cpu Archives - Programming, IoT and Server Stuff

Below is a post about the Spectre and Meltdown Security vulnerabilities and mostly how it relates to Ubuntu 16.04 LTS.

Spectre and Meltdown Background

Google Project Zero found a server-side hardware bug (undocumented feature) that allows reading of privileged memory by leveraging a CPU (and possibly any GPU and SOC) feature to execute code ahead of time in “if” code branches before the result of the “if” case is known. This execute code ahead of demand feature was added to speed up processors to assists the FETCH, DECODE, EXECUTE and WRITE-BACK stages in the execution pipeline preparation.

Processors hate reading from main memory (it is too slow) so if data can be PREFETCHED or CACHED before being executed in the CPU allowing the CPU can do more work. This bug/flaw is not really a bug/flaw IMHO but an insecure efficiency feature.

Read more on the Spectre and Meltdown bug here at Wired.

CPU History

Aside: Check out the Red Hill Hardware guide and the evolution (documentation) of early CPU’s.

You can read more about the Pentium 4’s cache, rapid execution engine and instruction set additions to learn more about the evolution of CPU efficiency here.

Making processors faster (adding more MHZ) may be futile if the cache is too small or slow, and simply adding more cache can increase costs. Branch prediction was a way to increase performance (by using idle clock cycles or saving clock cycles) without adding extra cache or silicone (extra cost). I suspect in the future branch prediction and read ahead features may be locked down or processor manufacturers may swing back to adding more MHZ/Cores/Cache.

Anandtech https://www.anandtech.com have a great article on branch prediction (I can’t find the article now but will add it when I find it later) but this guide gives the gist.

CPU 101

A CPU is much like a checkout area at a grocery store, and a multi-core CPU is like a grocery store with multiple checkouts.

Things (processing and reading to/from memory) happen sequentially (per core).
Only one item can be scanned (processed) at a time (per core).
Customers trolleys and items are like program threads and items to scan (to be calculated in the CPU).
Customers trolleys (programs with things to calculate) line up and wait for the CPU (attendant) to scan (execute) items. PRE-FETCH and other CPU tasks help organize data related to instructions.
One checkout line (core) cannot read or affect items at another checkout (thread safety).

When a price check is called on an item (causing huge delays while the price is being checked by a runner (reading from main memory)) the checkout attendant (CPU core) processes the next items at the checkout (items in the processor execution pipeline). Branch predicting will read ahead in idle times to prevent idle delays or cache-misses to prevent slowdown. Processors usually make sure things are in the processors L3, L2 or L1 memory before they are executed but some commands with pre-requisite data cannot be pre-cached.

CPU instruction information

Here is a list of x86 instructions

Troy Hunt in Weekly Update 68 https://www.troyhunt.com/weekly-update-68/ mentioned a twitter thread by Graham Sutherland (@gsuberland) https://twitter.com/gsuberland/status/948907452786933762 that summaries speculative execution more succinctly. Meltdown and Spectre bugs are due to the speculative execution in the processor.

Official Information on Spectre and Meltdown

Spectre (Security Vulnerability Wikipedia Article)

Meltdown (Security Vulnerability Wikipedia Article)

Proof of concepts exploits in the wide

Proof of concept and exploits are no doubt in the wild (as reported by Michael Schwarz – @misc0110)

Using #Meltdown to steal passwords in real time #intelbug #kaiser #kpti /cc @mlqxyz @lavados @StefanMangard @yuvalyarom https://t.co/gX4CxfL1Ax pic.twitter.com/JbEvQSQraP

— Michael Schwarz (@misc0110) January 4, 2018

Ubuntu Impact

I have a number of Ubuntu servers and I have updated them to fix Spectre and Meltdown issues.

Here are my past guides on setting up Ubuntu (and Centos) servers in the cloud on Digital Ocean, Vultr and AWS.

Ubuntu said here that is has been notified by Intel of this issue since November 09 2017.

Ubuntu Timeline (16.04 related snip from here)

2017 Nov 09: the Ubuntu Security team is notified by Intel under NDA.
2017 Nov 20: the CRD is established as 2018-01-09.
2017 Dec: the Ubuntu Security team receives notifications from additional silicon vendors about the impact to their products.
2018 Jan 03: issue becomes public a few days before the CRD.
2018 Jan 04: Canonical publicly communicates the planned update schedule.
2018 Jan 04: Mozilla releases timing attack mitigations.
2018 Jan 05: Ubuntu Firefox updates are made available in USN 3516-1.
2018 Jan 07: Candidate kernels are beginning to be made available for testing at ppa:canonical-kernel-team/pti. This initial round will address CVE-2017-5754 (aka Meltdown or Variant 3) for x86_64. We will address CVE-2017-5715 and CVE-2017-5753 (aka Spectre or Variant 1 & 2) in a subsequent round. We will also address additional architectures in subsequent rounds. Kernels currently available are as follows. We will continue to update this table as more become available:
Package: linux, Version: 4.4.0-108.131, Series: Xenial 16.04
-2018 Jan 09: NVIDIA driver updates published, see USN-3521-1.
Cloud image updates.
Core image updates.

