Linux Looks To Change The Default For Some Of Its Spectre Mitigations

[phoronix]

Phoronix: Linux Looks To Change The Default For Some Of Its Spectre Mitigations

Upstream Linux kernel developers are looking at changing some of their Spectre mitigation defaults around what's applied to SECCOMP threads by default in part due to the performance hit as well as other reasons...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-Spectre-SECCOMP-Default

[horizonbrave]

I wonder who design this adorable vulnerabilitiy mascottes/logos? So cute!
I also wonder how safer is to use a ryzen system instead.. I guess depends which generation and perhaps there's no clear answer

[elatllat]

I wonder who design this adorable vulnerabilitiy mascottes/logos? So cute!
I also wonder how safer is to use a ryzen system instead.. I guess depends which generation and perhaps there's no clear answer

Clear answer;

C4> uname -r && cd /sys/devices/system/cpu/vulnerabilities && grep . *
5.7.0-odroid-arm64
itlb_multihit:Not affected
l1tf:Not affected
mds:Not affected
meltdown:Not affected
spec_store_bypass:Not affected
spectre_v1:Mitigation: __user pointer sanitization
spectre_v2:Not affected
tsx_async_abort:Not affected 

11th gen intel vs whatever inconsistent AMD naming is current are similarly more vulnerable than the less speculative ARM options. Phoronix will sometimes list mitigations in the details at the begining of the article for your comparative pleasure.

Rpi is slow or vulnerable;
https://openbenchmarking.org/embed.p...01ba9d9c39&p=2

Intel is vulnerable but at least has good linux support;
https://openbenchmarking.org/embed.p...72af9a1e27&p=2

AMD is vulnerable but at least is fast;

https://openbenchmarking.org/embed.php?i=2005169-NI-RENOIR20265&sha=cc4b260&p=2

.

[ix900]

I also wonder how safer is to use a ryzen system instead.. I guess depends which generation and perhaps there's no clear answer

If you buy a CPU based on thinking its safer, tomorrow it might not be, a year later it might be once again. There's no guarantees. Up until the flaws were made public, everyone thought there wasn't any problem at all. So just pick something that works for you and enjoy.

[Azrael5]

Which CPus will be affected?

[c2p_]

Clear answer;

C4> uname -r && cd /sys/devices/system/cpu/vulnerabilities && grep . *
5.7.0-odroid-arm64
itlb_multihit:Not affected
l1tf:Not affected
mds:Not affected
meltdown:Not affected
spec_store_bypass:Not affected
spectre_v1:Mitigation: __user pointer sanitization
spectre_v2:Not affected
tsx_async_abort:Not affected 

11th gen intel vs whatever inconsistent AMD naming is current are similarly more vulnerable than the less speculative ARM options. Phoronix will sometimes list mitigations in the details at the begining of the article for your comparative pleasure.

Rpi is slow or vulnerable;
https://openbenchmarking.org/embed.p...01ba9d9c39&p=2

Intel is vulnerable but at least has good linux support;
https://openbenchmarking.org/embed.p...72af9a1e27&p=2

AMD is vulnerable but at least is fast;

https://openbenchmarking.org/embed.php?i=2005169-NI-RENOIR20265&sha=cc4b260&p=2

.

You could check with https://github.com/speed47/spectre-meltdown-checker
For Ryzen 5 2600 gives me:

[FONT=monospace][COLOR=#000000]Spectre and Meltdown mitigation detection tool v0.43-21-g9e87439 [/COLOR]

Checking for vulnerabilities on current system
Kernel is [COLOR=#b218b2]Linux 5.3.0-64-generic #58-Ubuntu SMP Fri Jul 10 19:33:51 UTC 2020 x86_64[/COLOR]
CPU is [COLOR=#b218b2]AMD Ryzen 5 2600 Six-Core Processor[/COLOR]

