I installed intel-microcode, but when I use ./spectre-meltdown-checker.sh I get this

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)
* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active:  NO 
* SMT is either mitigated or disabled:  YES 
> STATUS:  VULNERABLE  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled)

How do I fix it ? I can't understand

  sudo ./spectre-meltdown-checker.sh | grep 'CPU microcode is'
[sudo] password for user: 
  * CPU microcode is known to cause stability problems:  NO  (model 0x2d family 0x6 stepping 0x7 ucode 0x710 cpuid 0x206d7)
  * CPU microcode is the latest known available version:  NO  (latest version is 0x714 dated 2018/05/08 according to builtin MCExtractor DB v112 - 2019/05/22)
IBPB is considered as a good addition to retpoline for Variant 2 mitigation, but your CPU microcode doesn't support it
> STATUS:  VULNERABLE  (an up-to-date CPU microcode is needed to mitigate this vulnerability)

but it's latest

sudo apt install intel-microcode
Reading package lists... Done
Building dependency tree       
Reading state information... Done
intel-microcode is already the newest version (3.20180807a.2~deb9u1).
  • Silly question perhaps, but did you reboot after installing intel-microcode? Could you edit your question to show the output of sudo ./spectre-meltdown-checker.sh | grep 'CPU microcode is'? – Stephen Kitt Jun 22 at 6:14
  • @StephenKitt Thank you for help Stephen. Yes, I rebooted. Strange stuff spectre-meltdown-checker says CPU microcode is the latest known available version: NO and apt say intel-microcode is already the newest version . I edited my question – user359015 Jun 23 at 7:06

Do you have non-free enabled in the security repo in /etc/apt/sources.list?

deb http://security.debian.org/ stretch/updates main contrib non-free

If not, enable non-free, apt-get update, and install intel-microcode again. It'll install a new package. Reboot and try spectre-meltdown-checker again.

  • intel-microcode is already installed, and apt knows what versions are available, which means that non-free is already enabled. – Stephen Kitt Jun 24 at 7:56

Your CPU needs microcode 0x718 to fix Fallout and RIDL; this was added to intel-microcode in the 20190618 update, which wasn’t available in your configured repositories when you last updated.

It has now been pushed as a security update for Debian 9, and you should get the upgrade the next time you run

apt update && apt upgrade

(as root). The corresponding package version is 3.20190618.1~deb9u1.

You’ll need to reboot to apply the microcode update.

  • Thank you. I have 2 kernels one from strech-backports (4.19) and one default from strech (4.9). After I installed intel-microcode initramfs updates only 4.19. How to apply intel-microcode fix for 4.9 as well ? – user359015 Jun 24 at 17:59
  • sudo update-initramfs -u -k all will update all your kernels. – Stephen Kitt Jun 24 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.