intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian 10?

From	Christoph Pflügler <christoph@pfluegler.net>
Newsgroups	linux.debian.security
Subject	intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian 10?
Date	2021-01-08 21:30 +0100
Message-ID	<Bv6yt-6PR-19@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Installing package intel-microcode in Debian 10 (Buster) mitigates most 
vulnerabilities as per spectre-meltdown-checker. However, CVE-2018-3640 
and CVE-2018-3615 are still displayed as unmitigated after reboot, with 
spectre-meltdown-checker --explain (executed as su) pointing to missing 
microcode upgrades.

According to the Debian package description of intel-microcode, the two 
vulnerabilities are fixed in the current version of the package.

This occurs in exactly the same way on two different machines, one with 
an i5-3320M CPU and another one with an E3-1235L v5.

If I remember correctly, I was all green as per spectre-meltdown-checker 
in Debian 9 (Stretch).

Does anybody have an explanation and/or fix for this issue?


Thanks and best regards,

Christoph

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian 10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-08 21:30 +0100
  Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-08 22:50 +0100
    Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-08 23:50 +0100
      Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-09 15:50 +0100
        Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? James Wallen <jpwallen@comcast.net> - 2021-01-09 21:00 +0100
          Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Giacomo Catenazzi <cate@debian.org> - 2021-01-12 17:40 +0100
            Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-13 17:20 +0100
              Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-13 22:00 +0100
                Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-14 00:00 +0100
                Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on Debian  10? Christoph Pflügler <christoph@pfluegler.net> - 2021-01-14 18:30 +0100
  Re: intel-microcode not fixing CVE-2018-3640, CVE-2018-3615 on  Debian 10? Michael Stone <mstone@debian.org> - 2021-01-08 22:50 +0100

csiph-web