2018.7.25 追記
実行結果のサンプルについては、Fedora 確認方法 – 近代的CPUの脆弱性も併せてご参照ください。
目次
確認方法
まず、Ubuntu の確認方法同様に dmesg と proc/cpuinfo を利用して確認してみます。
base on kernel - How to check that KPTI is enabled on my Ubuntu? - Ask Ubuntu
- /proc/cpuinfo
grep -q "cpu_insecure|cpu_meltdown|kaiser" /proc/cpuinfo && echo "patched :)" || echo "unpatched :("- dmesg
dmesg | grep -q "Kernel/User page tables isolation: enabled" && echo "patched :)" || echo "unpatched :("
確認環境
Spec | Details |
---|---|
Product | Banana Pi M1 Classic |
OS | Armbian 5.38 |
Soc | Allwinner A20 / Dual-Core ARM Cortex-A7 @ 1.0GHz |
MEM | 1GB |
# cat /etc/issue
Debian GNU/Linux 9 \n \l
# cat /etc/debian_version
9.4
# cat /proc/version
Linux version 4.14.18-sunxi (root@xeon) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #24 SMP Fri Feb 9 16:24:32 CET 2018
実行サンプル
# dmesg | grep -q "Kernel/User page tables isolation: enabled" && echo "patched :)" || echo "unpatched :("
unpatched :(
# grep -q "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" || echo "unpatched :("
unpatched :(
# ls -lh /sys/devices/system/cpu/vulnerabilities/
ls: '/sys/devices/system/cpu/vulnerabilities/' にアクセスできません: そのようなファイルやディレクトリはありません
先日の記事にも記載しましたが、OSが 32bit なので物の見事に全てNGになっています。
公式方法での確認
Debian 9 以降は、脆弱性の判断ツール Debian Package Tracker - spectre-meltdown-checker が使えます。
# sudo apt install -t stretch-backports spectre-meltdown-checker
以下のパッケージが新たにインストールされます:
spectre-meltdown-checker
# sudo spectre-meltdown-checker
Spectre and Meltdown mitigation detection tool v0.37
Checking for vulnerabilities on current system
Kernel is Linux 4.14.18-sunxi #24 SMP Fri Feb 9 16:24:32 CET 2018 armv7l
CPU is ARM v7 model 0xc07
Hardware check
* CPU vulnerability to the three speculative execution attack variants
* Vulnerable to Variant 1: NO
* Vulnerable to Variant 2: NO
* Vulnerable to Variant 3: NO
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Kernel has array_index_mask_nospec (x86): NO
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm): NO
* Checking count of LFENCE instructions following a jump in kernel... NO (only 0 jump-then-lfence instructions found, should be >= 30 (heuristic))
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
* Kernel is compiled with IBRS support: NO
* IBRS enabled and active: UNKNOWN
* Kernel is compiled with IBPB support: NO
* IBPB enabled and active: NO
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: NO
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI): NO
* PTI enabled and active: NO
* Reduced performance impact of PTI: NO (PCID/INVPCID not supported, performance impact of PTI will be significant)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)
A false sense of security is worse than no security at all, see --disclaimer
上記、実行サンプルと同様に軒並みNGになっています。
当たり前ですね...。