2023-20593 (Zenbleed, cross-process information leak): NO

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
* Kernel has array_index_mask_nospec: NO
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
* Kernel has array_index_nospec (arm64): NO
* Checking count of LFENCE instructions following a jump in kernel... NO (only 29 jump-then-lfence instructions found, should be >= 30 (heuristic))
> STATUS: NOT VULNERABLE (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface: YES (Mitigation: Retpolines; IBPB: conditional; IBRS_FW; STIBP: conditional; RSB filling; PBRSB-eIBRS: Not affected; BHI: Not affected)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: UNKNOWN
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: NO
> STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl)
* Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
* SSB mitigation is enabled and active: YES (per-thread through prctl)
* SSB mitigation currently active for selected processes: NO (no process found using SSB mitigation through prctl)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability: N/A
> STATUS: VULNERABLE (your CPU supports SGX and the microcode is not up to date)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
* Kernel supports PTE inversion: YES (found in kernel image)
* PTE inversion enabled and active: YES
> STATUS: NOT VULNERABLE (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor: NO
* Mitigation 1 (KVM)
* EPT is disabled: NO
* Mitigation 2
* L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: YES (conditional flushes)
* Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: YES
> STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: NO
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers)

CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: NO
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers)

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: NO
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers)

CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* Mitigated according to the /sys interface: YES (Mitigation: Clear CPU buffers; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo)
* Kernel mitigation is enabled and active: YES
* SMT is either mitigated or disabled: NO
> STATUS: NOT VULNERABLE (Mitigation: Clear CPU buffers)

CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'
* Mitigated according to the /sys interface: YES (Not affected)
* TAA mitigation is supported by kernel: YES (found tsx_async_abort in kernel image)
* TAA mitigation enabled and active: NO
> STATUS: NOT VULNERABLE (Not affected)

CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'
* Mitigated according to the /sys interface: YES (KVM: Mitigation: VMX disabled)
* This system is a host running a hypervisor: NO
* iTLB Multihit mitigation is supported by kernel: YES (found itlb_multihit in kernel image)
* iTLB Multihit mitigation enabled and active: YES (KVM: Mitigation: VMX disabled)
> STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Microcode)
* SRBDS mitigation control is supported by the kernel: YES (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active: YES (Mitigation: Microcode)
> STATUS: VULNERABLE (Your CPU microcode may need to be updated to mitigate the vulnerability)

CVE-2023-20593 aka 'Zenbleed, cross-process information leak'
* Zenbleed mitigation is supported by kernel: YES (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active: N/A (CPU is incompatible)
* Zenbleed mitigation is supported by CPU microcode: NO
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:KO CVE-2018-3639:OK CVE-2018-3615:KO CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:KO CVE-2023-20593:OK

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer

Anard
Apprentice

Joined: 01 Oct 2020
Posts: 235

Posted: Sat Aug 31, 2024 1:11 pm Post subject:

OK !

Il fallait compiler les modules CPUID et MSR dans mon noyau, après l'ajout de ces modules et reboot :

Code:

$ sudo spectre-meltdown-checker
[...]
> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK CVE-2023-20593:OK

En revanche les autres commandes donnent les mêmes résultats...
_________________
"iMack" : GA-H97M-D3H, Intel i7 4790, 16Go DDR3, Intel HD4600, 2x SSD 256Go, HDD 500Go+2To / Clover - macOS Mojave / Gentoo-Xfce
"Portable" : HP 350G3, HDD 500Go / rEFInd - Xubuntu 20.04 / Windows 10

xaviermiller
Bodhisattva

Joined: 23 Jul 2004
Posts: 8716
Location: ~Brussels - Belgique

Posted: Sat Aug 31, 2024 7:48 pm Post subject:

Merci pour ton retour _________________ Kind regards, Xavier Miller

Display posts from previous:

	Gentoo Forums Forum Index French	All times are GMT
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Copyright 2001-2024 Gentoo Foundation, Inc. Designed by Kyle Manna © 2003; Style derived from original subSilver theme. | Hosting by Gossamer Threads Inc. © | Powered by phpBB 2.0.23-gentoo-p11 © 2001, 2002 phpBB Group
Privacy Policy