something is wrong with the Fedora "l1tf" patches

[Reindl Harald]

* Di Aug 14 2018 Justin M. Forbes <jforbes(a)fedoraproject.org&gt; - 4.17.14-101
- Fix "Foreshadow" CVE-2018-3620 CVE-2018-3646 (rhbz 1585005 1615998)

-----

CentOS 6: 2.6.32-754.3.5.el6.x86_64
[root@honeypot:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion
/sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
Speculative Store Bypass disabled via prctl
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: Load fences
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Vulnerable: Retpoline
with unsafe module(s), IBPB

-----

CentOS 7: 3.10.0-862.11.6.el7.x86_64

[root@hosting:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion
/sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
Speculative Store Bypass disabled via prctl and seccomp
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: Load
fences, __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full
retpoline

-----

Fedora 27/28: 4.17.14-(1|2)01.fc2(7|8).x86_64

[root@master:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
Speculative Store Bypass disabled via prctl and seccomp
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user
pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full
generic retpoline, IBPB, IBRS_FW

[Laura Abbott]

On 08/15/2018 01:21 PM, Reindl Harald wrote:
>  * Di Aug 14 2018 Justin M. Forbes <jforbes(a)fedoraproject.org&gt; -
> 4.17.14-101
>  - Fix "Foreshadow" CVE-2018-3620 CVE-2018-3646 (rhbz 1585005 1615998)
>  
>  -----
>  
>  CentOS 6: 2.6.32-754.3.5.el6.x86_64
>  [root@honeypot:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
>  /sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion
>  /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
>  /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
>  Speculative Store Bypass disabled via prctl
>  /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: Load fences
>  /sys/devices/system/cpu/vulnerabilities/spectre_v2:Vulnerable: Retpoline
>  with unsafe module(s), IBPB
>  
>  -----
>  
>  CentOS 7: 3.10.0-862.11.6.el7.x86_64
>  
>  [root@hosting:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
>  /sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion
>  /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
>  /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
>  Speculative Store Bypass disabled via prctl and seccomp
>  /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: Load
>  fences, __user pointer sanitization
>  /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full
>  retpoline
>  
>  -----
>  
>  Fedora 27/28: 4.17.14-(1|2)01.fc2(7|8).x86_64
>  
>  [root@master:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
>  /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
>  /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
>  Speculative Store Bypass disabled via prctl and seccomp
>  /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user
>  pointer sanitization
>  /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full
>  generic retpoline, IBPB, IBRS_FW 
There were .202 and .102 versions, please check those

[Reindl Harald]

Am 15.08.2018 um 23:25 schrieb Laura Abbott:
>  On 08/15/2018 01:21 PM, Reindl Harald wrote:
> > * Di Aug 14 2018 Justin M. Forbes <jforbes(a)fedoraproject.org&gt; -
> > 4.17.14-101
> > - Fix "Foreshadow" CVE-2018-3620 CVE-2018-3646 (rhbz 1585005 1615998)
> >
> > -----
> >
> > CentOS 6: 2.6.32-754.3.5.el6.x86_64
> > [root@honeypot:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
> > /sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion
> >
> > CentOS 7: 3.10.0-862.11.6.el7.x86_64
> >
> > [root@hosting:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
> > /sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion
> >
> > -----
> >
> > Fedora 27/28: 4.17.14-(1|2)01.fc2(7|8).x86_64
> >
> > [root@master:~]$ grep . /sys/devices/system/cpu/vulnerabilities/*
> > /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
> > /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation:
> > Speculative Store Bypass disabled via prctl and seccomp
> > /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user
> > pointer sanitization
> > /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full
> > generic retpoline, IBPB, IBRS_FW
>  
>  There were .202 and .102 versions, please check those 
looks better, did not see or expect that build

/sys/devices/system/cpu/vulnerabilities/l1tf
Mitigation: PTE Inversion

---

very interesting:
Product Name: HP Compaq Elite 8300 CMT
BIOS Version: K01 v03.07

[root@srv-rhsoft:~]$ cat /sys/devices/system/cpu/vulnerabilities/l1tf
Vulnerable

---

all other machines Elite 8200 (SandyBridge) and Elite 8330 (IvyBridge)
without the latest HP BIOS Update are fine and in case of 8200 also the
one with the lastest BIOS update

completly weird: even a VMware guest with the same Fedora Kernel running
on top of VMware Workstation (todas version) says "Mitigation: PTE
Inversion"