[COLOR=#5454ff][B]Hardware check[/B][/COLOR]
* Hardware support (CPU microcode) for mitigation techniques
 * Indirect Branch Restricted Speculation (IBRS)
   * SPEC_CTRL MSR is available: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates IBRS capability: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates preferring IBRS always-on: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates preferring IBRS over retpoline: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Indirect Branch Prediction Barrier (IBPB)
   * PRED_CMD MSR is available: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates IBPB capability: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (IBPB_SUPPORT feature bit) [/COLOR]
 * Single Thread Indirect Branch Predictors (STIBP)
   * SPEC_CTRL MSR is available: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates STIBP capability: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates preferring STIBP always-on: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Speculative Store Bypass Disable (SSBD)
   * CPU indicates SSBD capability: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (AMD non-architectural MSR) [/COLOR]
 * L1 data cache invalidation
   * FLUSH_CMD MSR is available: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
   * CPU indicates L1D flush capability: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * CPU supports Transactional Synchronization Extensions (TSX): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * CPU supports Software Guard Extensions (SGX): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * CPU supports Special Register Buffer Data Sampling (SRBDS): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * CPU microcode is known to cause stability problems: [COLOR=#000000] NO [/COLOR][COLOR=#000000] (family 0x17 model 0x8 stepping 0x2 ucode 0x800820d cpuid 0x800f82) [/COLOR]
 * CPU microcode is the latest known available version: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (latest version is 0x800820d dated 2019/04/16 according to builtin firmwares DB v163.20200930+i20200904) [/COLOR]
* CPU vulnerability to the speculative execution attack variants
 * Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Vulnerable to CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]

[COLOR=#5454ff][B]CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) [/COLOR]
* Kernel has array_index_mask_nospec: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (1 occurrence(s) found of x86 64 bits array_index_mask_nospec()) [/COLOR]
* Kernel has the Red Hat/Ubuntu patch: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* Kernel has mask_nospec64 (arm64): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* Kernel has array_index_nospec (arm64): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) [/COLOR]

[COLOR=#5454ff][B]CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Mitigation: Full AMD retpoline, IBPB: conditional, STIBP: disabled, RSB filling) [/COLOR]
* Mitigation 1
 * Kernel is compiled with IBRS support: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
   * IBRS enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Kernel is compiled with IBPB support: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
   * IBPB enabled and active: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
* Mitigation 2
 * Kernel has branch predictor hardening (arm): [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Kernel compiled with retpoline option: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
   * Kernel compiled with a retpoline-aware compiler: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (kernel reports full retpoline compilation) [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (Full retpoline + IBPB are mitigating the vulnerability) [/COLOR]

[COLOR=#5454ff][B]CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* Kernel supports Page Table Isolation (PTI): [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
 * PTI enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Reduced performance impact of PTI: [COLOR=#000000] NO [/COLOR][COLOR=#000000] (PCID/INVPCID not supported, performance impact of PTI will be significant) [/COLOR]
* Running as a Xen PV DomU: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-3640 aka 'Variant 3a, rogue system register read'[/B][/COLOR]
* CPU microcode mitigates the vulnerability: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-3639 aka 'Variant 4, speculative store bypass'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) [/COLOR]
* Kernel supports disabling speculative store bypass (SSB): [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found in /proc/self/status) [/COLOR]
* SSB mitigation is enabled and active: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (per-thread through prctl) [/COLOR]
* SSB mitigation currently active for selected processes: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (firefox-bin haveged irqbalance ModemManager pulseaudio systemd-journald systemd-logind systemd-timesyncd systemd-ud[/COLOR]
evd upowerd uuidd)
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'[/B][/COLOR]
* CPU microcode mitigates the vulnerability: [COLOR=#000000] N/A [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* Kernel supports PTE inversion: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found in kernel image) [/COLOR]
* PTE inversion enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'[/B][/COLOR]
* Information from the /sys interface: Not affected
* This system is a host running a hypervisor: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* Mitigation 1 (KVM)
 * EPT is disabled: [COLOR=#000000] N/A [/COLOR][COLOR=#000000] (the kvm_intel module is not loaded) [/COLOR]
* Mitigation 2
 * L1D flush is supported by kernel: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found flush_l1d in kernel image) [/COLOR]
 * L1D flush enabled: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
 * Hardware-backed L1D flush supported: [COLOR=#000000] NO [/COLOR][COLOR=#000000] (flush will be done in software, this is slower) [/COLOR]
 * Hyper-Threading (SMT) is enabled: [COLOR=#000000] YES [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* Kernel supports using MD_CLEAR mitigation: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found md_clear implementation evidence in kernel image) [/COLOR]
* Kernel mitigation is enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* SMT is either mitigated or disabled: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* Kernel supports using MD_CLEAR mitigation: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found md_clear implementation evidence in kernel image) [/COLOR]
* Kernel mitigation is enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* SMT is either mitigated or disabled: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* Kernel supports using MD_CLEAR mitigation: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found md_clear implementation evidence in kernel image) [/COLOR]
* Kernel mitigation is enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* SMT is either mitigated or disabled: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* Kernel supports using MD_CLEAR mitigation: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found md_clear implementation evidence in kernel image) [/COLOR]
* Kernel mitigation is enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* SMT is either mitigated or disabled: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* TAA mitigation is supported by kernel: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found tsx_async_abort in kernel image) [/COLOR]
* TAA mitigation enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* This system is a host running a hypervisor: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
* iTLB Multihit mitigation is supported by kernel: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found itlb_multihit in kernel image) [/COLOR]
* iTLB Multihit mitigation enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

