Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6021 > unrolled thread

CVE-2017-5715

Started byGeorgi Naplatanov <gosho@oles.biz>
First post2022-03-12 10:50 +0100
Last post2022-04-06 06:40 +0200
Articles 20 — 6 participants

Back to article view | Back to linux.debian.security

Contents

  CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-12 10:50 +0100
    Re: CVE-2017-5715 piorunz <piorunz@gmx.com> - 2022-03-23 15:00 +0100
      Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 15:50 +0100
        Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-23 16:50 +0100
          Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 17:20 +0100
          Re: CVE-2017-5715 piorunz <piorunz@gmx.com> - 2022-03-23 17:40 +0100
            Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 18:40 +0100
              Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-23 21:50 +0100
                Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 22:20 +0100
                  Re: CVE-2017-5715 Salvatore Bonaccorso <carnil@debian.org> - 2022-03-23 22:40 +0100
                    Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-24 09:00 +0100
                  Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-25 02:30 +0100
                    Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-25 08:20 +0100
                      Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-25 18:30 +0100
                        Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-25 18:40 +0100
                          Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-25 19:00 +0100
                            Re: CVE-2017-5715 Salvatore Bonaccorso <carnil@debian.org> - 2022-03-30 07:10 +0200
                              Re: CVE-2017-5715 Sylvestre Ledru <sylvestre@debian.org> - 2022-03-30 09:50 +0200
                                Re: CVE-2017-5715 Holger Levsen <holger@layer-acht.org> - 2022-03-30 11:40 +0200
                                  Re: CVE-2017-5715 Salvatore Bonaccorso <carnil@debian.org> - 2022-04-06 06:40 +0200

#6021 — CVE-2017-5715

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-12 10:50 +0100
SubjectCVE-2017-5715
Message-ID<E06xP-1dVd-3@gated-at.bofh.it>
Hi,

I use Debian stable with kernel

5.10.103-1 (2022-03-07)

but

spectre-meltdown-checker script reports that my system is vulnerable to
CVE-2017-5715. My CPU is Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz

Is this normal?

In the past all checks from spectre-meltdown-checker were green (my
system was not vulnerable).

Kind regards
Georgi

[toc] | [next] | [standalone]

#6022

Frompiorunz <piorunz@gmx.com>
Date2022-03-23 15:00 +0100
Message-ID<E49GN-3Fic-5@gated-at.bofh.it>
In reply to#6021
On 12/03/2022 09:48, Georgi Naplatanov wrote:

> spectre-meltdown-checker script reports that my system is vulnerable to
> CVE-2017-5715. My CPU is Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz
>
> Is this normal?
>
> In the past all checks from spectre-meltdown-checker were green (my
> system was not vulnerable).

Is your vulnerability  shown as follows?

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface:  YES  (Mitigation:
Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
* Mitigation 1
   * Kernel is compiled with IBRS support:  YES
     * IBRS enabled and active:  YES  (for firmware code only)
   * Kernel is compiled with IBPB support:  YES
     * IBPB enabled and active:  YES
* Mitigation 2
   * Kernel has branch predictor hardening (arm):  NO
   * Kernel compiled with retpoline option:  YES
   * Kernel supports RSB filling:  YES
 > STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
needed to mitigate the vulnerability)

--
With kindest regards, Piotr.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#6023

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-23 15:50 +0100
Message-ID<E4atb-3FND-7@gated-at.bofh.it>
In reply to#6022
On 3/23/22 15:58, piorunz wrote:
> On 12/03/2022 09:48, Georgi Naplatanov wrote:
> 
>> spectre-meltdown-checker script reports that my system is vulnerable to
>> CVE-2017-5715. My CPU is Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz
>>
>> Is this normal?
>>
>> In the past all checks from spectre-meltdown-checker were green (my
>> system was not vulnerable).
> 
> Is your vulnerability  shown as follows?
> 
> CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
> * Mitigated according to the /sys interface:  YES  (Mitigation:
> Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
> * Mitigation 1
>   * Kernel is compiled with IBRS support:  YES
>     * IBRS enabled and active:  YES  (for firmware code only)
>   * Kernel is compiled with IBPB support:  YES
>     * IBPB enabled and active:  YES
> * Mitigation 2
>   * Kernel has branch predictor hardening (arm):  NO
>   * Kernel compiled with retpoline option:  YES
>   * Kernel supports RSB filling:  YES
>> STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
> needed to mitigate the vulnerability)
> 

Yes, it seems the same but to avoid possible confusion/mistake I'm
pasting the output below:


CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface:  YES  (Mitigation:
Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
* Mitigation 1
  * Kernel is compiled with IBRS support:  YES
    * IBRS enabled and active:  YES  (for firmware code only)
  * Kernel is compiled with IBPB support:  YES
    * IBPB enabled and active:  YES
* Mitigation 2
  * Kernel has branch predictor hardening (arm):  NO
  * Kernel compiled with retpoline option:  YES
  * Kernel supports RSB filling:  YES
> STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
needed to mitigate the vulnerability)

[toc] | [prev] | [next] | [standalone]

#6024

FromLeandro Cunha <leandrocunha016@gmail.com>
Date2022-03-23 16:50 +0100
Message-ID<E4bpf-3GmO-3@gated-at.bofh.it>
In reply to#6023
Hi,

On Wed, Mar 23, 2022 at 11:47 AM Georgi Naplatanov <gosho@oles.biz> wrote:
>
> On 3/23/22 15:58, piorunz wrote:
> > On 12/03/2022 09:48, Georgi Naplatanov wrote:
> >
> >> spectre-meltdown-checker script reports that my system is vulnerable to
> >> CVE-2017-5715. My CPU is Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz
> >>
> >> Is this normal?
> >>
> >> In the past all checks from spectre-meltdown-checker were green (my
> >> system was not vulnerable).
> >
> > Is your vulnerability  shown as follows?
> >
> > CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
> > * Mitigated according to the /sys interface:  YES  (Mitigation:
> > Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
> > * Mitigation 1
> >   * Kernel is compiled with IBRS support:  YES
> >     * IBRS enabled and active:  YES  (for firmware code only)
> >   * Kernel is compiled with IBPB support:  YES
> >     * IBPB enabled and active:  YES
> > * Mitigation 2
> >   * Kernel has branch predictor hardening (arm):  NO
> >   * Kernel compiled with retpoline option:  YES
> >   * Kernel supports RSB filling:  YES
> >> STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
> > needed to mitigate the vulnerability)
> >
>
> Yes, it seems the same but to avoid possible confusion/mistake I'm
> pasting the output below:
>
>
> CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
> * Mitigated according to the /sys interface:  YES  (Mitigation:
> Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
> * Mitigation 1
>   * Kernel is compiled with IBRS support:  YES
>     * IBRS enabled and active:  YES  (for firmware code only)
>   * Kernel is compiled with IBPB support:  YES
>     * IBPB enabled and active:  YES
> * Mitigation 2
>   * Kernel has branch predictor hardening (arm):  NO
>   * Kernel compiled with retpoline option:  YES
>   * Kernel supports RSB filling:  YES
> > STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
> needed to mitigate the vulnerability)
>

Please, take into consideration what is in the link and you can consult through
it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715

-- 
Cheers,
Leandro Cunha
Software Engineer and Debian Contributor⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#6025

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-23 17:20 +0100
Message-ID<E4bSh-3GLN-1@gated-at.bofh.it>
In reply to#6024

On 3/23/22 17:41, Leandro Cunha wrote:
> Hi,
> 
> On Wed, Mar 23, 2022 at 11:47 AM Georgi Naplatanov <gosho@oles.biz> wrote:
>>
>> On 3/23/22 15:58, piorunz wrote:
>>> On 12/03/2022 09:48, Georgi Naplatanov wrote:
>>>
>>>> spectre-meltdown-checker script reports that my system is vulnerable to
>>>> CVE-2017-5715. My CPU is Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz
>>>>
>>>> Is this normal?
>>>>
>>>> In the past all checks from spectre-meltdown-checker were green (my
>>>> system was not vulnerable).
>>>
>>> Is your vulnerability  shown as follows?
>>>
>>> CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
>>> * Mitigated according to the /sys interface:  YES  (Mitigation:
>>> Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
>>> * Mitigation 1
>>>   * Kernel is compiled with IBRS support:  YES
>>>     * IBRS enabled and active:  YES  (for firmware code only)
>>>   * Kernel is compiled with IBPB support:  YES
>>>     * IBPB enabled and active:  YES
>>> * Mitigation 2
>>>   * Kernel has branch predictor hardening (arm):  NO
>>>   * Kernel compiled with retpoline option:  YES
>>>   * Kernel supports RSB filling:  YES
>>>> STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
>>> needed to mitigate the vulnerability)
>>>
>>
>> Yes, it seems the same but to avoid possible confusion/mistake I'm
>> pasting the output below:
>>
>>
>> CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
>> * Mitigated according to the /sys interface:  YES  (Mitigation:
>> Retpolines, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
>> * Mitigation 1
>>   * Kernel is compiled with IBRS support:  YES
>>     * IBRS enabled and active:  YES  (for firmware code only)
>>   * Kernel is compiled with IBPB support:  YES
>>     * IBPB enabled and active:  YES
>> * Mitigation 2
>>   * Kernel has branch predictor hardening (arm):  NO
>>   * Kernel compiled with retpoline option:  YES
>>   * Kernel supports RSB filling:  YES
>>> STATUS:  VULNERABLE  (IBRS+IBPB or retpoline+IBPB+RSB filling, is
>> needed to mitigate the vulnerability)
>>
> 
> Please, take into consideration what is in the link and you can consult through
> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> 

Hey Leandro,

I'm using kernel 5.10.103-1

and intel-microcode 3.20210608.2

but spectre-meltdown-checker reports that my system is vulnerable.

