The recently disclosed Spectre and Meltdown CPU vulnerabilities are some of the most dramatic security issues in the recent computer history. Fortunately even six weeks after public disclosure sophisticated attacks exploiting these vulnerabilities are not yet common to observe. Fortunately, because the hard- and software vendors are still stuggling to provide appropriate fixes.
If you happen to run a Linux system, an excellent tool for tracking your vulnerability as well as the already active mitigation strategies is the spectre-meltdown-checker script originally written and maintained by Stéphane Lesimple.
Within the last month I set myself the target to bring this script to Fedora and EPEL so it can be easily consumed by the Fedora, CentOS and RHEL users. Today it finally happend that the spectre-meltdown-checker package was added to the EPEL repositories after it is already available in the Fedora stable repositories since one week.
On Fedora, all you need to do is:
dnf install spectre-meltdown-checker
After enabling the EPEL repository on CentOS this would be:
yum install spectre-meltdown-checker
The script, which should be run by the root user, will report:
- If your processor is affected by the different variants of the Spectre and Meltdown vulnerabilities.
- If your processor microcode tries to mitigate the Spectre vulnerability or if you run a microcode which
is known to cause stability issues. - If your kernel implements the currently known mitigation strategies and if it was compiled with a compiler which is hardening it even more.
- And eventually if you’re (still) affected by some of the vulnerability variants.
On my laptop this currently looks like this (Note, that I’m not running the latest stable Fedora kernel yet):
# spectre-meltdown-checker
Spectre and Meltdown mitigation detection tool v0.33
Checking for vulnerabilities on current system
Kernel is Linux 4.14.14-200.fc26.x86_64 #1 SMP Fri Jan 19 13:27:06 UTC 2018 x86_64
CPU is Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: YES
* CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: YES
* CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: YES
* CPU indicates STIBP capability: YES
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: NO
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): UNKNOWN
* CPU microcode is known to cause stability problems: YES (Intel CPU Family 6 Model 61 Stepping 4 with microcode 0x28)
The microcode your CPU is running on is known to cause instability problems,
such as intempestive reboots or random crashes.
You are advised to either revert to a previous microcode version (that might not have
the mitigations for Spectre), or upgrade to a newer one if available.
* CPU vulnerability to the three speculative execution attacks variants
* Vulnerable to Variant 1: YES
* Vulnerable to Variant 2: YES
* Vulnerable to Variant 3: YES
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface: NO (kernel confirms your system is vulnerable)
> STATUS: VULNERABLE (Vulnerable)
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Mitigation 1
* Kernel is compiled with IBRS/IBPB support: NO
* Currently enabled features
* IBRS enabled for Kernel space: NO
* IBRS enabled for User space: NO
* IBPB enabled: NO
* Mitigation 2
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
* Retpoline enabled: YES
> STATUS: NOT VULNERABLE (Mitigation: Full generic retpoline)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)
A false sense of security is worse than no security at all, see --disclaimer
The script also supports a mode which outputs the result as JSON, so that it can easily be parsed by any compliance or monitoring tool:
# spectre-meltdown-checker --batch json 2>/dev/null | jq
[
{
"NAME": "SPECTRE VARIANT 1",
"CVE": "CVE-2017-5753",
"VULNERABLE": true,
"INFOS": "Vulnerable"
},
{
"NAME": "SPECTRE VARIANT 2",
"CVE": "CVE-2017-5715",
"VULNERABLE": false,
"INFOS": "Mitigation: Full generic retpoline"
},
{
"NAME": "MELTDOWN",
"CVE": "CVE-2017-5754",
"VULNERABLE": false,
"INFOS": "Mitigation: PTI"
}
]
For those who are (still) using a Nagios-compatible monitoring system, spectre-meltdown-checker also supports to be run as NRPE check:
# spectre-meltdown-checker --batch nrpe 2>/dev/null ; echo $? Vulnerable: CVE-2017-5753 2
I just mailed to Stéphane and he will soon release version 0.35 with many new features and fixes. As soon as it will be released I’ll submit a package update, so that you’re always up to date with the latest developments.