[COLOR=#5454ff][B]CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'[/B][/COLOR]
* Mitigated according to the /sys interface: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (Not affected) [/COLOR]
* SRBDS mitigation control is supported by the kernel: [COLOR=#000000] YES [/COLOR][COLOR=#000000] (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation) [/COLOR]
* SRBDS mitigation control is enabled and active: [COLOR=#000000] NO [/COLOR][COLOR=#000000] [/COLOR]
> [COLOR=#000000]STATUS:[/COLOR][COLOR=#000000] NOT VULNERABLE [/COLOR][COLOR=#000000] (your CPU vendor reported your CPU model as not vulnerable) [/COLOR]

> [COLOR=#000000]SUMMARY:[/COLOR][COLOR=#000000]CVE-2017-5753:OK[/COLOR][COLOR=#000000]CVE-2017-5715:OK[/COLOR][COLOR=#000000]CVE-2017-5754:OK[/COLOR][COLOR=#000000]CVE-2018-3640:OK[/COLOR][COLOR=#000000]CVE-2018-3639:OK[/COLOR][COLOR=#000000]CVE-2018-3615:OK[/COLOR][COLOR=#000000]CVE-2018-3620:OK[/COLOR][COLOR=#000000]CVE-2018-3646:OK[/COLOR][COLOR=#000000]CVE-2018-12126:OK[/COLOR][COLOR=#000000]CVE-2018-12130:[/COLOR]
OK[COLOR=#000000]CVE-2018-12127:OK[/COLOR][COLOR=#000000]CVE-2019-11091:OK[/COLOR][COLOR=#000000]CVE-2019-11135:OK[/COLOR][COLOR=#000000]CVE-2018-12207:OK[/COLOR][COLOR=#000000]CVE-2020-0543:OK                                                                                         [/COLOR][COLOR=#000000] [/COLOR]

Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer[/FONT]

[elatllat]

...spectre-meltdown-checker...

Was useful before /sys/devices/system/cpu/vulnerabilities was implemented, less so now.
I have had to fix a few bugs in spectre-meltdown-checker so I consider it somewhat unreliable.
I also think it's less useful because it's less concise.

[c2p_]

Was useful before /sys/devices/system/cpu/vulnerabilities was implemented, less so now.
I have had to fix a few bugs in spectre-meltdown-checker so I consider it somewhat unreliable.
I also think it's less useful because it's less concise.

TIL it exists, thanks. Output is more readable

itlb_multihit:Not affected
l1tf:Not affected
mds:Not affected
meltdown:Not affected
spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl and seccomp
spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
spectre_v2:Mitigation: Full AMD retpoline, IBPB: conditional, STIBP: disabled, RSB filling
srbds:Not affected
tsx_async_abort:Not affected

[Jabberwocky]

Clear answer;

/sys/devices/system/cpu/vulnerabilities

I want to cry when I read answers like this. This is wrong on so many different levels. That is not a clear nor correct answer!!!

[elatllat]

I want to cry when I read answers like this. This is wrong on so many different levels. That is not a clear nor correct answer!!!

Are you trolling or are you planning on convincing us (but accidentally pressed post before you could)?