Could you clarify what you meant?

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#6026

Frompiorunz <piorunz@gmx.com>
Date2022-03-23 17:40 +0100
Message-ID<E4cbD-3GRX-13@gated-at.bofh.it>
In reply to#6024
On 23/03/2022 15:41, Leandro Cunha wrote:

> Please, take into consideration what is in the link and you can consult through
> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715

Leandro,
I've been on this website before I posted with spectre-meltdown-checker
results. I have vulnerable status just like author of this topic. I am
on intel-microcode 3.20210608.2, and by the look of it, this bug
supposed to be fixed in:

"intel-microcode: Some microcode updates to partially adress
CVE-2017-5715 included in 3.20171215.1
Further updates in 3.20180312.1"

So my version of microcode is 3-4 years newer than that.

Is it microcode problem, or spectre-meltdown-checker displaying wrong
information, or something else entirely?


--
With kindest regards, Piotr.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#6027

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-23 18:40 +0100
Message-ID<E4d7H-3Hqk-1@gated-at.bofh.it>
In reply to#6026
On 3/23/22 18:35, piorunz wrote:
> On 23/03/2022 15:41, Leandro Cunha wrote:
> 
>> Please, take into consideration what is in the link and you can
>> consult through
>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> 
> Leandro,
> I've been on this website before I posted with spectre-meltdown-checker
> results. I have vulnerable status just like author of this topic. I am
> on intel-microcode 3.20210608.2, and by the look of it, this bug
> supposed to be fixed in:
> 
> "intel-microcode: Some microcode updates to partially adress
> CVE-2017-5715 included in 3.20171215.1
> Further updates in 3.20180312.1"
> 
> So my version of microcode is 3-4 years newer than that.
> 
> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> information, or something else entirely?
> 

I want to mention that on the same computer with kernel Debian 5.10.92-2

spectre-meltdown-checker

reports that the system is not vulnerable to CVE-2017-5715

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#6028

FromLeandro Cunha <leandrocunha016@gmail.com>
Date2022-03-23 21:50 +0100
Message-ID<E4g5z-3J9v-3@gated-at.bofh.it>
In reply to#6027
Hi,

On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>
> On 3/23/22 18:35, piorunz wrote:
> > On 23/03/2022 15:41, Leandro Cunha wrote:
> >
> >> Please, take into consideration what is in the link and you can
> >> consult through
> >> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> >
> > Leandro,
> > I've been on this website before I posted with spectre-meltdown-checker
> > results. I have vulnerable status just like author of this topic. I am
> > on intel-microcode 3.20210608.2, and by the look of it, this bug
> > supposed to be fixed in:
> >
> > "intel-microcode: Some microcode updates to partially adress
> > CVE-2017-5715 included in 3.20171215.1
> > Further updates in 3.20180312.1"
> >
> > So my version of microcode is 3-4 years newer than that.
> >
> > Is it microcode problem, or spectre-meltdown-checker displaying wrong
> > information, or something else entirely?
> >
>
> I want to mention that on the same computer with kernel Debian 5.10.92-2
>
> spectre-meltdown-checker
>
> reports that the system is not vulnerable to CVE-2017-5715
>
> Kind regards
> Georgi
>

This script is reporting an already patched CVE as vulnerable.
Just rule that out and see the link below for more information on DSA and DLA.
I hope it helped with that.
CVE-2017-5715: https://security-tracker.debian.org/tracker/CVE-2017-5715

-- 
Cheers,
Leandro Cunha
Software Engineer and Debian Contributor

[toc] | [prev] | [next] | [standalone]

