Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with

7 of 8 variants OK (the failed one is apparently not possible to exploit under VMware)

Then I was curious about my cloud stuff so I checked EC2 and RackSpace VMs. To my surprise they came back with only

2 of 8 variants OK 

That's bad. Looking at AWS bulletin, they swear that there is no problem. Why is the script detecting a problem then? I didn't search RackSpace security bulletins, but I'm assuming they say something similar as AWS. Is the script wrong or is AWS wrong? How can I really tell other than just taking AWS's word for it? Also, I don't have any Windows instances, but if I did and I ran Inspectre would I see the same discrepancy?

If the script is wrong, is there a better script? Is it because a "better script" would actually have to try the exploit, not just rely on some kind of heuristics? Where can I find such a script?

PS: You may be wondering which CVE's were ok and which were not. What I'm referring to when I say "2 of 8 OK" is the summary produced by the tool. I'm too paranoid to show you which ones, but I bet if you rerun the same tool, you'll get the same result. Summary looks like this (red/green for KO or OK)

SUMMARY: CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646
  • Does this help? github.com/speed47/spectre-meltdown-checker/issues/143
    – Serverfrog
    Oct 29, 2018 at 17:23
  • It helps a bit, in that it explains that depending on kernel, the script may not be able to detect a patch. But that thread is more than half year old. My question is, what script exists that correctly verifies AWS/RackSpace patch status? Or is there a 3rd party that has done the verification and published results? Nov 1, 2018 at 12:46


You must log in to answer this question.

Browse other questions tagged .