According to the Intel microcode update which was released on 2018-03-12 to address Spectre/Meltdown, the microcode is not compatible with CentOS 6.
Therefore, systems running CentOS 6 remain vulnerable to Spectre Variant 2 as CentOS maintainers delegated responsibility for this patch to upstream vendors (aka Intel).
We have installed all available OS updates and this has successfully patched against Spectre Variant 1 and Meltdown on CentOS 6 systems.
Spectre and Meltdown mitigation detection tool v0.35 Checking for vulnerabilities on current system Kernel is Linux 2.6.32-696.23.1.el6.x86_64 #1 SMP Tue Mar 13 22:44:18 UTC 2018 x86_64 CPU is Intel(R) Xeon(R) CPU E3-1220 V2 @ 3.10GHz Hardware check * Hardware support (CPU microcode) for mitigation techniques * Indirect Branch Restricted Speculation (IBRS) * SPEC_CTRL MSR is available: NO * CPU indicates IBRS capability: NO * Indirect Branch Prediction Barrier (IBPB) * PRED_CMD MSR is available: NO * CPU indicates IBPB capability: NO * Single Thread Indirect Branch Predictors (STIBP) * SPEC_CTRL MSR is available: NO * CPU indicates STIBP capability: NO * Enhanced IBRS (IBRS_ALL) * CPU indicates ARCH_CAPABILITIES MSR availability: NO * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): NO * CPU microcode is known to cause stability problems: NO (model 58 stepping 9 ucode 31) * CPU vulnerability to the three speculative execution attacks variants * Vulnerable to Variant 1: YES * Vulnerable to Variant 2: YES * Vulnerable to Variant 3: YES CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' * Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active) * Kernel has array_index_mask_nospec: NO * Kernel has the Red Hat/Ubuntu patch: YES > STATUS: NOT VULNERABLE (Mitigation: Load fences) CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' * Mitigated according to the /sys interface: NO (kernel confirms your system is vulnerable) * Mitigation 1 * Kernel is compiled with IBRS/IBPB support: YES * Currently enabled features * IBRS enabled for Kernel space: NO * IBRS enabled for User space: NO * IBPB enabled: YES * Mitigation 2 * Kernel compiled with retpoline option: YES * Kernel compiled with a retpoline-aware compiler: UNKNOWN > STATUS: VULNERABLE (Vulnerable: Retpoline with unsafe module(s)) CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' * Mitigated according to the /sys interface: YES (kernel confirms that the mitigation is active) * Kernel supports Page Table Isolation (PTI): YES * PTI enabled and active: YES * Running as a Xen PV DomU: NO > STATUS: NOT VULNERABLE (Mitigation: PTI) A false sense of security is worse than no security at all, see --disclaimer
This is the same on multiple systems running CentOS 6.9.
How can we patch a system running CentOS 6 against Spectre variant 2?