#6029

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-23 22:20 +0100
Message-ID<E4gyB-3Jyj-5@gated-at.bofh.it>
In reply to#6028
On 3/23/22 22:43, Leandro Cunha wrote:
> Hi,
> 
> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>
>> On 3/23/22 18:35, piorunz wrote:
>>> On 23/03/2022 15:41, Leandro Cunha wrote:
>>>
>>>> Please, take into consideration what is in the link and you can
>>>> consult through
>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
>>>
>>> Leandro,
>>> I've been on this website before I posted with spectre-meltdown-checker
>>> results. I have vulnerable status just like author of this topic. I am
>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
>>> supposed to be fixed in:
>>>
>>> "intel-microcode: Some microcode updates to partially adress
>>> CVE-2017-5715 included in 3.20171215.1
>>> Further updates in 3.20180312.1"
>>>
>>> So my version of microcode is 3-4 years newer than that.
>>>
>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
>>> information, or something else entirely?
>>>
>>
>> I want to mention that on the same computer with kernel Debian 5.10.92-2
>>
>> spectre-meltdown-checker
>>
>> reports that the system is not vulnerable to CVE-2017-5715
>>
>> Kind regards
>> Georgi
>>
> 
> This script is reporting an already patched CVE as vulnerable.


Are you sure this behavior on 5.10.103-1 is not some kind of regression?
What is the evidence that vulnerability is still fixed?


Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#6030

FromSalvatore Bonaccorso <carnil@debian.org>
Date2022-03-23 22:40 +0100
Message-ID<E4gRX-3JEo-5@gated-at.bofh.it>
In reply to#6029
Hi,

On Wed, Mar 23, 2022 at 11:17:41PM +0200, Georgi Naplatanov wrote:
> On 3/23/22 22:43, Leandro Cunha wrote:
> > Hi,
> > 
> > On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>
> >> On 3/23/22 18:35, piorunz wrote:
> >>> On 23/03/2022 15:41, Leandro Cunha wrote:
> >>>
> >>>> Please, take into consideration what is in the link and you can
> >>>> consult through
> >>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> >>>
> >>> Leandro,
> >>> I've been on this website before I posted with spectre-meltdown-checker
> >>> results. I have vulnerable status just like author of this topic. I am
> >>> on intel-microcode 3.20210608.2, and by the look of it, this bug
> >>> supposed to be fixed in:
> >>>
> >>> "intel-microcode: Some microcode updates to partially adress
> >>> CVE-2017-5715 included in 3.20171215.1
> >>> Further updates in 3.20180312.1"
> >>>
> >>> So my version of microcode is 3-4 years newer than that.
> >>>
> >>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> >>> information, or something else entirely?
> >>>
> >>
> >> I want to mention that on the same computer with kernel Debian 5.10.92-2
> >>
> >> spectre-meltdown-checker
> >>
> >> reports that the system is not vulnerable to CVE-2017-5715
> >>
> >> Kind regards
> >> Georgi
> >>
> > 
> > This script is reporting an already patched CVE as vulnerable.
> 
> 
> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
> What is the evidence that vulnerability is still fixed?

See: https://github.com/speed47/spectre-meltdown-checker/issues/420

(Background of this is
https://www.vusec.net/projects/bhi-spectre-bhb/).

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#6031

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-24 09:00 +0100
Message-ID<E4qxX-3PFz-3@gated-at.bofh.it>
In reply to#6030
On 3/23/22 23:36, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Wed, Mar 23, 2022 at 11:17:41PM +0200, Georgi Naplatanov wrote:
>> On 3/23/22 22:43, Leandro Cunha wrote:
>>> Hi,
>>>
>>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>>>
>>>> On 3/23/22 18:35, piorunz wrote:
>>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
>>>>>
>>>>>> Please, take into consideration what is in the link and you can
>>>>>> consult through
>>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
>>>>>
>>>>> Leandro,
>>>>> I've been on this website before I posted with spectre-meltdown-checker
>>>>> results. I have vulnerable status just like author of this topic. I am
>>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
>>>>> supposed to be fixed in:
>>>>>
>>>>> "intel-microcode: Some microcode updates to partially adress
>>>>> CVE-2017-5715 included in 3.20171215.1
>>>>> Further updates in 3.20180312.1"
>>>>>
>>>>> So my version of microcode is 3-4 years newer than that.
>>>>>
>>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
>>>>> information, or something else entirely?
>>>>>
>>>>
>>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
>>>>
>>>> spectre-meltdown-checker
>>>>
>>>> reports that the system is not vulnerable to CVE-2017-5715
>>>>
>>>> Kind regards
>>>> Georgi
>>>>
>>>
>>> This script is reporting an already patched CVE as vulnerable.
>>
>>
>> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
>> What is the evidence that vulnerability is still fixed?
> 
> See: https://github.com/speed47/spectre-meltdown-checker/issues/420
> 
> (Background of this is
> https://www.vusec.net/projects/bhi-spectre-bhb/).
> 

Thanks you, Salvatore,

for the links and clarification.

