Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with
7 of 8 variants OK (the failed one is apparently not possible to exploit under VMware)
Then I was curious about my cloud stuff so I checked EC2 and RackSpace VMs. To my surprise they came back with only
2 of 8 variants OK
That's bad. Looking at AWS bulletin, they swear that there is no problem. Why is the script detecting a problem then? I didn't search RackSpace security bulletins, but I'm assuming they say something similar as AWS. Is the script wrong or is AWS wrong? How can I really tell other than just taking AWS's word for it? Also, I don't have any Windows instances, but if I did and I ran Inspectre would I see the same discrepancy?
If the script is wrong, is there a better script? Is it because a "better script" would actually have to try the exploit, not just rely on some kind of heuristics? Where can I find such a script?
PS: You may be wondering which CVE's were ok and which were not. What I'm referring to when I say "2 of 8 OK" is the summary produced by the tool. I'm too paranoid to show you which ones, but I bet if you rerun the same tool, you'll get the same result. Summary looks like this (red/green for KO or OK)
SUMMARY: CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646
