search

freedomofpress / securedrop-workstation

Qubes-based SecureDrop Journalist Workstation environment for submission handling
GNU Affero General Public License v3.0
138 stars 42 forks source link

September 2023 Linux kernel update #916

Closed cfm closed 11 months ago

cfm commented 1 year ago

Being done in coordination with freedomofpress/securedrop#6938.

Checklist

Test plan

cfm commented 1 year ago

This is blocked on https://github.com/freedomofpress/securedrop-apt-test/pull/202#issuecomment-1709117337, which will be resolved with new packages tomorrow.

cfm commented 1 year ago

Unblocked by freedomofpress/securedrop-apt-test#203. We're hoping to complete testing in time to promote to securedrop-apt-prod on Monday.

rocodes commented 1 year ago

Tested on sd-bullseye template by manually installing kernel. Kernel boots and blackhat tests come back fine, but the spectre/meltdown checker reports SRBDS unmitigated (see also kev's results on the server). It also reports an Unknown result for CVE-2022-40982 aka 'Downfall, gather data sampling (GDS)'.

Unlike kev's, I notice this line in the hardware preflight check:

 * CPU supports Special Register Buffer Data Sampling (SRBDS):  NO

Regardless, looking into the failures:

output ``` Checking for vulnerabilities on current system Kernel is Linux 5.15.131-1-grsec-workstation #1 SMP PREEMPT @1309379017 x86_64 CPU is Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz Hardware check * Hardware support (CPU microcode) for mitigation techniques * Indirect Branch Restricted Speculation (IBRS) * SPEC_CTRL MSR is available: YES * CPU indicates IBRS capability: YES (SPEC_CTRL feature bit) * Indirect Branch Prediction Barrier (IBPB) * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit) * Single Thread Indirect Branch Predictors (STIBP) * SPEC_CTRL MSR is available: YES * CPU indicates STIBP capability: YES (Intel STIBP feature bit) * Speculative Store Bypass Disable (SSBD) * CPU indicates SSBD capability: YES (Intel SSBD) * L1 data cache invalidation * CPU indicates L1D flush capability: YES (L1D flush feature bit) * Microarchitectural Data Sampling * VERW instruction is available: YES (MD_CLEAR feature bit) * Indirect Branch Predictor Controls * Indirect Predictor Disable feature is available: NO * Bottomless RSB Disable feature is available: NO * BHB-Focused Indirect Predictor Disable feature is available: NO * Enhanced IBRS (IBRS_ALL) * CPU indicates ARCH_CAPABILITIES MSR availability: YES * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: YES * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): YES * CPU explicitly indicates not being affected by Variant 4 (SSB_NO): NO * CPU/Hypervisor indicates L1D flushing is not necessary on this system: NO * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): NO * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): YES * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): NO * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): NO * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): NO * CPU explicitly indicates being affected by GDS and having mitigation control (GDS_CTRL): NO * CPU explicitly indicates not being affected by GDS (GDS_NO): NO * CPU supports Transactional Synchronization Extensions (TSX): NO * CPU supports Software Guard Extensions (SGX): NO * CPU supports Special Register Buffer Data Sampling (SRBDS): NO * CPU microcode is known to cause stability problems: NO (family 0x6 model 0x8e stepping 0xc ucode 0xf4 cpuid 0x806ec) * CPU microcode is the latest known available version: NO (latest version is 0xf8 dated 2023/02/26 according to builtin firmwares DB v273+i20230808+b6bd) * CPU vulnerability to the speculative execution attack variants * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): NO * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): YES * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): YES * Affected by CVE-2023-20593 (Zenbleed, cross-process information leak): NO * Affected by CVE-2022-40982 (Downfall, gather data sampling (GDS)): YES * Affected by CVE-2023-20569 (Inception, return address security (RAS)): NO CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass' * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization (complete, automated)) * Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec()) * Kernel has the Red Hat/Ubuntu patch: NO * Kernel has mask_nospec64 (arm64): NO * Kernel has array_index_nospec (arm64): NO > STATUS: NOT VULNERABLE (Mitigation: usercopy/swapgs barriers and __user pointer sanitization (complete, automated)) CVE-2017-5715 aka 'Spectre Variant 2, branch target injection' * Mitigated according to the /sys interface: YES (Mitigation: Enhanced / Automatic IBRS, IBPB: conditional, RSB filling, PBRSB-eIBRS: SW sequence) * Mitigation 1 * Kernel is compiled with IBRS support: YES * IBRS enabled and active: YES * Kernel is compiled with IBPB support: YES * IBPB enabled and