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#6032

FromLeandro Cunha <leandrocunha016@gmail.com>
Date2022-03-25 02:30 +0100
Message-ID<E4GW5-3Zzn-5@gated-at.bofh.it>
In reply to#6029
Hi,

On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>
> On 3/23/22 22:43, Leandro Cunha wrote:
> > Hi,
> >
> > On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>
> >> On 3/23/22 18:35, piorunz wrote:
> >>> On 23/03/2022 15:41, Leandro Cunha wrote:
> >>>
> >>>> Please, take into consideration what is in the link and you can
> >>>> consult through
> >>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> >>>
> >>> Leandro,
> >>> I've been on this website before I posted with spectre-meltdown-checker
> >>> results. I have vulnerable status just like author of this topic. I am
> >>> on intel-microcode 3.20210608.2, and by the look of it, this bug
> >>> supposed to be fixed in:
> >>>
> >>> "intel-microcode: Some microcode updates to partially adress
> >>> CVE-2017-5715 included in 3.20171215.1
> >>> Further updates in 3.20180312.1"
> >>>
> >>> So my version of microcode is 3-4 years newer than that.
> >>>
> >>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> >>> information, or something else entirely?
> >>>
> >>
> >> I want to mention that on the same computer with kernel Debian 5.10.92-2
> >>
> >> spectre-meltdown-checker
> >>
> >> reports that the system is not vulnerable to CVE-2017-5715
> >>
> >> Kind regards
> >> Georgi
> >>
> >
> > This script is reporting an already patched CVE as vulnerable.
>
>
> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
> What is the evidence that vulnerability is still fixed?
>
>
> Kind regards
> Georgi
>

When replying to your email I was aware of the script issue that was reporting
several already resolved CVEs as unresolved. As Salvatore sent the issue link.
But it seems to me that this problem was solved 7 days ago, it would be
interesting if there was an update or a backport to stable.

-- 
Cheers,
Leandro Cunha
Software Engineer and Debian Contributor

[toc] | [prev] | [next] | [standalone]

#6033

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-25 08:20 +0100
Message-ID<E4MoN-4312-3@gated-at.bofh.it>
In reply to#6032
On 3/25/22 03:24, Leandro Cunha wrote:
> Hi,
> 
> On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>
>> On 3/23/22 22:43, Leandro Cunha wrote:
>>> Hi,
>>>
>>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>>>
>>>> On 3/23/22 18:35, piorunz wrote:
>>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
>>>>>
>>>>>> Please, take into consideration what is in the link and you can
>>>>>> consult through
>>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
>>>>>
>>>>> Leandro,
>>>>> I've been on this website before I posted with spectre-meltdown-checker
>>>>> results. I have vulnerable status just like author of this topic. I am
>>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
>>>>> supposed to be fixed in:
>>>>>
>>>>> "intel-microcode: Some microcode updates to partially adress
>>>>> CVE-2017-5715 included in 3.20171215.1
>>>>> Further updates in 3.20180312.1"
>>>>>
>>>>> So my version of microcode is 3-4 years newer than that.
>>>>>
>>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
>>>>> information, or something else entirely?
>>>>>
>>>>
>>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
>>>>
>>>> spectre-meltdown-checker
>>>>
>>>> reports that the system is not vulnerable to CVE-2017-5715
>>>>
>>>> Kind regards
>>>> Georgi
>>>>
>>>
>>> This script is reporting an already patched CVE as vulnerable.
>>
>>
>> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
>> What is the evidence that vulnerability is still fixed?
>>
>>
>> Kind regards
>> Georgi
>>
> 
> When replying to your email I was aware of the script issue that was reporting
> several already resolved CVEs as unresolved. As Salvatore sent the issue link.
> But it seems to me that this problem was solved 7 days ago, it would be
> interesting if there was an update or a backport to stable.
> 

Hi Leandro,

I also think that an update would be nice.

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#6034

FromLeandro Cunha <leandrocunha016@gmail.com>
Date2022-03-25 18:30 +0100
Message-ID<E4VV7-48LP-3@gated-at.bofh.it>
In reply to#6033

