5 ms·

This command does not show anything on my ubuntu 16.04 lts machine. grep . /sys/devices/system/cpu/vulnerabilities/* is there an alternate command for ubuntu?

drofmij 9y ago
for ubuntu command check here: https://askubuntu.com/questions/992137/how-to-check-that-kpti-is-enabled-on-my-ubuntu https://askubuntu.com/questions/992137/how-to-check-that-kpt... Here is one of the commands recommended in that thread: grep -q "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" \ || echo "unpatched :("
- yorby 9y ago
  This command appears to work in Fedora too...
- the_af 9y ago
  That line worked for me, but do note the first command listed in the answer you linked to is NOT reliable and is not always consistent with the next two commands.
deleted 9y ago
[deleted]
mnw21cam 9y ago
Having actually read the article, this would suggest that your kernel is too old to have the fixes.
- twunde 9y ago
  Not true. Ubuntu packported the kernel patches. 16.04 should be updated automatically as long as you've restarted your server
  - newman314 9y ago
    To be clear, Ubuntu's Spectre fixes are only in -proposed right now. They are scheduled to be moved to the regular repos on the 22th.
    - newman314 9y ago
      Just to follow up, looks like Spectre fixes are now available but only for Variant 1. The following is on a 16.04 VM running HWE 4.13.0-31. Additionally, reptoline patches are not available. CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: YES > STATUS: NOT VULNERABLE (114 opcodes found, which is >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: YES * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): YES * PTI enabled and active: YES * Checking if we're running under Xen PV (64 bits): NO > STATUS: NOT VULNERABLE (PTI mitigates the vulnerability)
jlgaddis 9y ago
> Some “enterprise” distributions did not backport the changes for this reporting, so if you are running one of those types of kernels, go bug the vendor to fix that, you really want a unified way of knowing the state of your system.

drofmij 9y ago

for ubuntu command check here: https://askubuntu.com/questions/992137/how-to-check-that-kpti-is-enabled-on-my-ubuntu https://askubuntu.com/questions/992137/how-to-check-that-kpt... Here is one of the commands recommended in that thread: grep -q "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" \ || echo "unpatched :("

yorby 9y ago
This command appears to work in Fedora too...
the_af 9y ago
That line worked for me, but do note the first command listed in the answer you linked to is NOT reliable and is not always consistent with the next two commands.

deleted 9y ago

[deleted]

mnw21cam 9y ago

Having actually read the article, this would suggest that your kernel is too old to have the fixes.

twunde 9y ago
Not true. Ubuntu packported the kernel patches. 16.04 should be updated automatically as long as you've restarted your server
- newman314 9y ago
  To be clear, Ubuntu's Spectre fixes are only in -proposed right now. They are scheduled to be moved to the regular repos on the 22th.
  - newman314 9y ago
    Just to follow up, looks like Spectre fixes are now available but only for Variant 1. The following is on a 16.04 VM running HWE 4.13.0-31. Additionally, reptoline patches are not available. CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: YES > STATUS: NOT VULNERABLE (114 opcodes found, which is >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: YES * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): YES * PTI enabled and active: YES * Checking if we're running under Xen PV (64 bits): NO > STATUS: NOT VULNERABLE (PTI mitigates the vulnerability)

jlgaddis 9y ago

> Some “enterprise” distributions did not backport the changes for this reporting, so if you are running one of those types of kernels, go bug the vendor to fix that, you really want a unified way of knowing the state of your system.