{"action":"published","release":{"url":"https://api.github.com/repos/AndyLavr/wip-kernel/releases/9608767","assets_url":"https://api.github.com/repos/AndyLavr/wip-kernel/releases/9608767/assets","upload_url":"https://uploads.github.com/repos/AndyLavr/wip-kernel/releases/9608767/assets{?name,label}","html_url":"https://github.com/AndyLavr/wip-kernel/releases/tag/v4.15.2-wip-x10","id":9608767,"tag_name":"v4.15.2-wip-x10","target_commitish":"master","name":"Kernel 4.15.2-wip-x10 IBRS/IBPB/LKRG (PDS scheduler)","draft":false,"author":{"login":"AndyLavr","id":16132814,"avatar_url":"https://avatars0.githubusercontent.com/u/16132814?v=4","gravatar_id":"","url":"https://api.github.com/users/AndyLavr","html_url":"https://github.com/AndyLavr","followers_url":"https://api.github.com/users/AndyLavr/followers","following_url":"https://api.github.com/users/AndyLavr/following{/other_user}","gists_url":"https://api.github.com/users/AndyLavr/gists{/gist_id}","starred_url":"https://api.github.com/users/AndyLavr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AndyLavr/subscriptions","organizations_url":"https://api.github.com/users/AndyLavr/orgs","repos_url":"https://api.github.com/users/AndyLavr/repos","events_url":"https://api.github.com/users/AndyLavr/events{/privacy}","received_events_url":"https://api.github.com/users/AndyLavr/received_events","type":"User","site_admin":false},"prerelease":false,"created_at":"2018-02-09T12:09:47Z","published_at":"2018-02-09T12:10:50Z","assets":[],"tarball_url":"https://api.github.com/repos/AndyLavr/wip-kernel/tarball/v4.15.2-wip-x10","zipball_url":"https://api.github.com/repos/AndyLavr/wip-kernel/zipball/v4.15.2-wip-x10","body":"# WIP Kernel 4.15.2-wip-x10\r\nWIP Patched Kernel Sources (Linux 4.15.2)\r\n\r\n\r\n## Full support:\r\n \r\n - Indirect Branch Restricted Speculation (IBRS)\r\n - Indirect Branch Prediction Barrier (IBPB)\r\n\r\n## Add Linux Kernel Runtime Guard (LKRG)\r\n\r\n Linux Kernel Runtime Guard (LKRG) is a loadable kernel module that\r\nperforms runtime integrity checking of the Linux kernel and detection of\r\nsecurity vulnerability exploits against the kernel.\r\n\r\n Warning: Fix seccomp interceptions\r\n\r\n Not build kernel with optimization flag -O3 and premption models.\r\nInterception do_seccomp funtion cannot work.\r\n\r\n\r\n#### Recommended built on the latest GCC 7.3+\r\n\r\nCurrent status of this kernel for the Spectre and Meltdown vulnerabilities\r\n--------------------------------------------------------------------------\r\n\r\n-= Spectre and Meltdown mitigation detection tool =-\r\n\r\nChecking for vulnerabilities on current system\r\n\r\nHardware check\r\n* Hardware support (CPU microcode) for mitigation techniques\r\n  * Indirect Branch Restricted Speculation (IBRS)\r\n    * SPEC_CTRL MSR is available:  YES \r\n    * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)\r\n    * Kernel has set the spec_ctrl flag in cpuinfo:  NO \r\n  * Indirect Branch Prediction Barrier (IBPB)\r\n    * PRED_CMD MSR is available:  YES\r\n    * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)\r\n  * Single Thread Indirect Branch Predictors (STIBP)\r\n    * SPEC_CTRL MSR is available:  YES\r\n    * CPU indicates STIBP capability:  YES\r\n  * Enhanced IBRS (IBRS_ALL)\r\n    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO\r\n    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO\r\n  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO\r\n  * CPU microcode is known to cause stability problems:\r\n  YES  (model 71 stepping 1 ucode 0x1b)\r\n\r\n* CPU vulnerability to the three speculative execution attacks variants\r\n  * Vulnerable to Variant 1:  YES (Enable Mitigation: __user pointer sanitization)\r\n  * Vulnerable to Variant 2:  YES (Enable Mitigation: PTI)\r\n  * Vulnerable to Variant 3:  YES (Enable Mitigation: Full generic retpoline, IBPB, IBRS_FW)\r\n\r\nCVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'\r\n* Mitigated according to the /sys interface:\r\n  YES  (kernel confirms that the mitigation is active)\r\n* Kernel has array_index_mask_nospec:\r\n  YES  (1 occurence(s) found of 64 bits array_index_mask_nospec())\r\n* Checking count of LFENCE instructions following a jump in kernel:\r\n  YES  (1839 jump-then-lfence instructions found, which is >= 30 (heuristic))\r\n> STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)\r\n\r\nCVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'\r\n* Mitigated according to the /sys interface:\r\n  YES  (kernel confirms that the mitigation is active)\r\n* Mitigation 1\r\n  * Kernel is compiled with IBRS/IBPB support:  YES\r\n  * Currently enabled features\r\n    * IBRS enabled for Kernel space:  NO\r\n    * IBRS enabled for User space:  NO\r\n    * IBPB enabled:  YES\r\n* Mitigation 2\r\n  * Kernel compiled with retpoline option:  YES\r\n  * Kernel compiled with a retpoline-aware compiler:\r\n  YES  (kernel reports full retpoline compilation)\r\n  * Retpoline enabled:  YES\r\n> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline, IBPB, IBRS_FW)\r\n\r\nCVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'\r\n* Mitigated according to the /sys interface:\r\n  YES  (kernel confirms that the mitigation is active)\r\n* Kernel supports Page Table Isolation (PTI):  YES\r\n* PTI enabled and active:  YES\r\n* Performance impact if PTI is enabled\r\n  * CPU supports PCID:\r\n  YES  (performance degradation with PTI will be limited)\r\n  * CPU supports INVPCID:\r\n  YES  (performance degradation with PTI will be limited)\r\n* Running as a Xen PV DomU:  NO\r\n> STATUS:  NOT VULNERABLE  (Mitigation: PTI)\r\n"}}
{"actor":{"display_login":"AndyLavr"}}