Ubuntu
linux package

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'

Bug #1746058 reported by Cristian Aravena Romero on 2018-01-29

This bug report is a duplicate of: Bug #1743812: CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'. Edit Remove

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	linux (Ubuntu)	Triaged	High	Unassigned

Bug Description

Hello,

I'm checking:
https://www.tecmint.com/check-and-patch-meltdown-cpu-vulnerability-in-linux/

:~/spectre-meltdown-checker$ sudo ./spectre-meltdown-checker.sh
[...]

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support: YES
  * Currently enabled features
    * IBRS enabled for Kernel space: NO
    * IBRS enabled for User space: NO
    * IBPB enabled: NO
* Mitigation 2
  * Kernel compiled with retpoline option: NO
  * Kernel compiled with a retpoline-aware compiler: NO
  * Retpoline enabled: NO
> STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability)

[...]

Regards,
--
Cristian

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: linux-image-4.13.0-32-generic 4.13.0-32.35
ProcVersionSignature: Ubuntu 4.13.0-32.35-generic 4.13.13
Uname: Linux 4.13.0-32-generic x86_64
ApportVersion: 2.20.8-0ubuntu6
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: gdm 1296 F.... pulseaudio
caravena 1698 F.... pulseaudio
Date: Mon Jan 29 15:03:34 2018
InstallationDate: Installed on 2017-10-13 (108 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170926)
MachineType: SAMSUNG ELECTRONICS CO., LTD. 530U3C/530U4C
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/@/boot/vmlinuz-4.13.0-32-generic root=UUID=707d0f89-4b1d-4432-9d50-6058dc4c1ee9 ro rootflags=subvol=@ quiet splash vt.handoff=1
PulseList:
Error: command ['pacmd', 'list'] failed with exit code 1: Home directory not accessible: Permission denied
No PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-4.13.0-32-generic N/A
linux-backports-modules-4.13.0-32-generic N/A
linux-firmware 1.170
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 04/15/2013
dmi.bios.vendor: Phoenix Technologies Ltd.
dmi.bios.version: P14AAJ
dmi.board.asset.tag: Base Board Asset Tag
dmi.board.name: SAMSUNG_NP1234567890
dmi.board.vendor: SAMSUNG ELECTRONICS CO., LTD.
dmi.board.version: FAB1
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 9
dmi.chassis.vendor: SAMSUNG ELECTRONICS CO., LTD.
dmi.chassis.version: 0.1
dmi.modalias: dmi:bvnPhoenixTechnologiesLtd.:bvrP14AAJ:bd04/15/2013:svnSAMSUNGELECTRONICSCO.,LTD.:pn530U3C/530U4C:pvr0.1:rvnSAMSUNGELECTRONICSCO.,LTD.:rnSAMSUNG_NP1234567890:rvrFAB1:cvnSAMSUNGELECTRONICSCO.,LTD.:ct9:cvr0.1:
dmi.product.family: ChiefRiver System
dmi.product.name: 530U3C/530U4C
dmi.product.version: 0.1
dmi.sys.vendor: SAMSUNG ELECTRONICS CO., LTD.
---
ApportVersion: 2.20.8-0ubuntu8
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/pcmC0D0p: caravena 1849 F...m pulseaudio
/dev/snd/controlC0: caravena 1849 F.... pulseaudio
CurrentDesktop: ubuntu-communitheme:ubuntu:GNOME
DistroRelease: Ubuntu 18.04
InstallationDate: Installed on 2017-10-13 (118 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170926)
MachineType: SAMSUNG ELECTRONICS CO., LTD. 530U3C/530U4C
Package: linux (not installed)
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/@/boot/vmlinuz-4.15.0-9-generic root=UUID=707d0f89-4b1d-4432-9d50-6058dc4c1ee9 ro rootflags=subvol=@ quiet splash vt.handoff=1
ProcVersionSignature: Ubuntu 4.15.0-9.10-generic 4.15.2
RelatedPackageVersions:
linux-restricted-modules-4.15.0-9-generic N/A
linux-backports-modules-4.15.0-9-generic N/A
linux-firmware 1.170
Tags: bionic
Uname: Linux 4.15.0-9-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dialout dip libvirt lpadmin plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 04/15/2013
dmi.bios.vendor: Phoenix Technologies Ltd.
dmi.bios.version: P14AAJ
dmi.board.asset.tag: Base Board Asset Tag
dmi.board.name: SAMSUNG_NP1234567890
dmi.board.vendor: SAMSUNG ELECTRONICS CO., LTD.
dmi.board.version: FAB1
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 9
dmi.chassis.vendor: SAMSUNG ELECTRONICS CO., LTD.
dmi.chassis.version: 0.1
dmi.modalias: dmi:bvnPhoenixTechnologiesLtd.:bvrP14AAJ:bd04/15/2013:svnSAMSUNGELECTRONICSCO.,LTD.:pn530U3C/530U4C:pvr0.1:rvnSAMSUNGELECTRONICSCO.,LTD.:rnSAMSUNG_NP1234567890:rvrFAB1:cvnSAMSUNGELECTRONICSCO.,LTD.:ct9:cvr0.1:
dmi.product.family: ChiefRiver System
dmi.product.name: 530U3C/530U4C
dmi.product.version: 0.1
dmi.sys.vendor: SAMSUNG ELECTRONICS CO., LTD.