active: YES * Mitigation 2 * Kernel has branch predictor hardening (arm): NO * Kernel compiled with retpoline option: YES * Kernel supports RSB filling: YES > STATUS: NOT VULNERABLE (IBRS + IBPB are mitigating the vulnerability) CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: dmesg truncated, Xen detection will be unreliable. Please reboot and relaunch this script UNKNOWN (dmesg truncated, please reboot and relaunch this script) * Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced) dmesg truncated, Xen detection will be unreliable. Please reboot and relaunch this script dmesg truncated, Xen detection will be unreliable. Please reboot and relaunch this script * Running as a Xen PV DomU: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-3640 aka 'Variant 3a, rogue system register read' * CPU microcode mitigates the vulnerability: YES > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-3639 aka 'Variant 4, speculative store bypass' * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl) * Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status) * SSB mitigation is enabled and active: YES (per-thread through prctl) * SSB mitigation currently active for selected processes: NO (no process found using SSB mitigation through prctl) > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl) CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault' * CPU microcode mitigates the vulnerability: N/A > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault' * Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion) * Kernel supports PTE inversion: YES (found in kernel image) * PTE inversion enabled and active: YES > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault' * Information from the /sys interface: Mitigation: PTE Inversion * This system is a host running a hypervisor: NO * Mitigation 1 (KVM) * EPT is disabled: N/A (the kvm_intel module is not loaded) * Mitigation 2 * L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo) * L1D flush enabled: dmesg truncated, Xen detection will be unreliable. Please reboot and relaunch this script UNKNOWN (unrecognized mode) * Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced) * Hyper-Threading (SMT) is enabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)' * Mitigated according to the /sys interface: YES (Not affected) * TAA mitigation is supported by kernel: YES (found tsx_async_abort in kernel image) * TAA mitigation enabled and active: NO > STATUS: NOT VULNERABLE (Not affected) CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)' * Mitigated according to the /sys interface: YES (KVM: Mitigation: VMX unsupported) * This system is a host running a hypervisor: NO * iTLB Multihit mitigation is supported by kernel: YES (found itlb_multihit in kernel image) * iTLB Multihit mitigation enabled and active: YES (KVM: Mitigation: VMX unsupported) > STATUS: NOT VULNERABLE (this system is not running a hypervisor) CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)' * Mitigated according to the /sys interface: UNKNOWN (Unknown: Dependent on hypervisor status) * SRBDS mitigation control is supported by the kernel: YES (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation) * SRBDS mitigation control is enabled and active: NO > STATUS: VULNERABLE (Your CPU microcode may need to be updated to mitigate the vulnerability) CVE-2023-20593 aka 'Zenbleed, cross-process information leak' * Zenbleed mitigation is supported by kernel: YES (found zenbleed message in kernel image) * Zenbleed kernel mitigation enabled and active: N/A (CPU is incompatible) * Zenbleed mitigation is supported by CPU microcode: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) CVE-2022-40982 aka 'Downfall, gather data sampling (GDS)' * Mitigated according to the /sys interface: UNKNOWN (Unknown: Dependent on hypervisor status) * GDS is mitigated by microcode: NO * Kernel supports software mitigation by disabling AVX: YES (found gather_data_sampling in kernel image) * Kernel has disabled AVX as a mitigation: NO (AVX support is enabled) > STATUS: UNKNOWN (Unknown: Dependent on hypervisor status) CVE-2023-20569 aka 'Inception, return address security (RAS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports mitigation: YES (found spec_rstack_overflow in kernel image) * Kernel compiled with SRSO support: YES * Kernel compiled with IBPB_ENTRY support: YES > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:KO CVE-2023-20593:OK CVE-2022-40982:?? CVE-2023-20569:OK Need more detailed information about mitigation options? Use --explain A false sense of security is worse than no security at all, see --disclaimer ```
cfm commented 1 year ago

Thanks, @ro. Per https://github.com/freedomofpress/securedrop/issues/6938#issuecomment-1716625204, do you get the same results (with the same meltdown.sh) on the previous kernel?

rocodes commented 1 year ago

Yes - on the 5.15.123-1 grsec workstation kernel I get the same result for the SRBDS.