[elrepo] kernel-lt and kernel-ml updates for Meltdown and Spectre

[Phil Perry]

On 10/01/18 20:06, Phil Perry wrote:
> 
> 
> A vulnerability checker script:
> 
> https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh 
> 
> 

On a fully updated RHEL7 system (kernel-3.10.0-693.11.6.el7.x86_64), and 
after applying the latest microcode update for my CPU from Intel:

# ./spectre-meltdown-checker.sh
Spectre and Meltdown mitigation detection tool v0.24

Checking for vulnerabilities against live running kernel Linux 
3.10.0-693.11.6.el7.x86_64 #1 SMP Thu Dec 28 14:23:39 EST 2017 x86_64

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Checking count of LFENCE opcodes in kernel:  YES  (112 opcodes found, 
which is >= 70)
 > STATUS:  NOT VULNERABLE  (heuristic to be improved when official 
patches become available)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
*   Hardware (CPU microcode) support for mitigation:  YES
*   Kernel support for IBRS:  YES
*   IBRS enabled for Kernel space:  YES
*   IBRS enabled for User space:  NO
* Mitigation 2
*   Kernel compiled with retpoline option:  NO
*   Kernel compiled with a retpoline-aware compiler:  NO
 > STATUS:  NOT VULNERABLE  (IBRS mitigates the vulnerability)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI):  YES
* PTI enabled and active:  YES
 > STATUS:  NOT VULNERABLE  (PTI mitigates the vulnerability)

A false sense of security is worse than no security at all, see --disclaimer


Before the microcode update, it was showing as vulnerable to 
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'