See original description

Tags:

CVE References

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-01-29:

AlsaInfo.txt Edit (30.9 KiB, text/plain; charset="utf-8")
CRDA.txt Edit (426 bytes, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (56.4 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (3.1 KiB, text/plain; charset="utf-8")
IwConfig.txt Edit (355 bytes, text/plain; charset="utf-8")
JournalErrors.txt Edit (146.7 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (20.9 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (625 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.7 KiB, text/plain; charset="utf-8")
ProcCpuinfoMinimal.txt Edit (956 bytes, text/plain; charset="utf-8")
ProcEnviron.txt Edit (306 bytes, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.5 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (6.5 KiB, text/plain; charset="utf-8")
RfKill.txt Edit (249 bytes, text/plain; charset="utf-8")
UdevDb.txt Edit (163.0 KiB, text/plain; charset="utf-8")
WifiSyslog.txt Edit (104.5 KiB, text/plain; charset="utf-8")

Revision history for this message

Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote on 2018-01-29: Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status:	New → Confirmed

Joseph Salisbury (jsalisbury) on 2018-01-29

Changed in linux (Ubuntu):
importance:	Undecided → High
status:	Confirmed → Triaged
tags:	added: pti

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-08:

spectre-meltdown-checker.txt Edit (2.5 KiB, text/plain)

Hello,

http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.15.2/linux-image-4.15.2-041502-generic_4.15.2-041502.201802072230_amd64.deb

Linux version 4.15.2-041502-generic

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support: NO
  * Currently enabled features
    * IBRS enabled for Kernel space: NO
    * IBRS enabled for User space: NO
    * IBPB enabled: NO
* Mitigation 2
  * Kernel compiled with retpoline option: YES
  * Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
  * Retpoline enabled: NO
> STATUS: NOT VULNERABLE (Mitigation: Full generic retpoline)

Regards,
--
Cristian

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: AlsaInfo.txt

AlsaInfo.txt Edit (30.8 KiB, text/plain)

apport information

tags:	added: apport-collected
description:	updated

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: CRDA.txt

CRDA.txt Edit (426 bytes, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: CurrentDmesg.txt

CurrentDmesg.txt Edit (58.1 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: IwConfig.txt

IwConfig.txt Edit (320 bytes, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: JournalErrors.txt

JournalErrors.txt Edit (158.7 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: Lspci.txt

Lspci.txt Edit (9.4 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: Lsusb.txt

#10

Lsusb.txt Edit (723 bytes, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: ProcCpuinfo.txt

#11

ProcCpuinfo.txt Edit (3.7 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: ProcCpuinfoMinimal.txt

#12

ProcCpuinfoMinimal.txt Edit (956 bytes, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: ProcEnviron.txt

#13

ProcEnviron.txt Edit (331 bytes, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: ProcInterrupts.txt

#14

ProcInterrupts.txt Edit (2.6 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: ProcModules.txt

#15

ProcModules.txt Edit (6.2 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: PulseList.txt

#16

PulseList.txt Edit (23.5 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: RfKill.txt

#17

RfKill.txt Edit (249 bytes, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: UdevDb.txt

#18

UdevDb.txt Edit (164.9 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09: WifiSyslog.txt

#19

WifiSyslog.txt Edit (106.6 KiB, text/plain)

apport information

Revision history for this message

Cristian Aravena Romero (caravena) wrote on 2018-02-09:

#20

# ./spectre-meltdown-checker.sh
Spectre and Meltdown mitigation detection tool v0.34+

Checking for vulnerabilities on current system
Kernel is Linux 4.15.0-9-generic #10-Ubuntu SMP Thu Feb 8 20:22:38 UTC 2018 x86_64
CPU is Intel(R) Core(TM) i3-2377M CPU @ 1.50GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available: NO
    * CPU indicates IBRS capability: NO
  * Indirect Branch Prediction Barrier (IBPB)
    * PRED_CMD MSR is available: NO
    * CPU indicates IBPB capability: NO
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available: NO
    * CPU indicates STIBP capability: NO
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability: NO
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): NO
  * CPU microcode is known to cause stability problems: NO (model 42 stepping 7 ucode 0x29)
* CPU vulnerability to the three speculative execution attacks variants
  * Vulnerable to Variant 1: YES
  * Vulnerable to Variant 2: YES
  * Vulnerable to Variant 3: YES

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel has array_index_mask_nospec: YES (1 occurence(s) found of 64 bits array_index_mask_nospec())
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

A false sense of security is worse than no security at all, see --disclaimer

# ./spectre-meltdown-checker.sh 
Spectre and Meltdown mitigation detection tool v0.34+

Checking for vulnerabilities on current system
Kernel is Linux 4.15.0-9-generic #10-Ubuntu SMP Thu Feb 8 20:22:38 UTC 2018 x86_64
CPU is Intel(R) Core(TM) i3-2377M CPU @ 1.50GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available:  NO 
    * CPU indicates IBRS capability:  NO 
  * Indirect Branch Prediction Barrier (IBPB)
    * PRED_CMD MSR is available:  NO 
    * CPU indicates IBPB capability:  NO 
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available:  NO 
    * CPU indicates STIBP capability:  NO 
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO 
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO 
  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO 
  * CPU microcode is known to cause stability problems:  NO  (model 42 stepping 7 ucode 0x29)
* CPU vulnerability to the three speculative execution attacks variants
  * Vulnerable to Variant 1:  YES 
  * Vulnerable to Variant 2:  YES 
  * Vulnerable to Variant 3:  YES

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel has array_index_mask_nospec:  YES  (1 occurence(s) found of 64 bits array_index_mask_nospec())
> STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  NO 
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO 
    * IBRS enabled for User space:  NO 
    * IBPB enabled:  NO 
* Mitigation 2
  * Kernel compiled with retpoline option:  YES 
  * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
  * Retpoline enabled:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI):  YES 
* PTI enabled and active:  YES 
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: PTI)

A false sense of security is worse than no security at all, see --disclaimer

Report a bug

This report contains Public information

Everyone can see this information.

Duplicate of bug #1743812 Remove

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'

Bug Description

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux package