Re: patch openSUSE-2019-1806 fails to mitigate CVE-2018-12126/CVE-2018-12130/CVE-2018-12127/CVE-2019-11091 ?

Hi,

On Wed, Feb 12, 2020 at 08:29:53PM -0800, PGNet Dev wrote:
> This security update
> 
> 	https://lists.opensuse.org/opensuse-security-announce/2019-07/msg00052.html
> 
> addresses
> 
> 	Four new speculative execution information leak issues have been
> 	identified in Intel CPUs. (bsc#1111331)
> 
> 	- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
> 	- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
> 	- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
> 	- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory
> 	(MDSUM)
> 
> 	These updates contain the CPU Microcode adjustments for the software
> 	mitigations.
> 
> to be installed with
> 
> 	zypper in -t patch openSUSE-2019-1806=1
> 
> here, running
> 
> 	lsb_release -rd
> 		Description:    openSUSE Leap 15.1
> 		Release:        15.1
> 
> 	uname -rm
> 		5.5.2-25.g994cf1f-default x86_64
> 
> 	rpm -qa | egrep "ucode-intel|firmware-intel"
> 		ucode-intel-20191115-lp151.3.9.x86_64
> 		kernel-firmware-intel-20200122-36.2.noarch
> 
> on an old, but otherwise functional, laptop,
> 
> 	cat /proc/cpuinfo | grep -i "model name"
> 		model name : Intel(R) Core(TM) i3 CPU M 370  @ 2.40GHz
> 
> with mitigations enabled with,
> 
> 	cat /proc/cmdline
> 		BOOT_IMAGE=/vmlinuz-5.5.2-25.g994cf1f-default ... mitigations=auto,nosmt ...
> 
> and
> 
> 	zypper in -t patch openSUSE-2019-1806=1
> 		Loading repository data...
> 		Reading installed packages...
> 		'patch:openSUSE-2019-1806 = 1' is already installed.
> 		Resolving package dependencies...
> 
> 		Nothing to do.
> 
> a check with
> 
> 	spectre-meltdown-checker.sh --version
> 		Spectre and Meltdown mitigation detection tool v0.43
> 
> returns
> 
> 	...
> 	CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
> 	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
> 	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
> 	* Kernel mitigation is enabled and active:  NO
> 	* SMT is either mitigated or disabled:  YES
> 	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
> 
> 	CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
> 	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
> 	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
> 	* Kernel mitigation is enabled and active:  NO
> 	* SMT is either mitigated or disabled:  YES
> 	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
> 
> 	CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
> 	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
> 	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
> 	* Kernel mitigation is enabled and active:  NO
> 	* SMT is either mitigated or disabled:  YES
> 	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
> 
> 	CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
> 	* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
> 	* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
> 	* Kernel mitigation is enabled and active:  NO
> 	* SMT is either mitigated or disabled:  YES
> 	> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
> 	...
> 
> and
> 
> 	cat /sys/devices/system/cpu/vulnerabilities/mds
> 		Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled
> 
> what additional mitigation, &/or specific microcode update is required to complete the mitigations?

A newer processor. :/

Sadly, Intel does not provide updated microcode for older processors.

Ciao, Marcus
-- 
To unsubscribe, e-mail: [email protected]
To contact the owner, e-mail: [email protected]