[Multipart message — attachments visible in raw view] — view raw

Hi,

On Fri, Mar 25, 2022 at 4:19 AM Georgi Naplatanov <gosho@oles.biz> wrote:
>
> On 3/25/22 03:24, Leandro Cunha wrote:
> > Hi,
> >
> > On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>
> >> On 3/23/22 22:43, Leandro Cunha wrote:
> >>> Hi,
> >>>
> >>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>>>
> >>>> On 3/23/22 18:35, piorunz wrote:
> >>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
> >>>>>
> >>>>>> Please, take into consideration what is in the link and you can
> >>>>>> consult through
> >>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> >>>>>
> >>>>> Leandro,
> >>>>> I've been on this website before I posted with spectre-meltdown-checker
> >>>>> results. I have vulnerable status just like author of this topic. I am
> >>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
> >>>>> supposed to be fixed in:
> >>>>>
> >>>>> "intel-microcode: Some microcode updates to partially adress
> >>>>> CVE-2017-5715 included in 3.20171215.1
> >>>>> Further updates in 3.20180312.1"
> >>>>>
> >>>>> So my version of microcode is 3-4 years newer than that.
> >>>>>
> >>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> >>>>> information, or something else entirely?
> >>>>>
> >>>>
> >>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
> >>>>
> >>>> spectre-meltdown-checker
> >>>>
> >>>> reports that the system is not vulnerable to CVE-2017-5715
> >>>>
> >>>> Kind regards
> >>>> Georgi
> >>>>
> >>>
> >>> This script is reporting an already patched CVE as vulnerable.
> >>
> >>
> >> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
> >> What is the evidence that vulnerability is still fixed?
> >>
> >>
> >> Kind regards
> >> Georgi
> >>
> >
> > When replying to your email I was aware of the script issue that was reporting
> > several already resolved CVEs as unresolved. As Salvatore sent the issue link.
> > But it seems to me that this problem was solved 7 days ago, it would be
> > interesting if there was an update or a backport to stable.
> >
>
> Hi Leandro,
>
> I also think that an update would be nice.
>
> Kind regards
> Georgi
>

I applied a patch from upstream and repackaged it from unstable.
And this CVE is displayed as resolved.

-- 
Cheers,
Leandro Cunha
Software Engineer and Debian Contributor

[toc] | [prev] | [next] | [standalone]

#6035

FromGeorgi Naplatanov <gosho@oles.biz>
Date2022-03-25 18:40 +0100
Message-ID<E4W4N-48OX-1@gated-at.bofh.it>
In reply to#6034
On 3/25/22 19:19, Leandro Cunha wrote:
> Hi,
> 
> On Fri, Mar 25, 2022 at 4:19 AM Georgi Naplatanov <gosho@oles.biz> wrote:
>>
>> On 3/25/22 03:24, Leandro Cunha wrote:
>>> Hi,
>>>
>>> On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>>>
>>>> On 3/23/22 22:43, Leandro Cunha wrote:
>>>>> Hi,
>>>>>
>>>>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>>>>>
>>>>>> On 3/23/22 18:35, piorunz wrote:
>>>>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
>>>>>>>
>>>>>>>> Please, take into consideration what is in the link and you can
>>>>>>>> consult through
>>>>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
>>>>>>>
>>>>>>> Leandro,
>>>>>>> I've been on this website before I posted with spectre-meltdown-checker
>>>>>>> results. I have vulnerable status just like author of this topic. I am
>>>>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
>>>>>>> supposed to be fixed in:
>>>>>>>
>>>>>>> "intel-microcode: Some microcode updates to partially adress
>>>>>>> CVE-2017-5715 included in 3.20171215.1
>>>>>>> Further updates in 3.20180312.1"
>>>>>>>
>>>>>>> So my version of microcode is 3-4 years newer than that.
>>>>>>>
>>>>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
>>>>>>> information, or something else entirely?
>>>>>>>
>>>>>>
>>>>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
>>>>>>
>>>>>> spectre-meltdown-checker
>>>>>>
>>>>>> reports that the system is not vulnerable to CVE-2017-5715
>>>>>>
>>>>>> Kind regards
>>>>>> Georgi
>>>>>>
>>>>>
>>>>> This script is reporting an already patched CVE as vulnerable.
>>>>
>>>>
>>>> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
>>>> What is the evidence that vulnerability is still fixed?
>>>>
>>>>
>>>> Kind regards
>>>> Georgi
>>>>
>>>
>>> When replying to your email I was aware of the script issue that was reporting
>>> several already resolved CVEs as unresolved. As Salvatore sent the issue link.
>>> But it seems to me that this problem was solved 7 days ago, it would be
>>> interesting if there was an update or a backport to stable.
>>>
>>
>> Hi Leandro,
>>
>> I also think that an update would be nice.
>>
>> Kind regards
>> Georgi
>>
> 
> I applied a patch from upstream and repackaged it from unstable.
> And this CVE is displayed as resolved.
> 

Thank you, Leandro!

I guess that the patch will appear in Debian stable (11.4), right?

