search

freedomofpress / securedrop

GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!
https://securedrop.org/
Other
3.6k stars 686 forks source link

September 2023 Linux kernel update #6938

Closed cfm closed 11 months ago

cfm commented 1 year ago

Being done in coordination with freedomofpress/securedrop-workstation#916.

Checklist

Testing matrix

Instructions on testing procedure

To update to the new kernel, please use sudo apt-get update && sudo unattended-upgrades -d (not sudo apt-get upgrade) OR wait 24h for the automatic update to happen.

Make sure you're using the most recent version of the spectre-meltdown-checker, which just had a new release for Zenbleed support. You should see "Zenbleed mitigation is supported by kernel: YES (found zenbleed message in kernel image)" in the output (near the very end).

Test plan

rocodes commented 1 year ago

See https://github.com/freedomofpress/securedrop-apt-test/pull/202#issuecomment-1709117337 : I just realized we forgot one step, which is to revert the manual dependency on the 5.15.89-kernel that we were previously using in order to keep 2 extra versions around.

(See https://github.com/freedomofpress/kernel-builder/pull/38)

cfm commented 1 year ago

Thanks for catching this, @rocodes. I confirm that this is blocked on new packages, which will be available tomorrow.

cfm commented 1 year ago

Unblocked by freedomofpress/securedrop-apt-test#203. We're hoping to complete testing in time to promote to securedrop-apt-prod on Monday.

rocodes commented 1 year ago

Installed the 5.15.131 package on a staging vm that hadn't received yesterday's build (so was at 5.15.123) - and also on one that did receive the 130 kernel yesterday - no problems, unattended upgrade completes happily, kernel boots, and 5.15.89 kernel is not a dependency :)

cfm commented 1 year ago

Everything checks out on my NUC11s.

NB. In the new versioning scheme, so far one old kernel is available to be retained, for two available to boot:

root@mon:/home/sdadmin# ls /boot/vmlinuz*
/boot/vmlinuz
/boot/vmlinuz-5.15.123-1-grsec-securedrop  # August
/boot/vmlinuz-5.15.131-1-grsec-securedrop  # September
/boot/vmlinuz.old

That's confusing based on https://github.com/freedomofpress/securedrop/issues/6762#issuecomment-1520569189, which intended that freedomofpress/kernel-builder#38 would ship in June. This is the intended behavior on our actual (as opposed to that intended) timeline.

rocodes commented 1 year ago

Spoke to @legoktm yesterday morning and he indicated that yes, this is the expected behaviour; apt itself now controls the number of kernels to protect, which is 2 most of the time, and that the number of kernels to be retained is not obviously configurable since it now lives in apt. So we'd either keep all of them, keep the number that apt suggests (2 generally, 3 while booting into the new kernel), or we'd have to mark a dependency on older kernels manually each time as we did with the 5.15.89 one, which seems clunky.

zenmonkeykstop commented 1 year ago

Nuc10:

