LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-26-2022, 01:58 PM   #1
pinguin20
Member
 
Registered: Jan 2022
Posts: 36

Rep: Reputation: 0
Does my microcode need to be updated?


When i run ''sudo dmesg | grep microcode'' i get this:

[ 0.000000] microcode: microcode updated early to revision 0x7, date = 2018-04-23
[ 0.294848] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
[ 2.452489] microcode: sig=0x20655, pf=0x2, revision=0x7
[ 2.469715] microcode: Microcode Update Driver: v2.2.

Does anyone know if everything is okay with my microcode? What does it mean when it says ''MDS: Vulnerable: Clear CPU buffers attempted, no microcode''? Is something wrong?
 
Old 01-26-2022, 02:37 PM   #2
shruggy
Senior Member
 
Registered: Mar 2020
Posts: 3,670

Rep: Reputation: Disabled
Quote:
Originally Posted by pinguin20 View Post
What does it mean when it says ''MDS: Vulnerable: Clear CPU buffers attempted, no microcode''?
Let it show a bit of context, and you'll see
Code:
$dmesg|grep -B4 MDS:
[    0.275957] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[    0.275959] Spectre V2 : Mitigation: Full generic retpoline
[    0.275959] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
[    0.275960] Speculative Store Bypass: Vulnerable
[    0.275964] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
Code:
$ sudo spectre-meltdown-checker|grep MDS_NO
  * CPU explicitly indicates not being vulnerable to Microarchitectural Data Sampling (MDS_NO):  NO
Code:
$ sudo spectre-meltdown-checker --explain --variant msbds|grep -wA5 aka
CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active:  NO
* SMT is either mitigated or disabled:  YES
> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

Last edited by shruggy; 01-26-2022 at 03:00 PM.
 
Old 01-26-2022, 02:55 PM   #3
pinguin20
Member
 
Registered: Jan 2022
Posts: 36

Original Poster
Rep: Reputation: 0
The ''sudo dmesg|grep -B4 MDS'' command shows me this:

[ 0.294830] Spectre V2 : Enabling Restricted Speculation for firmware calls
[ 0.294834] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 0.294838] Spectre V2 : User space: Mitigation: STIBP via seccomp and prctl
[ 0.294841] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl and seccomp
[ 0.294848] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
--
[ 0.405665] NMI watchdog: Enabled. Permanently consumes one hw-PMU counter.
[ 0.405851] smp: Bringing up secondary CPUs ...
[ 0.405984] x86: Booting SMP configuration:
[ 0.405988] .... node #0, CPUs: #1
[ 0.406455] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/late...-vuln/mds.html for more details.

When I run ''sudo spectre-meltdown-checker|grep MDS_NO'' terminal tells me that this command doesn't exist
 
Old 01-26-2022, 03:03 PM   #4
shruggy
Senior Member
 
Registered: Mar 2020
Posts: 3,670

Rep: Reputation: Disabled
Quote:
Originally Posted by pinguin20 View Post
[ 0.406455] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/late...-vuln/mds.html for more details.
Have a look at that link.

Quote:
Originally Posted by pinguin20 View Post
When I run ''sudo spectre-meltdown-checker|grep MDS_NO'' terminal tells me that this command doesn't exist
Install the package spectre-meltdown-checker.
 
Old 01-26-2022, 03:05 PM   #5
pinguin20
Member
 
Registered: Jan 2022
Posts: 36

Original Poster
Rep: Reputation: 0
The ''sudo spectre-meltdown-checker --explain --variant msbds|grep -wA5 aka'' doens't exist as well. My distro is OpenSUSE Leap 15.3
 
Old 01-26-2022, 03:11 PM   #6
shruggy
Senior Member
 
Registered: Mar 2020
Posts: 3,670

Rep: Reputation: Disabled
I'm pretty much sure spectre-meltdown-checker does exist in OpenSUSE Leap 15.3. Install it.

Last edited by shruggy; 01-26-2022 at 03:33 PM.
 