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#6036

FromLeandro Cunha <leandrocunha016@gmail.com>
Date2022-03-25 19:00 +0100
Message-ID<E4Wo9-48Vq-1@gated-at.bofh.it>
In reply to#6035

[Multipart message — attachments visible in raw view] — view raw

Hi,

On Fri, Mar 25, 2022 at 2:38 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>
> On 3/25/22 19:19, Leandro Cunha wrote:
> > Hi,
> >
> > On Fri, Mar 25, 2022 at 4:19 AM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>
> >> On 3/25/22 03:24, Leandro Cunha wrote:
> >>> Hi,
> >>>
> >>> On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>>>
> >>>> On 3/23/22 22:43, Leandro Cunha wrote:
> >>>>> Hi,
> >>>>>
> >>>>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>>>>>
> >>>>>> On 3/23/22 18:35, piorunz wrote:
> >>>>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
> >>>>>>>
> >>>>>>>> Please, take into consideration what is in the link and you can
> >>>>>>>> consult through
> >>>>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> >>>>>>>
> >>>>>>> Leandro,
> >>>>>>> I've been on this website before I posted with spectre-meltdown-checker
> >>>>>>> results. I have vulnerable status just like author of this topic. I am
> >>>>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
> >>>>>>> supposed to be fixed in:
> >>>>>>>
> >>>>>>> "intel-microcode: Some microcode updates to partially adress
> >>>>>>> CVE-2017-5715 included in 3.20171215.1
> >>>>>>> Further updates in 3.20180312.1"
> >>>>>>>
> >>>>>>> So my version of microcode is 3-4 years newer than that.
> >>>>>>>
> >>>>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> >>>>>>> information, or something else entirely?
> >>>>>>>
> >>>>>>
> >>>>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
> >>>>>>
> >>>>>> spectre-meltdown-checker
> >>>>>>
> >>>>>> reports that the system is not vulnerable to CVE-2017-5715
> >>>>>>
> >>>>>> Kind regards
> >>>>>> Georgi
> >>>>>>
> >>>>>
> >>>>> This script is reporting an already patched CVE as vulnerable.
> >>>>
> >>>>
> >>>> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
> >>>> What is the evidence that vulnerability is still fixed?
> >>>>
> >>>>
> >>>> Kind regards
> >>>> Georgi
> >>>>
> >>>
> >>> When replying to your email I was aware of the script issue that was reporting
> >>> several already resolved CVEs as unresolved. As Salvatore sent the issue link.
> >>> But it seems to me that this problem was solved 7 days ago, it would be
> >>> interesting if there was an update or a backport to stable.
> >>>
> >>
> >> Hi Leandro,
> >>
> >> I also think that an update would be nice.
> >>
> >> Kind regards
> >> Georgi
> >>
> >
> > I applied a patch from upstream and repackaged it from unstable.
> > And this CVE is displayed as resolved.
> >
>
> Thank you, Leandro!
>
> I guess that the patch will appear in Debian stable (11.4), right?
>
> Kind regards
> Georgi
>

This update must comply with the link below. I only did a test here.
It is up to the maintainers to analyze this.
I already see it as something necessary to be corrected.
[1] https://www.debian.org/doc/manuals/developers-reference/pkgs.html#special-case-uploads-to-the-stable-and-oldstable-distributions

-- 
Cheers,
Leandro Cunha
Software Engineer and Debian Contributor

[toc] | [prev] | [next] | [standalone]

#6039

FromSalvatore Bonaccorso <carnil@debian.org>
Date2022-03-30 07:10 +0200
Message-ID<E6yKJ-59RQ-1@gated-at.bofh.it>
In reply to#6036
Hi all,