script output... ``` Spectre and Meltdown mitigation detection tool v0.46 Checking for vulnerabilities on current system Kernel is Linux 5.15.131-1-grsec-securedrop #1 SMP @1309379017 x86_64 CPU is Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz Hardware check * Hardware support (CPU microcode) for mitigation techniques * Indirect Branch Restricted Speculation (IBRS) * SPEC_CTRL MSR is available:  YES  * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit) * Indirect Branch Prediction Barrier (IBPB) * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit) * Single Thread Indirect Branch Predictors (STIBP) * SPEC_CTRL MSR is available:  YES  * CPU indicates STIBP capability:  YES  (Intel STIBP feature bit) * Speculative Store Bypass Disable (SSBD) * CPU indicates SSBD capability:  YES  (Intel SSBD) * L1 data cache invalidation * CPU indicates L1D flush capability:  YES  (L1D flush feature bit) * Microarchitectural Data Sampling * VERW instruction is available:  YES  (MD_CLEAR feature bit) * Indirect Branch Predictor Controls * Indirect Predictor Disable feature is available:  NO  * Bottomless RSB Disable feature is available:  NO  * BHB-Focused Indirect Predictor Disable feature is available:  NO  * Enhanced IBRS (IBRS_ALL) * CPU indicates ARCH_CAPABILITIES MSR availability:  YES  * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  YES  * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO):  YES  * CPU explicitly indicates not being affected by Variant 4 (SSB_NO):  NO  * CPU/Hypervisor indicates L1D flushing is not necessary on this system:  YES  * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA):  NO  * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO):  YES  * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO):  NO  * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO):  NO  * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR):  NO  * CPU explicitly indicates being affected by GDS and having mitigation control (GDS_CTRL):  YES  * GDS microcode mitigation is disabled (GDS_MITG_DIS):  NO  * GDS microcode mitigation is locked in enabled state (GDS_MITG_LOCK):  NO  * CPU explicitly indicates not being affected by GDS (GDS_NO):  NO  * CPU supports Transactional Synchronization Extensions (TSX):  NO  * CPU supports Software Guard Extensions (SGX):  YES  * CPU supports Special Register Buffer Data Sampling (SRBDS):  YES  * CPU microcode is known to cause stability problems:  NO  (family 0x6 model 0x8e stepping 0xc ucode 0xf8 cpuid 0x806ec) * CPU microcode is the latest known available version:  YES  (latest version is 0xf8 dated 2023/02/26 according to builtin firmwares DB v273+i20230808+b6bd) * CPU vulnerability to the speculative execution attack variants * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass):  YES  * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES  * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  NO  * Affected by CVE-2018-3640 (Variant 3a, rogue system register read):  NO  * Affected by CVE-2018-3639 (Variant 4, speculative store bypass):  YES  * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  NO  * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  NO  * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  NO  * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)):  NO  * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)):  NO  * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)):  NO  * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)):  NO  * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)):  YES  * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)):  YES  * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)):  YES  * Affected by CVE-2023-20593 (Zenbleed, cross-process information leak):  NO  * Affected by CVE-2022-40982 (Downfall, gather data sampling (GDS)):  YES  * Affected by CVE-2023-20569 (Inception, return address security (RAS)):  NO  CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass' * Mitigated according to the /sys interface:  YES  (Mitigation: usercopy/swapgs barriers and __user pointer sanitization (complete, automated)) * Kernel has array_index_mask_nospec:  YES  (1 occurrence(s) found of x86 64 bits array_index_mask_nospec()) * Kernel has the Red Hat/Ubuntu patch:  NO  * Kernel has mask_nospec64 (arm64):  NO  * Kernel has array_index_nospec (arm64):  NO  > STATUS:  NOT VULNERABLE  (Mitigation: usercopy/swapgs barriers and __user pointer sanitization (complete, automated)) CVE-2017-5715 aka 'Spectre Variant 2, branch target injection' * Mitigated according to the /sys interface:  YES  (Mitigation: Enhanced / Automatic IBRS, IBPB: conditional, RSB filling, PBRSB-eIBRS: SW sequence) * Mitigation 1 * Kernel is compiled with IBRS support:  YES  * IBRS enabled and active:  YES  * Kernel is compiled with IBPB support:  YES  * IBPB enabled and active:  YES  * Mitigation 2 * Kernel has branch predictor hardening (arm):  NO  * Kernel compiled with retpoline option:  YES  * Kernel supports RSB filling:  YES  > STATUS:  NOT VULNERABLE  (IBRS + IBPB are mitigating the vulnerability) CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load' * Mitigated according to the /sys interface:  YES  (Not affected) * Kernel supports Page Table Isolation (PTI):  NO  * PTI enabled and active:  NO  * Reduced performance impact of PTI:  YES  (CPU supports INVPCID, performance impact of PTI will be greatly reduced) * Running as a Xen PV DomU:  NO  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-3640 aka 'Variant 3a, rogue system register read' * CPU microcode mitigates the vulnerability:  YES  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-3639 aka 'Variant 4, speculative store bypass' * Mitigated according to the /sys interface:  YES  (Mitigation: Speculative Store Bypass disabled via prctl) * Kernel supports disabling speculative store bypass (SSB):  YES  (found in /proc/self/status) * SSB mitigation is enabled and active:  YES  (per-thread through prctl) * SSB mitigation currently active for selected processes:  NO  (no process found using SSB mitigation through prctl) > STATUS:  NOT VULNERABLE  (Mitigation: Speculative Store Bypass disabled via prctl) CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault' * CPU microcode mitigates the vulnerability:  YES  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault' * Mitigated according to the /sys interface:  YES  (Mitigation: PTE Inversion) * Kernel supports PTE inversion:  YES  (found in kernel image) * PTE inversion enabled and active:  YES  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault' * Information from the /sys interface: Mitigation: PTE Inversion * This system is a host running a hypervisor:  NO  * Mitigation 1 (KVM) * EPT is disabled:  N/A  (the kvm_intel module is not loaded) * Mitigation 2 * L1D flush is supported by kernel:  YES  (found flush_l1d in /proc/cpuinfo) * L1D flush enabled:  UNKNOWN  (unrecognized mode) * Hardware-backed L1D flush supported:  YES  (performance impact of the mitigation will be greatly reduced) * Hyper-Threading (SMT) is enabled:  YES  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)' * Mitigated according to the /sys interface:  YES  (Not affected) * Kernel supports using MD_CLEAR mitigation:  YES  (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active:  NO  * SMT is either mitigated or disabled:  NO  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)' * Mitigated according to the /sys interface:  YES  (Not affected) * Kernel supports using MD_CLEAR mitigation:  YES  (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active:  NO  * SMT is either mitigated or disabled:  NO  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)' * Mitigated according to the /sys interface:  YES  (Not affected) * Kernel supports using MD_CLEAR mitigation:  YES  (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active:  NO  * SMT is either mitigated or disabled:  NO  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)' * Mitigated according to the /sys interface:  YES  (Not affected) * Kernel supports using MD_CLEAR mitigation:  YES  (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active:  NO  * SMT is either mitigated or disabled:  NO  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)' * Mitigated according to the /sys interface:  YES  (Not affected) * TAA mitigation is supported by kernel:  YES  (found tsx_async_abort in kernel image) * TAA mitigation enabled and active:  NO  > STATUS:  NOT VULNERABLE  (Not affected) CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)' * Mitigated according to the /sys interface:  UNKNOWN  (Processor vulnerable) * This system is a host running a hypervisor:  NO  * iTLB Multihit mitigation is supported by kernel:  YES  (found itlb_multihit in kernel image) * iTLB Multihit mitigation enabled and active:  NO  > STATUS:  NOT VULNERABLE  (this system is not running a hypervisor) CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)' * Mitigated according to the /sys interface:  YES  (Mitigation: Microcode) * SRBDS mitigation control is supported by the kernel:  YES  (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation) * SRBDS mitigation control is enabled and active:  YES  (Mitigation: Microcode) > STATUS:  VULNERABLE  (Your microcode and kernel are both up to date for SRBDS mitigation control. Mitigation is disabled) CVE-2023-20593 aka 'Zenbleed, cross-process information leak' * Zenbleed mitigation is supported by kernel:  YES  (found zenbleed message in kernel image) * Zenbleed kernel mitigation enabled and active:  N/A  (CPU is incompatible) * Zenbleed mitigation is supported by CPU microcode:  NO  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) CVE-2022-40982 aka 'Downfall, gather data sampling (GDS)' * Mitigated according to the /sys interface:  YES  (Mitigation: Microcode) * GDS is mitigated by microcode:  OK  (microcode mitigation is supported and enabled) * Kernel supports software mitigation by disabling AVX:  YES  (found gather_data_sampling in kernel image) * Kernel has disabled AVX as a mitigation:  NO  (AVX support is enabled) > STATUS:  NOT VULNERABLE  (Mitigation: Microcode) CVE-2023-20569 aka 'Inception, return address security (RAS)' * Mitigated according to the /sys interface:  YES  (Not affected) * Kernel supports mitigation:  YES  (found spec_rstack_overflow in kernel image) * Kernel compiled with SRSO support:  YES  * Kernel compiled with IBPB_ENTRY support:  YES  > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected) > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:KO CVE-2023-20593:OK CVE-2022-40982:OK CVE-2023-20569:OK Need more detailed information about mitigation options? Use --explain A false sense of security is worse than no security at all, see --disclaimer ```
zenmonkeykstop commented 1 year ago

Nuc8:

cfm commented 1 year ago

Thanks, @zenmonkeykstop. Re: (cleaned up):

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Microcode)
* SRBDS mitigation control is supported by the kernel: YES (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active: YES (Mitigation: Microcode)
STATUS: VULNERABLE (Your microcode and kernel are both up to date for SRBDS mitigation control. Mitigation is disabled)

I don't understand how mitigation control is enabled and Mitigation is disabled can both be true.

Can you rerun meltdown.sh -v -v -v on the previous kernel and then again on this one, to isolate whether this result is (a) a kernel flaw or (b) an instrumentation bug on your NUC10 hardware (per https://github.com/speed47/spectre-meltdown-checker/issues/472#issuecomment-1678651753)?

zenmonkeykstop commented 12 months ago

Looks like this is indeed an issue with the checker script. Confirmed as requested. Good to go

nathandyer commented 12 months ago

NUC12