Groups > linux.debian.user > #192657 > unrolled thread

Is Debian Linux protected against the Meltdown and Spectre security flaws?

Started by	Turritopsis Dohrnii Teo En Ming <tdteoenming@gmail.com>
First post	2018-02-19 14:20 +0100
Last post	2018-02-27 17:10 +0100
Articles	9 on this page of 29 — 11 participants

Back to article view | Back to linux.debian.user

Page 2 of 2 — ← Prev page 1 [2]

#192775 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Andy Smith <andy@strugglers.net>
Date	2018-02-20 16:20 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vlhS1-2gf-5@gated-at.bofh.it>
In reply to	#192753

Hi Stephen,

On Tue, Feb 20, 2018 at 10:09:52AM +0100, Stephan Seitz wrote:
> On Di, Feb 20, 2018 at 05:09:12 +0000, Andy Smith wrote:
> >CVE-2017-5753 is Spectre v1. There is no fix for Spectre v1 anywhere
> >yet, not even in Linux upstream.
> 
> Are you sure?

[…]

> >STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)
> 
> Kernel is Linux 4.15.4 #1 SMP Sat Feb 17 23:19:56 CET 2018 x86_64, compiled
> myself with gcc 7.3 from testing.

Ah, I think you might be right that the known exploit for Spectre v1
is fixed now.

The commit message¹ speaks of infrastructure for future mitigations,
I think because further exploits are expected to be thought up for
this, but when they do I imagine they will have their own CVE
numbers (and names :)).

Cheers,
Andy

¹ https://lkml.org/lkml/2018/1/20/152

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#192669 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Brad Rogers <brad@fineby.me.uk>
Date	2018-02-19 15:20 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vkUsq-433-15@gated-at.bofh.it>
In reply to	#192657

[Multipart message — attachments visible in raw view] — view raw

On Mon, 19 Feb 2018 21:13:42 +0800
Turritopsis Dohrnii Teo En Ming <tdteoenming@gmail.com> wrote:

Hello Turritopsis,

>What are the patches that I can download and install to be protected
>against the Meltdown and Spectre security vulnerabilities?

First, you might want to check whether your system is vulnerable.

Mr. Meowski, on a local LUG ML pointed out this;

If anyone wants to check their (linux) system specifically for the
current state of spectre+meltdown mitigation on a given machine then
have a look here:

https://github.com/speed47/spectre-meltdown-checker

Really simple instructions are as follows:

cd [to some directory where you want to keep this]

wget meltdown.ovh -O spectre-meltdown-checker.sh
cat spectre-meltdown-checker.sh
chmod +x spectre-meltdown-checker.sh
sudo ./spectre-meltdown-checker.sh

-- 
 Regards  _
         / )           "The blindingly obvious is
        / _)rad        never immediately apparent"
You're not so safe in the safety of your room
Nasty - The Damned

[toc] | [prev] | [next] | [standalone]

#192706 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Michael Lange <klappnase@freenet.de>
Date	2018-02-19 19:40 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vkYw2-6Dg-25@gated-at.bofh.it>
In reply to	#192669

Hi,

On Mon, 19 Feb 2018 14:10:14 +0000
Brad Rogers <brad@fineby.me.uk> wrote:

(...)
> If anyone wants to check their (linux) system specifically for the
> current state of spectre+meltdown mitigation on a given machine then
> have a look here:
> 
> https://github.com/speed47/spectre-meltdown-checker
> 
> Really simple instructions are as follows:
(...)

With debian it is even simpler:

apt-get install spectre-meltdown-checker
sudo spectre-meltdown-checker

Regards

Michael


.-.. .. ...- .   .-.. --- -. --.   .- -. -..   .--. .-. --- ... .--. . .-.

The sight of death frightens them [Earthers].
		-- Kras the Klingon, "Friday's Child", stardate 3497.2

[toc] | [prev] | [next] | [standalone]

#192712 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Brad Rogers <brad@fineby.me.uk>
Date	2018-02-19 20:20 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vkZ8K-75Q-9@gated-at.bofh.it>
In reply to	#192706

[Multipart message — attachments visible in raw view] — view raw

On Mon, 19 Feb 2018 19:31:46 +0100
Michael Lange <klappnase@freenet.de> wrote:

Hello Michael,

>With debian it is even simpler:
>apt-get install spectre-meltdown-checker
>sudo spectre-meltdown-checker

I hadn't realised it was in the repos.

