Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6035

Re: CVE-2017-5715

Show all headers | View raw

On 3/25/22 19:19, Leandro Cunha wrote:
> Hi,
> 
> On Fri, Mar 25, 2022 at 4:19 AM Georgi Naplatanov <gosho@oles.biz> wrote:
>>
>> On 3/25/22 03:24, Leandro Cunha wrote:
>>> Hi,
>>>
>>> On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>>>
>>>> On 3/23/22 22:43, Leandro Cunha wrote:
>>>>> Hi,
>>>>>
>>>>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
>>>>>>
>>>>>> On 3/23/22 18:35, piorunz wrote:
>>>>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
>>>>>>>
>>>>>>>> Please, take into consideration what is in the link and you can
>>>>>>>> consult through
>>>>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
>>>>>>>
>>>>>>> Leandro,
>>>>>>> I've been on this website before I posted with spectre-meltdown-checker
>>>>>>> results. I have vulnerable status just like author of this topic. I am
>>>>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
>>>>>>> supposed to be fixed in:
>>>>>>>
>>>>>>> "intel-microcode: Some microcode updates to partially adress
>>>>>>> CVE-2017-5715 included in 3.20171215.1
>>>>>>> Further updates in 3.20180312.1"
>>>>>>>
>>>>>>> So my version of microcode is 3-4 years newer than that.
>>>>>>>
>>>>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
>>>>>>> information, or something else entirely?
>>>>>>>
>>>>>>
>>>>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
>>>>>>
>>>>>> spectre-meltdown-checker
>>>>>>
>>>>>> reports that the system is not vulnerable to CVE-2017-5715
>>>>>>
>>>>>> Kind regards
>>>>>> Georgi
>>>>>>
>>>>>
>>>>> This script is reporting an already patched CVE as vulnerable.
>>>>
>>>>
>>>> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
>>>> What is the evidence that vulnerability is still fixed?
>>>>
>>>>
>>>> Kind regards
>>>> Georgi
>>>>
>>>
>>> When replying to your email I was aware of the script issue that was reporting
>>> several already resolved CVEs as unresolved. As Salvatore sent the issue link.
>>> But it seems to me that this problem was solved 7 days ago, it would be
>>> interesting if there was an update or a backport to stable.
>>>
>>
>> Hi Leandro,
>>
>> I also think that an update would be nice.
>>
>> Kind regards
>> Georgi
>>
> 
> I applied a patch from upstream and repackaged it from unstable.
> And this CVE is displayed as resolved.
> 

Thank you, Leandro!

I guess that the patch will appear in Debian stable (11.4), right?

Kind regards
Georgi

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-12 10:50 +0100
  Re: CVE-2017-5715 piorunz <piorunz@gmx.com> - 2022-03-23 15:00 +0100
    Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 15:50 +0100
      Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-23 16:50 +0100
        Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 17:20 +0100
        Re: CVE-2017-5715 piorunz <piorunz@gmx.com> - 2022-03-23 17:40 +0100
          Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 18:40 +0100
            Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-23 21:50 +0100
              Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 22:20 +0100
                Re: CVE-2017-5715 Salvatore Bonaccorso <carnil@debian.org> - 2022-03-23 22:40 +0100
                Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-24 09:00 +0100
                Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-25 02:30 +0100
                Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-25 08:20 +0100
                Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-25 18:30 +0100
                Re: CVE-2017-5715 Georgi Naplatanov <gosho@oles.biz> - 2022-03-25 18:40 +0100
                Re: CVE-2017-5715 Leandro Cunha <leandrocunha016@gmail.com> - 2022-03-25 19:00 +0100
                Re: CVE-2017-5715 Salvatore Bonaccorso <carnil@debian.org> - 2022-03-30 07:10 +0200
                Re: CVE-2017-5715 Sylvestre Ledru <sylvestre@debian.org> - 2022-03-30 09:50 +0200
                Re: CVE-2017-5715 Holger Levsen <holger@layer-acht.org> - 2022-03-30 11:40 +0200
                Re: CVE-2017-5715 Salvatore Bonaccorso <carnil@debian.org> - 2022-04-06 06:40 +0200

csiph-web