patch openSUSE-2019-1806 fails to mitigate CVE-2018-12126/CVE-2018-12130/CVE-2018-12127/CVE-2019-11091 ?

This security update

	https://lists.opensuse.org/opensuse-security-announce/2019-07/msg00052.html

addresses

	Four new speculative execution information leak issues have been
	identified in Intel CPUs. (bsc#1111331)

	- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
	- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
	- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
	- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory
	(MDSUM)

	These updates contain the CPU Microcode adjustments for the software
	mitigations.

to be installed with

	zypper in -t patch openSUSE-2019-1806=1

here, running

	lsb_release -rd
		Description:    openSUSE Leap 15.1
		Release:        15.1

	uname -rm
		5.5.2-25.g994cf1f-default x86_64

	rpm -qa | egrep "ucode-intel|firmware-intel"
		ucode-intel-20191115-lp151.3.9.x86_64
		kernel-firmware-intel-20200122-36.2.noarch

on an old, but otherwise functional, laptop,

	cat /proc/cpuinfo | grep -i "model name"
		model name : Intel(R) Core(TM) i3 CPU M 370  @ 2.40GHz

with mitigations enabled with,

	cat /proc/cmdline
		BOOT_IMAGE=/vmlinuz-5.5.2-25.g994cf1f-default ... mitigations=auto,nosmt ...

and

	zypper in -t patch openSUSE-2019-1806=1
		Loading repository data...
		Reading installed packages...
		'patch:openSUSE-2019-1806 = 1' is already installed.
		Resolving package dependencies...

		Nothing to do.

a check with

	spectre-meltdown-checker.sh --version
		Spectre and Meltdown mitigation detection tool v0.43

returns

	...
	CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
	* Kernel mitigation is enabled and active:  NO
	* SMT is either mitigated or disabled:  YES
	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

	CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
	* Kernel mitigation is enabled and active:  NO
	* SMT is either mitigated or disabled:  YES
	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

	CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
	* Kernel mitigation is enabled and active:  NO
	* SMT is either mitigated or disabled:  YES
	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

	CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
	* Kernel mitigation is enabled and active:  NO
	* SMT is either mitigated or disabled:  YES
	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
	...

and

	cat /sys/devices/system/cpu/vulnerabilities/mds
		Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled

what additional mitigation, &/or specific microcode update is required to complete the mitigations?

-- 
To unsubscribe, e-mail: [email protected]
To contact the owner, e-mail: [email protected]