-- 
 Regards  _
         / )           "The blindingly obvious is
        / _)rad        never immediately apparent"
Hey there, Mr Average, you don't exist, you never did
Persons Unknown - Poison Girls

[toc] | [prev] | [next] | [standalone]

#192721

From	Gene Heskett <gheskett@shentel.net>
Date	2018-02-19 21:30 +0100
Message-ID	<vl0eu-7K6-7@gated-at.bofh.it>
In reply to	#192706

On Monday 19 February 2018 13:31:46 Michael Lange wrote:

> Hi,
>
> On Mon, 19 Feb 2018 14:10:14 +0000
> Brad Rogers <brad@fineby.me.uk> wrote:
>
> (...)
>
> > If anyone wants to check their (linux) system specifically for the
> > current state of spectre+meltdown mitigation on a given machine then
> > have a look here:
> >
> > https://github.com/speed47/spectre-meltdown-checker
> >
> > Really simple instructions are as follows:
>
> (...)
>
> With debian it is even simpler:
>
> apt-get install spectre-meltdown-checker
not available for stretch on arm64, why?

> sudo spectre-meltdown-checker
>
> Regards
>
> Michael
>
>
> .-.. .. ...- .   .-.. --- -. --.   .- -. -..   .--. .-. --- ... .--. .
> .-.
>
> The sight of death frightens them [Earthers].
> 		-- Kras the Klingon, "Friday's Child", stardate 3497.2



-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#192725 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Greg Wooledge <wooledg@eeg.ccf.org>
Date	2018-02-19 21:50 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vl0xQ-7Qo-11@gated-at.bofh.it>
In reply to	#192721

On Mon, Feb 19, 2018 at 03:27:36PM -0500, Gene Heskett wrote:
> On Monday 19 February 2018 13:31:46 Michael Lange wrote:
> > apt-get install spectre-meltdown-checker
> not available for stretch on arm64, why?

Because this package did not exist at the time stretch was frozen.
Nor even at the time stretch was released.

[toc] | [prev] | [next] | [standalone]

#192733 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Michael Lange <klappnase@freenet.de>
Date	2018-02-20 00:20 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vl2T0-13S-17@gated-at.bofh.it>
In reply to	#192725

On Mon, 19 Feb 2018 15:43:16 -0500
Greg Wooledge <wooledg@eeg.ccf.org> wrote:

> On Mon, Feb 19, 2018 at 03:27:36PM -0500, Gene Heskett wrote:
> > On Monday 19 February 2018 13:31:46 Michael Lange wrote:
> > > apt-get install spectre-meltdown-checker
> > not available for stretch on arm64, why?
> 
> Because this package did not exist at the time stretch was frozen.
> Nor even at the time stretch was released.
> 
> 

Yes, with Stretch you need the backports.

Regards

Michael

.-.. .. ...- .   .-.. --- -. --.   .- -. -..   .--. .-. --- ... .--. . .-.

You!  What PLANET is this!
		-- McCoy, "The City on the Edge of Forever", stardate
3134.0

[toc] | [prev] | [next] | [standalone]

#192734

From	Gene Heskett <gheskett@shentel.net>
Date	2018-02-20 00:30 +0100
Message-ID	<vl32F-16R-5@gated-at.bofh.it>
In reply to	#192725

On Monday 19 February 2018 15:43:16 Greg Wooledge wrote:

> On Mon, Feb 19, 2018 at 03:27:36PM -0500, Gene Heskett wrote:
> > On Monday 19 February 2018 13:31:46 Michael Lange wrote:
> > > apt-get install spectre-meltdown-checker
> >
> > not available for stretch on arm64, why?
>
> Because this package did not exist at the time stretch was frozen.
> Nor even at the time stretch was released.

Humph!

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#193164 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

From	Vincent Lefevre <vincent@vinc17.net>
Date	2018-02-27 17:10 +0100
Subject	Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?
Message-ID	<vnPZg-7g5-21@gated-at.bofh.it>
In reply to	#192669

On 2018-02-19 14:10:14 +0000, Brad Rogers wrote:
> If anyone wants to check their (linux) system specifically for the
> current state of spectre+meltdown mitigation on a given machine then
> have a look here:
> 
> https://github.com/speed47/spectre-meltdown-checker
> 
> Really simple instructions are as follows:
> 
> cd [to some directory where you want to keep this]
> 
> wget meltdown.ovh -O spectre-meltdown-checker.sh

This is insecure. You should use the https URL directly, without
the redirection. Or the Debian package.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

csiph-web

Is Debian Linux protected against the Meltdown and Spectre security flaws?

Contents

#192775 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

#192669 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

#192706 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

#192712 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

#192721

#192725 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

#192733 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

#192734

#193164 — Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?