Old 01-26-2022, 03:13 PM   #7
pinguin20
Member
 
Registered: Jan 2022
Posts: 36

Original Poster
Rep: Reputation: 0
Ok it seems to be working now, but i used instead ''sudo spectre-meltdown-checker.sh'' command and it gave me this:

Spectre and Meltdown mitigation detection tool v0.44

Checking for vulnerabilities on current system
Kernel is Linux 5.3.18-150300.59.43-preempt #1 SMP PREEMPT Sun Jan 23 19:27:23 UTC 2022 (c76af22) x86_64
CPU is Intel(R) Core(TM) i3 CPU 540 @ 3.07GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: YES
* CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: YES
* CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: YES
* CPU indicates STIBP capability: YES (Intel STIBP feature bit)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: YES (Intel SSBD)
* L1 data cache invalidation
* FLUSH_CMD MSR is available: YES
* CPU indicates L1D flush capability: YES (L1D flush feature bit)
* Microarchitectural Data Sampling
* VERW instruction is available: NO
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: NO
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
* CPU explicitly indicates not being vulnerable to Meltdown/L1TF (RDCL_NO): NO
* CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): NO
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: NO
* Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): NO
* CPU explicitly indicates not being vulnerable to Microarchitectural Data Sampling (MDS_NO): NO
* CPU explicitly indicates not being vulnerable to TSX Asynchronous Abort (TAA_NO): NO
* CPU explicitly indicates not being vulnerable to iTLB Multihit (PSCHANGE_MSC_NO): NO
* CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): NO
* CPU supports Transactional Synchronization Extensions (TSX): NO
* CPU supports Software Guard Extensions (SGX): NO
* CPU supports Special Register Buffer Data Sampling (SRBDS): NO
* CPU microcode is known to cause stability problems: NO (family 0x6 model 0x25 stepping 0x5 ucode 0x7 cpuid 0x20655)
* CPU microcode is the latest known available version: YES (latest version is 0x7 dated 2018/04/23 according to builtin firmwares DB v165.20201021+i20200616)
* CPU vulnerability to the speculative execution attack variants
* Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
* Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
* Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
* Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
* Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
* Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO
* Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
* Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES
* Vulnerable to CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): YES
* Vulnerable to CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): YES
* Vulnerable to CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): YES
* Vulnerable to CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): YES
* Vulnerable to CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO
* Vulnerable to CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES
* Vulnerable to CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
* Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
* Kernel has array_index_nospec (arm64): NO
> STATUS: NOT VULNERABLE (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: YES (for firmware code only)
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports PCID, performance impact of PTI will be reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: YES
> STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
* SSB mitigation is enabled and active: YES (per-thread through prctl)
* SSB mitigation currently active for selected processes: YES (bwrap gconf-helper ModemManager pipewire pipewire-media-session pulseaudio systemd-hostnamed systemd-journald systemd-logind udevadm upowerd)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability: N/A
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
* Kernel supports PTE inversion: YES (found in kernel image)
* PTE inversion enabled and active: YES
> STATUS: NOT VULNERABLE (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor: NO
* Mitigation 1 (KVM)
* EPT is disabled: NO
* Mitigation 2
* L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: YES (conditional flushes)
* Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: YES
> STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: NO
* SMT is either mitigated or disabled: NO
> STATUS: VULNERABLE (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: NO
* SMT is either mitigated or disabled: NO
> STATUS: VULNERABLE (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: NO
* SMT is either mitigated or disabled: NO
> STATUS: VULNERABLE (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* Mitigated according to the /sys interface: NO (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: YES (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: NO
* SMT is either mitigated or disabled: NO
> STATUS: VULNERABLE (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'
* Mitigated according to the /sys interface: YES (Not affected)
* TAA mitigation is supported by kernel: YES (found tsx_async_abort in kernel image)
* TAA mitigation enabled and active: NO
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'
* Mitigated according to the /sys interface: YES (KVM: Mitigation: VMX disabled)
* This system is a host running a hypervisor: NO
* iTLB Multihit mitigation is supported by kernel: YES (found itlb_multihit in kernel image)
* iTLB Multihit mitigation enabled and active: YES (KVM: Mitigation: VMX disabled)
> STATUS: NOT VULNERABLE (this system is not running a hypervisor)

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
* Mitigated according to the /sys interface: YES (Not affected)
* SRBDS mitigation control is supported by the kernel: YES (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active: NO
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK

Last edited by pinguin20; 01-26-2022 at 03:18 PM.
 
Old 01-26-2022, 03:22 PM   #8
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,126

Rep: Reputation: 1260Reputation: 1260Reputation: 1260Reputation: 1260Reputation: 1260Reputation: 1260Reputation: 1260Reputation: 1260Reputation: 1260
Lines can be intermixed in kernel messages. The "microcode:" lines are coming from intel.c which is telling you the microcode version that is installed. The "MDS:" lines from bugs.c is telling you what mitigation for the recent Spectre, etc. bugs is active. Pretty much all recent Intel CPUs are vulnerable. I think it says the mitigation is being done in software rather than in microcode, but not sure. To look for a warning do:
Code:
dmesg |grep 'CPU bug present and SMT on, data leak possible'
Even if you have the warning, it is mostly an issue if you are hosting an untrusted VM on your system or running untrusted code. There are many easier ways to a attack a system than Spectre and Meltdown.
 