At this time it looks like this has been fixed on Ubuntu 16.04 LTS (Xenial Xerus) with released (57.0.4+build1-0ubuntu0.16.04.1). Consider updating your Ubuntu servers.

You can follow the Ubuntu CVE listing here to be ahead of future security issues.
https://people.canonical.com/~ubuntu-security/cve/main.html

Spectre and Meltdown related Ubuntu CVE’s

Spectre – CVE-2017-5715

Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

Link: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5715.html

Spectre – CVE-2017-5753

Description: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

Ubuntu-Description: Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via side-channel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory.

Link: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5753.html

Meltdown – CVE-2017-5754

Ubuntu-Description: Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via side-channel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory.

Link: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5754.html

Links

Ubuntu Security News https://usn.ubuntu.com/usn/

Subscribe to the Ubuntu Security Announcement Distribution List https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Ubuntu CVE Tracker (Main) http://people.canonical.com/~ubuntu-security/cve/main.html

How to update Ubuntu

As always backup your server and configuration first (consider taking a snapshot). I run the following command to update my system and reboot.

Warning: Some packages may overwrite in-production configuration files (or break production servers) so take your time updating, use test servers (green and blue or dev, test and prod) and only upgrade production when you are ready.

sudo apt update && sudo apt upgrade && shutdown -r now

1	sudo apt update && sudo apt upgrade && shutdown -r now

Check to see if the update was held back, it was, “xenial-security 4.4.0.109.114” was held back for me

apt list --upgradable
Listing... Done
libdrm2/xenial-updates 2.4.83-1~16.04.1 amd64 [upgradable from: 2.4.76-1~ubuntu16.04.1]
linux-generic/xenial-updates,xenial-security 4.4.0.109.114 amd64 [upgradable from: 4.4.0.87.93]
linux-headers-generic/xenial-updates,xenial-security 4.4.0.109.114 amd64 [upgradable from: 4.4.0.87.93]
linux-image-generic/xenial-updates,xenial-security 4.4.0.109.114 amd64 [upgradable from: 4.4.0.87.93]
python3-requests/xenial,xenial 2.18.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 2.9.1-3]
python3-urllib3/xenial,xenial 1.21.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 1.13.1-2ubuntu0.16.04.1]

apt list --upgradable

Listing... Done

libdrm2/xenial-updates 2.4.83-1~16.04.1 amd64 [upgradable from: 2.4.76-1~ubuntu16.04.1]

linux-generic/xenial-updates,xenial-security 4.4.0.109.114 amd64 [upgradable from: 4.4.0.87.93]

linux-headers-generic/xenial-updates,xenial-security 4.4.0.109.114 amd64 [upgradable from: 4.4.0.87.93]

linux-image-generic/xenial-updates,xenial-security 4.4.0.109.114 amd64 [upgradable from: 4.4.0.87.93]

python3-requests/xenial,xenial 2.18.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 2.9.1-3]

python3-urllib3/xenial,xenial 1.21.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 1.13.1-2ubuntu0.16.04.1]

You can now force the security updates (below)

Schedule automatic unattended security upgrades (and manually install updates)

#Install Unattended updates Package
sudo apt-get install unattended-upgrades

#Install Updates
sudo unattended-upgrades -d

#Enable Automatic installation of stable security updates
sudo dpkg-reconfigure  unattended-upgrades

#Install Unattended updates Package

sudo apt-get install unattended-upgrades

#Install Updates

sudo unattended-upgrades -d

#Enable Automatic installation of stable security updates

sudo dpkg-reconfigure unattended-upgrades

You can now see what packages need updating after forcing the updates (no more “xenial-security 4.4.0.109.114”)

apt list --upgradable
Listing... Done
libdrm2/xenial-updates 2.4.83-1~16.04.1 amd64 [upgradable from: 2.4.76-1~ubuntu16.04.1]
python3-requests/xenial,xenial 2.18.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 2.9.1-3]
python3-urllib3/xenial,xenial 1.21.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 1.13.1-2ubuntu0.16.04.1]

apt list --upgradable

Listing... Done

libdrm2/xenial-updates 2.4.83-1~16.04.1 amd64 [upgradable from: 2.4.76-1~ubuntu16.04.1]

python3-requests/xenial,xenial 2.18.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 2.9.1-3]

python3-urllib3/xenial,xenial 1.21.1-1+ubuntu16.04.1+certbot+1 all [upgradable from: 1.13.1-2ubuntu0.16.04.1]

