With so much going on - is there a way in linux to know whether my system is patched or not? Similar to the powershell script for Windows?
$ dmesg | grep isolation
[ 0.000000] Kernel/User page tables isolation: enabled
Meltdown and Spectre Linux kernel status
21–30 of 186 posts
Re: Meltdown and Spectre Linux kernel status
#22Earlier quoted context omitted.
So, there is NO kernel update available for Ubuntu 16.04 at this time.
Right - for desktop use though, there are Firefox and Chrome updates with mitigation. JavaScript exploits were the most dangerous desktop scenario. For servers running Ubuntu, what is the risk, as long as my services don't run arbitrary user uploaded executables? As far as I can tell it is that a different remote code execution exploit can now read the entire memory, possibly leaking secrets. Assuming we have a kerne…
I think it's naive to think you're completely protected just because code isn't supposed to ever run. It seems as though the simplest and safest piece of mind is to use some extra layers of protection ala SELinux.
This won't stop the memory from being accessed, but it has a better chance of stopping things that can exploit the bug(s) in the first place.
Revoking TLS certs is probably a little bit on the side of paranoia.
I think you're on the right track -- just watch for the kernel update, and rotate passwords plus keys if it's not a hassle.
Re: Meltdown and Spectre Linux kernel status
#23Earlier quoted context omitted.
And you probably know much better than the second most important guy on linux what security means on the Internet: securing some javascript script on a random blog.
HTTPS should be expected by now - ISPs keep messing with my unencrypted traffic.
Then you should get yourself a different ISP or a VPN.
Re: Meltdown and Spectre Linux kernel status
#24With so much going on - is there a way in linux to know whether my system is patched or not? Similar to the powershell script for Windows?
A number of ways are listed here [1]
1. With dmesg
dmesg -wH | grep 'page tables isolation'
2. With /proc/cpuinfo
grep cpu_insecure /proc/cpuinfo && echo "Patched" || echo "Unpatched!"
[1] https://askubuntu.com/questions/992137/how-to-check-that-kpt...
Re: Meltdown and Spectre Linux kernel status
#25With so much going on - is there a way in linux to know whether my system is patched or not? Similar to the powershell script for Windows?
Link to the powershell script for those who need it:
https://blogs.technet.microsoft.com/ralphkyttle/2018/01/05/v...
Re: Meltdown and Spectre Linux kernel status
#26Someone please correct me if I'm wrong, but both spectre and meltdown seem to me to be local root exploits, not remote vulns. They can be used to break out of (say) a VM into the host hypervisor, and thence into other VMs running on the same hardware, but cannot be used to break into a machine from outside its hardware perimeter. Is that right?
Re: Meltdown and Spectre Linux kernel status
#27The website serves JS and does not serve it over https, and discusses Spectre bug and how to patch it. I know he is the second most important guy on linux, but the irony.
I get the irony, but if you could magically visualize the entire internet security threat matrix, this would fall so far down the list and his other work is so high in terms of impact, that it would absolutely no sense for him to take even one minute away from his other activities to address this.
Re: Meltdown and Spectre Linux kernel status
#28Re: Meltdown and Spectre Linux kernel status
#29Earlier quoted context omitted.
HTTPS should be expected by now - ISPs keep messing with my unencrypted traffic.
Then you should get yourself a different ISP or a VPN.
Some places have no other choices for ISPs. I don't disagree that a VPN would help but that feels like it's simply dismissing that there's a problem.
Re: Meltdown and Spectre Linux kernel status
#30Earlier quoted context omitted.
What is the expected outcome if its patched vs. not? I am getting: fpu_exception : yes
You should see "pti" on the "flags" line of /proc/cpuinfo. You apparently don't, so you don't have page table isolation.
No, he shouldn’t be seeing that regardless as it doesn’t match the grep regex. I don’t know what, though.
Edit: facepalm. Or should that be foot-in-mouth?