On Fri, Mar 25, 2022 at 02:57:12PM -0300, Leandro Cunha wrote:
> Hi,
> 
> On Fri, Mar 25, 2022 at 2:38 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >
> > On 3/25/22 19:19, Leandro Cunha wrote:
> > > Hi,
> > >
> > > On Fri, Mar 25, 2022 at 4:19 AM Georgi Naplatanov <gosho@oles.biz> wrote:
> > >>
> > >> On 3/25/22 03:24, Leandro Cunha wrote:
> > >>> Hi,
> > >>>
> > >>> On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> > >>>>
> > >>>> On 3/23/22 22:43, Leandro Cunha wrote:
> > >>>>> Hi,
> > >>>>>
> > >>>>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> > >>>>>>
> > >>>>>> On 3/23/22 18:35, piorunz wrote:
> > >>>>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
> > >>>>>>>
> > >>>>>>>> Please, take into consideration what is in the link and you can
> > >>>>>>>> consult through
> > >>>>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> > >>>>>>>
> > >>>>>>> Leandro,
> > >>>>>>> I've been on this website before I posted with spectre-meltdown-checker
> > >>>>>>> results. I have vulnerable status just like author of this topic. I am
> > >>>>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
> > >>>>>>> supposed to be fixed in:
> > >>>>>>>
> > >>>>>>> "intel-microcode: Some microcode updates to partially adress
> > >>>>>>> CVE-2017-5715 included in 3.20171215.1
> > >>>>>>> Further updates in 3.20180312.1"
> > >>>>>>>
> > >>>>>>> So my version of microcode is 3-4 years newer than that.
> > >>>>>>>
> > >>>>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> > >>>>>>> information, or something else entirely?
> > >>>>>>>
> > >>>>>>
> > >>>>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
> > >>>>>>
> > >>>>>> spectre-meltdown-checker
> > >>>>>>
> > >>>>>> reports that the system is not vulnerable to CVE-2017-5715
> > >>>>>>
> > >>>>>> Kind regards
> > >>>>>> Georgi
> > >>>>>>
> > >>>>>
> > >>>>> This script is reporting an already patched CVE as vulnerable.
> > >>>>
> > >>>>
> > >>>> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
> > >>>> What is the evidence that vulnerability is still fixed?
> > >>>>
> > >>>>
> > >>>> Kind regards
> > >>>> Georgi
> > >>>>
> > >>>
> > >>> When replying to your email I was aware of the script issue that was reporting
> > >>> several already resolved CVEs as unresolved. As Salvatore sent the issue link.
> > >>> But it seems to me that this problem was solved 7 days ago, it would be
> > >>> interesting if there was an update or a backport to stable.
> > >>>
> > >>
> > >> Hi Leandro,
> > >>
> > >> I also think that an update would be nice.
> > >>
> > >> Kind regards
> > >> Georgi
> > >>
> > >
> > > I applied a patch from upstream and repackaged it from unstable.
> > > And this CVE is displayed as resolved.
> > >
> >
> > Thank you, Leandro!
> >
> > I guess that the patch will appear in Debian stable (11.4), right?
> >
> > Kind regards
> > Georgi
> >
> 
> This update must comply with the link below. I only did a test here.
> It is up to the maintainers to analyze this.
> I already see it as something necessary to be corrected.
> [1] https://www.debian.org/doc/manuals/developers-reference/pkgs.html#special-case-uploads-to-the-stable-and-oldstable-distributions

I would suggest to ask the maintainers if they can prepare an update
to be included in the next point release. This can happen directly or
to the bug #1008181.

Sylvestre and Holger, would you have time to include the bugfix as
well in the future bullseye point release?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#6040

FromSylvestre Ledru <sylvestre@debian.org>
Date2022-03-30 09:50 +0200
Message-ID<E6B5U-5b8V-5@gated-at.bofh.it>
In reply to#6039
Le 30/03/2022 à 07:07, Salvatore Bonaccorso a écrit :
> Sylvestre and Holger, would you have time to include the bugfix as
> well in the future bullseye point release?
Sure, should be easy.
Is there a timeline?
Cheers,
Sylvestre

[toc] | [prev] | [next] | [standalone]

#6041

FromHolger Levsen <holger@layer-acht.org>
Date2022-03-30 11:40 +0200
Message-ID<E6CY1-5cgQ-9@gated-at.bofh.it>
In reply to#6040

[Multipart message — attachments visible in raw view] — view raw

On Wed, Mar 30, 2022 at 09:36:58AM +0200, Sylvestre Ledru wrote:
> Le 30/03/2022 à 07:07, Salvatore Bonaccorso a écrit :
> > Sylvestre and Holger, would you have time to include the bugfix as
> > well in the future bullseye point release?
> Sure, should be easy.
> Is there a timeline?

as the last point release was last weekend the next one will probably
happen in around two months.

that said, one can file an SRM bug now and do the upload now as well too. :)


-- 
cheers,
	Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Nach wieviel Einzelfällen wird ein Einzelfall zum Normalfall?
(Jan Böhmermann)

[toc] | [prev] | [next] | [standalone]

#6042

FromSalvatore Bonaccorso <carnil@debian.org>
Date2022-04-06 06:40 +0200
Message-ID<E95Cx-6NHG-1@gated-at.bofh.it>
In reply to#6041
Hi

On Wed, Mar 30, 2022 at 09:31:32AM +0000, Holger Levsen wrote:
> On Wed, Mar 30, 2022 at 09:36:58AM +0200, Sylvestre Ledru wrote:
> > Le 30/03/2022 à 07:07, Salvatore Bonaccorso a écrit :
> > > Sylvestre and Holger, would you have time to include the bugfix as
> > > well in the future bullseye point release?
> > Sure, should be easy.
> > Is there a timeline?
> 
> as the last point release was last weekend the next one will probably
> happen in around two months.
> 
> that said, one can file an SRM bug now and do the upload now as well too. :)

Right. And additionally in cases where there is some need (maybe not
here), but like tzdata updates or clamav, updates can go earlier as
well via a SUA and stable-updates.

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web