Old 01-26-2022, 03:25 PM   #9
pinguin20
Member
 
Registered: Jan 2022
Posts: 36

Original Poster
Rep: Reputation: 0
When i run ''dmesg |grep 'CPU bug present and SMT on, data leak possible'' it shows me this:

[ 0.406455] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/late...-vuln/mds.html for more details.
 
Old 01-26-2022, 03:25 PM   #10
shruggy
Senior Member
 
Registered: Mar 2020
Posts: 3,670

Rep: Reputation: Disabled
Quote:
Originally Posted by pinguin20 View Post
* CPU microcode is known to cause stability problems: NO (family 0x6 model 0x25 stepping 0x5 ucode 0x7 cpuid 0x20655)
* CPU microcode is the latest known available version: YES (latest version is 0x7 dated 2018/04/23 according to builtin firmwares DB v165.20201021+i20200616)
Quote:
Does anyone know if everything is okay with my microcode?
Seems so.
 
Old 01-26-2022, 03:28 PM   #11
pinguin20
Member
 
Registered: Jan 2022
Posts: 36

Original Poster
Rep: Reputation: 0
Then I don't need to update it?
 
Old 01-26-2022, 03:30 PM   #12
shruggy
Senior Member
 
Registered: Mar 2020
Posts: 3,670

Rep: Reputation: Disabled
You cannot. It is already at the latest available version for your CPU.
 
1 members found this post helpful.
Old 01-27-2022, 12:03 PM   #13
obobskivich
Member
 
Registered: Jun 2020
Posts: 596

Rep: Reputation: Disabled
Quote:
Originally Posted by smallpond View Post
Lines can be intermixed in kernel messages. The "microcode:" lines are coming from intel.c which is telling you the microcode version that is installed. The "MDS:" lines from bugs.c is telling you what mitigation for the recent Spectre, etc. bugs is active. Pretty much all recent Intel CPUs are vulnerable.
To clarify: recent Intel CPUs have rolled out hardware fixes for many of the 'side channel' vulnerabilities (starting mostly with 9th gen) - this is a much older CPU in question, and the older ones tended to be less patched (they also may not have as many vulnerabilities - e.g. if they lack SGX). Intel did release updated microcode for everything going back to around ~2009 initially, but quickly abandoned multiple entire architectural families and motherboard makers/system integrators (with mostly the sole exception of Apple) largely ignored/abandoned their customers on these patches across the board, which has made the roll-out of updates very inconsistent. Linux will load the updated microcode at startup, which broadly achieves the same end result, assuming there's updated microcode to be had.

Quote:
Even if you have the warning, it is mostly an issue if you are hosting an untrusted VM on your system or running untrusted code. There are many easier ways to a attack a system than Spectre and Meltdown.
This message is not related to Spectre or Meltdown, it is related to MDS:
https://en.wikipedia.org/wiki/Microa..._Data_Sampling

The firmware/microcode patches available from Intel for this are not available for the CPU in question (it is considered too old). Whether or not this is of concern really depends on individual use-case, but I would both disagree with the hand-waving 'there are easier ways to attack so ignore this' AND the 'throw everything Intel into the sea they're swiss cheese' generalizations that have come out of the 'side channel exploit' paper mills of late. 'Running untrusted code' is so vague these days (do you personally audit every line of code you run on a modern system? does anyone? can anyone?) - unfortunately there's just not a great answer on a case-by-case basis for if people should consider upgrading or not. FWIW, Intel considered all of these problems significant enough to fix them (in hardware) in recent releases, and even client-focused vendors like Apple pushed patches as well, so probably it isn't a bad idea to patch where possible, but on the other hand I'm not sure burning down every PC older than ~2 years is wise either. YMMV.
 
Old 02-18-2023, 08:43 AM   #14
camerabambai
Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 406

Rep: Reputation: 54
Unfortunately seems olders cpu are not patched.
Maybe is possible in the future the kernel will patch for old intel's cpu?
 
  


Reply

Tags
mds


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: ZFS On Linux 0.8 Released, BlackArch Linux 2019.06.01 Now Available, Canonical Releases Updated intel-microcode Firmware, Peppermint 1 LXer Syndicated Linux News 0 05-24-2019 03:03 PM
Updated to the latest Intel microcode, but still vulnerable to one variant. john2x Slackware 21 08-09-2018 05:38 PM
Apply new Intel microcode- no microcode.dat file Naks110 Linux - Kernel 2 06-12-2018 05:20 PM
[SOLVED] Updated recent intel microcode firmware through update manager, now cannot boot linux mint 18.3 Chripcikas Linux - Newbie 60 01-23-2018 11:16 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 05:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration