☰

SpectreMeltdown ubuntu 内核 3.13.0-141-generic 更新后仍然容易受到攻击吗？

tag-icon • tag-icon ubuntu kernel security
SpectreMeltdown ubuntu 内核 3.13.0-141-generic 更新后仍然容易受到攻击吗？

我已经将我的服务器的 ubuntu 14.04 更新到了最新的内核：

3.13.0-141-generic

据我所知，这是 spectreMeltdown 漏洞披露后的第二个版本。

但是当运行 spectre-and-meltdown 漏洞检查器时：

https://github.com/speed47/spectre-meltdown-checker

我的系统似乎仍然容易受到攻击：

Spectre and Meltdown mitigation detection tool v0.32

Checking for vulnerabilities on current system
Kernel is Linux 3.13.0-141-generic #190-Ubuntu SMP Fri Jan 19 12:52:38 UTC 2018 x86_64
CPU is Intel(R) Xeon(R) CPU E5-2630L v2 @ 2.40GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available:  NO
    * CPU indicates IBRS capability:  NO
  * Indirect Branch Prediction Barrier (IBPB)
    * PRED_CMD MSR is available:  NO
    * CPU indicates IBPB capability:  NO
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available:  NO
    * CPU indicates STIBP capability:  NO
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO
  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO
* CPU vulnerability to the three speculative execution attacks variants
  * Vulnerable to Variant 1:  YES
  * Vulnerable to Variant 2:  YES
  * Vulnerable to Variant 3:  YES

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Checking count of LFENCE opcodes in kernel:  YES
> STATUS:  NOT VULNERABLE  (99 opcodes found, which is >= 70, heuristic to be improved when official patches become available)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  YES
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO  (echo 1 > /proc/sys/kernel/ibrs_enabled)
    * IBRS enabled for User space:  NO  (echo 2 > /proc/sys/kernel/ibrs_enabled)
    * IBPB enabled:  NO  (echo 1 > /proc/sys/kernel/ibpb_enabled)
* Mitigation 2
  * Kernel compiled with retpoline option:  NO
  * Kernel compiled with a retpoline-aware compiler:  NO
  * Retpoline enabled:  NO
> STATUS:  VULNERABLE  (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI):  YES
* PTI enabled and active:  YES
* Running as a Xen PV DomU:  NO
> STATUS:  NOT VULNERABLE  (PTI mitigates the vulnerability)

A false sense of security is worse than no security at all, see --disclaimer

https://imgur.com/a/tobCB

我可以采取进一步措施来减轻这些威胁，还是这只是目前的情况？

提前致谢！

答案1

有关 Ubuntu 特定的 Meltdown 和 Spectre 缓解措施的最佳信息来源是安全知识库中的专用页面。那里的信息与您所看到的相符：

  • 您的 CPU 尚未更新为支持 IBRS/IBPB，因此 Spectre 变体 2 的缓解措施不起作用；
  • Meltdown 和 Spectre 变种 1 得到缓解。

关于你的CPU，有更新的微代码包，但这导致了回归和已恢复。您的主板制造商可能有可用的固件更新来解决该问题；安装它将启用 Spectre 变体 2 缓解措施。

尚未包含 Retpoline 支持，但稍后也可能会解决 Spectre 变体 2 的问题。

作为锐 指出，这些更新不应让您陷入安全错误，可能还有其他类似的漏洞等待被发现（如果还没有被发现！）。无论如何，你应该始终认为计算机是不可信的......

答案2

您可以通过运行“dmesg | grepisolation”来检查任何发行版的“meltdown”如果启用了 PTI，那么输出应该是：“Kernel/User pagetablesisolation：enabled”在 Devuan 上，我必须按如下方式启用它：检查您的供应商已使用 PTI 修补了您的内核！ "grep -i "isolation" /boot/config-*" 如果显示“CONFIG_PAGE_TABLE_ISOLATION=y” 那么你很幸运！通过在内核启动参数中设置“pti=on”来启用 D​​evuan 中的 PTI：将“pti=on”添加到“/etc/default/grub”中的“GRUB_CMDLINE_LINUX_DEFAULT”并运行：“update-grub” 重新启动并再次检查！为了缓解所有 Intel CPU 的错误，必须按照帖子中之前提到的方式更新微代码。我的 i3 笔记本电脑已经用了 8 年了！任何固件更新的机会:-/

相关内容