Reboot

shutdown -r now

1	shutdown -r now

Check patch install status with this command

sudo grep "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" || echo "unpatched :("

1	sudo grep "cpu_insecure\\|cpu_meltdown\\|kaiser" /proc/cpuinfo && echo "patched :)" \|\| echo "unpatched :("

Pathed Installed Result

sudo grep "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" || echo "unpatched :("
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc rep_good nopl xtopology eagerfpu pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm invpcid_single kaiser fsgsbase bmi1 avx2 smep bmi2 erms invpcid xsaveopt arat
patched :)

sudo grep "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" || echo "unpatched :("

flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc rep_good nopl xtopology eagerfpu pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm invpcid_single kaiser fsgsbase bmi1 avx2 smep bmi2 erms invpcid xsaveopt arat

patched :)

Patched Not Installed Result (did you reboot)?

grep "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" \
> || echo "unpatched :("
unpatched :(

grep "cpu_insecure\|cpu_meltdown\|kaiser" /proc/cpuinfo && echo "patched :)" \

> || echo "unpatched :("

unpatched :(

Or you can run

dmesg | grep isolation && echo "patched :)" || echo "unpatched :("
[ 0.000000] Kernel/User page tables isolation: enabled
patched :)

dmesg | grep isolation && echo "patched :)" || echo "unpatched :("

[ 0.000000] Kernel/User page tables isolation: enabled

patched :)

Troubleshooting

If you have servers that won’t update via the method above (on Ubuntu 61.04 LTS) you can run

sudo apt-get install linux-headers-4.4.0-109 linux-headers-4.4.0-109-generic linux-headers-generic linux-image-4.4.0-109-generic linux-image-extra-4.4.0-109-generic linux-image-generic linux-tools-4.4.0-109 linux-tools-4.4.0-109-generic linux-tools-generic
sudo shutdown -r now

1 2	sudo apt-get install linux-headers-4.4.0-109 linux-headers-4.4.0-109-generic linux-headers-generic linux-image-4.4.0-109-generic linux-image-extra-4.4.0-109-generic linux-image-generic linux-tools-4.4.0-109 linux-tools-4.4.0-109-generic linux-tools-generic sudo shutdown -r now

Don’t forget to reboot then run the following

dmesg | grep isolation && echo "patched :)" || echo "unpatched :("
[ 0.000000] Kernel/User page tables isolation: enabled
patched :)

dmesg | grep isolation && echo "patched :)" || echo "unpatched :("

[ 0.000000] Kernel/User page tables isolation: enabled

patched :)

You can view CPU flags by typing “cat /proc/cpuinfo”

cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 62
model name      : Intel(R) Xeon(R) CPU E5-2630L v2 @ 2.40GHz
stepping        : 4
microcode       : 0x1
cpu MHz         : 2399.998
cache size      : 15360 KB
physical id     : 0
siblings        : 1
core id         : 0
cpu cores       : 1
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 13
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon rep_good nopl eagerfpu pni pclmulqdq vmx ssse3 cx16 pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm kaiser vnmi ept fsgsbase tsc_adjust smep erms xsaveopt arat
bugs            :
bogomips        : 4799.99
clflush size    : 64
cache_alignment : 64
address sizes   : 40 bits physical, 48 bits virtual
power management:

cat /proc/cpuinfo

processor : 0

vendor_id : GenuineIntel

cpu family : 6

model : 62

model name : Intel(R) Xeon(R) CPU E5-2630L v2 @ 2.40GHz

stepping : 4

microcode : 0x1

cpu MHz : 2399.998

cache size : 15360 KB

physical id : 0

siblings : 1

core id : 0

cpu cores : 1

apicid : 0

initial apicid : 0

fpu : yes

fpu_exception : yes

cpuid level : 13

wp : yes

flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon rep_good nopl eagerfpu pni pclmulqdq vmx ssse3 cx16 pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm kaiser vnmi ept fsgsbase tsc_adjust smep erms xsaveopt arat

bugs :

bogomips : 4799.99

clflush size : 64

cache_alignment : 64

address sizes : 40 bits physical, 48 bits virtual

power management:

fyi: AWS related Speculative Execution post: https://aws.amazon.com/security/security-bulletins/AWS-2018-013/

Read more on “4.4.0-108-generic” kernel panics (do not install “4.4.0-108-generic”) here and here.

