Gfilui

The Ubuntu Security knowledge base regarding Meltdown&Spectre still saying:

• No microcode updates are currently available for AMD or Intel, which means Spectre v2 is still unmitigated out of the box on Ubuntu on x86 CPUs for userspace.

KnowlegdeBase:
SecurityTeam / KnowledgeBase / SpectreAndMeltdown | Ubuntu Wiki

Is that really true? Anyone can help with this? This topic became complex with too many patches & reverts in meanwhile.

If the above is true, that means Ubuntu is currently only mitigated against Meltdown and Spectre Variant 1?

We are using AWS Cloud and Ubuntu servers.

Best,
Fadi

This is a complex topic that is hard to give a true "Patched" or "Not patched" answer. So, I will provide you the very inaccurate and useless short answer, and a less brief summary that summarizes the rest of the info I provide.

The very inaccurate short answer is "Yes and no", but it doesn't give you a clear idea of what the actual situation is.

I'm not sure what architecture AWS uses, but my guess is that it's an i386 or amd64 architecture. Patches for Spectre variant 1 and Meltdown are in the kernel. But Spectre Variant 2 requires updated stable firmware / microcode from the manufacturers - both Intel and AMD. Therefore, though the kernel contains mitigations against the issues, the actual CPU firmwares need updated. And therefore, Spectre variant 2 is not completely patched.

However, the above summary is not really an accurate portrayal of the current state of patching against these issues - it's just a very basic summary.

So, for that reason, I'm taking the data provided from the Security Team's knowledge base, and making it a human-understandable summary of the page as it was on March 22, 2018 at 09:48AM UTC-4. I also am only focusing on 14.04 and later versions, because Precise is End of Life unless you pay Canonical for the Ubuntu Advantage for 12.04 Precise systems, and is mostly irrelevant for people running Precise without this paid support.

Note that for the Spectre and Meltdown issues to be properly addressed in all releases, both the Kernel and the CPU Microcode sections must have mitigations and updates released and incorporated. This is why Spectre Variant 2 is not really 'patched' yet, per-se.

Kernel:

• Patched for Spectre Variant 1.


• Patched for Meltdown.


• Spectre Variant 2:
  
  
  • Kernel contains mitigations
  
  
  • Kernel mitigations alone aren't enough, CPU firmware/microcode updates are needed.
  
  

CPU Firmware/Microcode:

• 
  ppc64el and s390x processor architectures patched, updates available from IBM.


• 
  armhf and arm64 are mostly unaffected, there are only a very small number of chips affected by this.


• 
  i386 and amd64 do not have stable releases to their microcode addressing this issue.
  
  
  • Intel had released microcode updates, but these were reverted due to the introduction of system instability issues, details in USN-3531-2.
  
  
  • AMD released a statement on March 20th that they are in the process of developing and staging mitigations for Spectre and Meltdown, but has not yet released a stable version of microcode.
  
  
  • Summary: No stable release of microcode updates has been made containing the Spectre and/or Meltdown code updates.
    
  
  

Userspace Mitigations:

Some programs and libraries have mitigations against Spectre and Meltdown built-into their code to prevent exploitation of the issues by the programs or libraries themselves:

• Firefox


• WebKitGTK+


• NVIDIA graphics drivers


• QEMU


• libvirt

Cloud Images (this might not include AWS, and I have not checked):

Trusty, Xenial, and Artful cloud images after 20180122 as their serial include patches in the images. Per the above other sections, though, as Cloud Images still have to obey the rest of the patch rules and such from above.

_{This answer was last updated on: March 22, 2018 10:02AM}