From: Mohammed Azfar <m_az@LIVE.IN>
To: "kernelnewbies@nl.linux.org" <kernelnewbies@nl.linux.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Reg : Spectre & Meltdown 
Thread-Topic: Reg : Spectre & Meltdown 
Thread-Index: AQHTim4qNvzuNxTZ20qDTz43sKfWwaN1b8rLgABjHL0=
Date: Mon, 15 Jan 2018 21:14:51 +0000
Message-ID: <MA1PR0101MB11890D4628800E42A63213F6ECEB0@MA1PR0101MB1189.INDPRD01.PROD.OUTLOOK.COM>
References: <MA1PR0101MB118900C3BC708AE48A0F305FEC110@MA1PR0101MB1189.INDPRD01.PROD.OUTLOOK.COM>,<MA1PR0101MB1189DC9B8899A77FBAED00FEECEB0@MA1PR0101MB1189.INDPRD01.PROD.OUTLOOK.COM>
In-Reply-To: <MA1PR0101MB1189DC9B8899A77FBAED00FEECEB0@MA1PR0101MB1189.INDPRD01.PROD.OUTLOOK.COM>
Accept-Language: en-US
Content-Language: en-US
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: f91a7e57-2e73-48d8-4de6-08d55c5d0430
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jan 2018 21:14:51.4156
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HK2APC01HT168
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

Hi Team

please share your suggestions about this.

I tired an online tool to check the vulnerability of spectre and meltdown, this is after upgrading 4.4.111-1 kernel version in centos 7. But its still showing in vulnerable state, im running this script in AWS instance.  Please advice me.

Script :?https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh

Output :?

Spectre and Meltdown mitigation detection tool v0.24


Checking for vulnerabilities against live running kernel Linux 4.4.111-1.el7.elrepo.x86_64 #1 SMP Wed Jan 10 13:12:02 EST 2018 x86_64


CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Checking count of LFENCE opcodes in kernel:? NO? (only 35 opcodes found, should be >= 70)
> STATUS:? VULNERABLE? (heuristic to be improved when official patches become available)


CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
*? ?Hardware (CPU microcode) support for mitigation:? YES
*? ?Kernel support for IBRS:? NO
*? ?IBRS enabled for Kernel space:? NO
*? ?IBRS enabled for User space:? NO
* Mitigation 2
*? ?Kernel compiled with retpoline option:? NO
*? ?Kernel compiled with a retpoline-aware compiler:? NO
> STATUS:? VULNERABLE? (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability)


CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI):? YES
* PTI enabled and active:? YES
> STATUS:? NOT VULNERABLE? (PTI mitigates the vulnerability)


A false sense of security is worse than no security at all, see --disclaimer


--
Thanks


Mohammed Azfar