Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian 10?

From	Michael Stone <mstone@debian.org>
Newsgroups	linux.debian.security
Subject	Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian 10?
Date	2021-01-08 22:50 +0100
Message-ID	<Bv7NT-7v4-3@gated-at.bofh.it> (permalink)
References	<Bv6yt-6PR-19@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Jan 08, 2021 at 09:12:53PM +0100, Christoph Pflügler wrote:
>Installing package intel-microcode in Debian 10 (Buster) mitigates 
>most vulnerabilities as per spectre-meltdown-checker. However, 
>CVE-2018-3640 and CVE-2018-3615 are still displayed as unmitigated 
>after reboot, with spectre-meltdown-checker --explain (executed as su) 
>pointing to missing microcode upgrades.
>
>According to the Debian package description of intel-microcode, the 
>two vulnerabilities are fixed in the current version of the package.
>
>This occurs in exactly the same way on two different machines, one 
>with an i5-3320M CPU and another one with an E3-1235L v5.
>
>If I remember correctly, I was all green as per 
>spectre-meltdown-checker in Debian 9 (Stretch).

What version of intel-microcode do you have installed?

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian 10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-08 21:30 +0100
  Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-08 22:50 +0100
    Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-08 23:50 +0100
      Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-09 15:50 +0100
        Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? James Wallen <jpwallen@comcast.net> - 2021-01-09 21:00 +0100
          Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Giacomo Catenazzi <cate@debian.org> - 2021-01-12 17:40 +0100
            Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-13 17:20 +0100
              Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-13 22:00 +0100
                Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-14 00:00 +0100
                Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-14 18:30 +0100
  Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-08 22:50 +0100

csiph-web