Impact on Future Program Build Times

Twitter user Peter Czanik (@PCzanik https://twitter.com/PCzanik) reports that compile times that fix speculative execution have increased his build times from 4 minutes to 21 minutes.

The fix for the #Intel CPU vulnerabilities has a #brutal effect on compile times.

Compiling the #syslog_ng package on #Fedora changed drastically: from 4 minutes to 21!

As far as I can see compiling #Java is affected most.#Meltdown #Spectre

— Peter Czanik (@PCzanik) January 5, 2018

Windows Impacts

Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems

https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/

OSX Impacts
Report: Intel CPUs suffer from major security flaw, fix could bring notable performance hit to macOS

Report: Intel CPUs suffer from major security flaw, fix could bring notable performance hit to macOS https://t.co/zGVsnoPLd7 by @ChanceHMiller pic.twitter.com/njk4FeOZ4T

— 9to5Mac  (@9to5mac) January 3, 2018

Web Browser and JavaScript Impacts

Wonderful explanation on how Meltdown and Spectre affect WebKit/Safari and most of it still generally applicable to all JavaScript engines https://t.co/Is0d8hnWYI

— Jay Phelps (@_jayphelps) January 9, 2018

Impact on Servers and Software

Redis appears to be 30% slower after patching.

Here’s what happened last night to one of our busier redis servers before and after patching for meltdown. Using the same 200k/12 minute axes on both: down from ~145k ops/sec to ~95ks ops/sec, or about 35% slower. pic.twitter.com/H6sM0C5i1V

— Nick Craver (@Nick_Craver) January 12, 2018

General

Here’s what every Chrome user should do in the wake of #Spectre

http://mashable.com/2018/01/04/google-chrome-spectre-precaution-meltdown/

Microsoft reveals how Spectre updates can slow your PC down

https://www.theverge.com/2018/1/9/16868290/microsoft-meltdown-spectre-firmware-updates-pc-slowdown

Microsoft halts AMD Meltdown and Spectre patches after reports of unbootable PCs

Microsoft halts AMD Meltdown and Spectre patches after reports of unbootable PCs https://t.co/A7LqLoHOzi pic.twitter.com/VUmjvkUlgV

— The Verge (@verge) January 9, 2018

Review: https://twitter.com/search?q=spectre%20meltdown

Ubuntu Cloud Tips

Read my guide on Useful Linux Terminal Commands https://fearby.com/article/useful-linux-terminal-commands/

Read my guide on how to setting up a Vultr VM (Ubuntu) and configuring it https://fearby.com/article/setting-vultr-vm-configuring/

Good luck.

Scott Manley’s breakdown of Spectre and Meltdown

More Reading

Anandtech – Understanding Meltdown & Spectre: What To Know About New Exploits That Affect Virtually All CPUs.

Check out the extensive Hardening a Linux Server guide at thecloud.org.uk: https://thecloud.org.uk/wiki/index.php?title=Hardening_a_Linux_Server

Links from CVE articles

https://spectreattack.com/
https://meltdownattack.com/
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5715
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr
http://www.amd.com/en/corporate/speculative-execution
https://developer.arm.com/support/security-update
https://www.qemu.org/2018/01/04/spectre/
https://usn.ubuntu.com/usn/usn-3516-1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5753
http://nvidia.custhelp.com/app/answers/detail/a_id/4611
https://usn.ubuntu.com/usn/usn-3521-1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754
https://github.com/IAIK/KAISER
https://gruss.cc/files/kaiser.pdf
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html

FYI: Ubuntu 17.04 will not be getting the Spectre and Meltdown fixes, this is a good reason why not to use a non-LTS (long time support) release of Ubuntu (abandoned after 9 months):
https://lists.ubuntu.com/archives/ubuntu-announce/2018-January/000227.html

More Fearby.com Reading

Donate and make this blog better

Ask a question or recommend an article

Revision History

v1.83 added Impact on Servers and Software

v1.82 added cat /proc/cpuinfo info

v1.81 added extra link to kernel panic

v1.8 added force update of “xenial-security 4.4.0.109.114” and patch verification

v1.7 added info on forcing updates and checking patch status

v1.6 Install and configure unattended upgrades of security packages

v1.5 added link to Hardening_a_Linux_Server

v1.4 Scott Manleys link

v1.3 Added Anandtech article.

v1.2 Wired link.

v1.1 view the changelog of updatable packages.

v1.0 Initial Copy.

Hope this helps someone.

Development Blog

Coding for fun since 1996, Learn by doing and sharing.

cpu

Ubuntu 16.04: Spectre, Meltdown Security Vulnerabilities (and how to patch).

Popular

Security

Code

Tech

Wordpress

General

Main navigation

cpu

Footer

Popular

Security

Code

Tech

Wordpress

General