スペクターとメルトダウンのシェルスクリプト簡易チェッカーがあったので試してみた
speed47/spectre-meltdown-checker: Spectre & Meltdown vulnerability/mitigation checker for Linux
https://github.com/speed47/spectre-meltdown-checker
何か実行して調べるわけではなく、いろんなパラメータから状態を調べるだけのよう。
ダウンロードして実行してみる。
さくらのクラウド
ターゲットは、まだ対策がされていない"さくらのクラウド"でのインスタンス。
ダウンロードして実行権限を与える。
ubuntu@psv:~/test$ wget https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh --2018-01-16 13:33:29-- https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.228.133 Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.228.133|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 36439 (36K) [text/plain] Saving to: ‘spectre-meltdown-checker.sh’ spectre-meltdown-ch 100%[===================>] 35.58K --.-KB/s in 0.03s 2018-01-16 13:33:29 (1.26 MB/s) - ‘spectre-meltdown-checker.sh’ saved [36439/36439] ubuntu@psv:~/test$ chmod +x spectre-meltdown-checker.sh
rootで実行しろってことだけど、ユーザー権限でもある程度はわかる。
ubuntu@psv:~/test$ ./spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.31 Note that you should launch this script with root privileges to get accurate information. We'll proceed but you might see permission denied errors. To run it as root, you can try the following command: sudo ./spectre-meltdown-checker.sh Checking for vulnerabilities against running kernel Linux 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 12 14:59:54 UTC 2017 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied ./spectre-meltdown-checker.sh: 1: ./spectre-meltdown-checker.sh: cannot open /boot/vmlinuz-4.4.0-96-generic: Permission denied CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: UNKNOWN > STATUS: UNKNOWN (couldn't check (couldn't extract your kernel from /boot/vmlinuz-4.4.0-96-generic)) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: UNKNOWN (couldn't read /dev/cpu/0/msr, is msr support enabled in your kernel?) * The SPEC_CTRL CPUID feature bit is set: UNKNOWN (couldn't read /dev/cpu/0/cpuidr, is cpuid support enabled in your kernel?) * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Checking if we're running under Xen PV (64 bits): NO > STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
rootでやってみる。
ubuntu@psv:~/test$ sudo ./spectre-meltdown-checker.sh [sudo] password for ubuntu: Spectre and Meltdown mitigation detection tool v0.31 Checking for vulnerabilities against running kernel Linux 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 12 14:59:54 UTC 2017 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: NO > STATUS: VULNERABLE (only 33 opcodes found, should be >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Checking if we're running under Xen PV (64 bits): NO > STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
リアルな表示は、エスケープシーケンでカラフルになっているから、もっとわかりやすいよ。
対策はされていない。
ubuntu@psv:~$ uname -a Linux psv 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 12 14:59:54 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
ubuntu@psv:~$ sudo apt-get update ubuntu@psv:~$ sudo apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages have been kept back: libdrm-amdgpu1 libdrm2 libegl1-mesa libgbm1 libgl1-mesa-dri libwayland-egl1-mesa linux-generic linux-headers-generic linux-image-generic The following packages will be upgraded: libgdk-pixbuf2.0-0 libgdk-pixbuf2.0-common ubuntu-mono 3 upgraded, 0 newly installed, 0 to remove and 9 not upgraded. Need to get 346 kB of archives. After this operation, 0 B of additional disk space will be used. Do you want to continue? [Y/n] y (snip)
xenial-updates/mainにも、xenial-security/mainにも、対策パッケージは来ていないようだ。
AWS
AWSでもやってみようかな。
$ sudo ./spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.31 Checking for vulnerabilities against running kernel Linux 4.4.0-1039-aws #48-Ubuntu SMP Wed Oct 11 15:15:01 UTC 2017 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: NO > STATUS: VULNERABLE (only 33 opcodes found, should be >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Checking if we're running under Xen PV (64 bits): NO > STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
EC2の中身までは責任の範囲外で、自分でやれってことね。
パッケージアップデートして再起動。
$ sudo apt-get update $ sudo apt-get upgrade Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages were automatically installed and are no longer required: linux-aws-headers-4.4.0-1028 linux-aws-headers-4.4.0-1035 linux-aws-headers-4.4.0-1038 linux-aws-headers-4.4.0-1041 linux-aws-headers-4.4.0-1043 linux-aws-headers-4.4.0-1044 linux-headers-4.4.0-1028-aws linux-headers-4.4.0-1035-aws linux-headers-4.4.0-1038-aws linux-headers-4.4.0-1041-aws linux-headers-4.4.0-1043-aws linux-headers-4.4.0-1044-aws linux-image-4.4.0-1028-aws linux-image-4.4.0-1035-aws linux-image-4.4.0-1038-aws linux-image-4.4.0-1041-aws linux-image-4.4.0-1043-aws linux-image-4.4.0-1044-aws Use 'sudo apt autoremove' to remove them. The following packages have been kept back: libdrm2 The following packages will be upgraded: grub-common grub-pc grub-pc-bin grub2-common libseccomp2 squashfs-tools unattended-upgrades 7 upgraded, 0 newly installed, 0 to remove and 1 not upgraded. Need to get 3,477 kB of archives. After this operation, 28.7 kB of additional disk space will be used. Do you want to continue? [Y/n] y (snip) $ sudo reboot
AWSのは独自パッケージのようだ。
そんなに新しくないな。
$ uname -a Linux ip-xxx-xxx-xxx-xxx 4.4.0-1048-aws #57-Ubuntu SMP Tue Jan 9 21:45:57 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
実行する。
$ sudo ./spectre-meltdown-checker.sh Spectre and Meltdown mitigation detection tool v0.31 Checking for vulnerabilities against running kernel Linux 4.4.0-1048-aws #57-Ubuntu SMP Tue Jan 9 21:45:57 UTC 2018 x86_64 CPU is Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Checking count of LFENCE opcodes in kernel: NO > STATUS: VULNERABLE (only 35 opcodes found, should be >= 70, heuristic to be improved when official patches become available) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigation 1 * Hardware (CPU microcode) support for mitigation * The SPEC_CTRL MSR is available: YES * The SPEC_CTRL CPUID feature bit is set: NO * Kernel support for IBRS: NO * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * Mitigation 2 * Kernel compiled with retpoline option: NO * Kernel compiled with a retpoline-aware compiler: NO > STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Kernel supports Page Table Isolation (PTI): YES * PTI enabled and active: YES * Checking if we're running under Xen PV (64 bits): NO > STATUS: NOT VULNERABLE (PTI mitigates the vulnerability) A false sense of security is worse than no security at all, see --disclaimer
スペクターは未対策。
メルトダウンの対策がされたのはわかった。
