2

Are the most modern CPUs still susceptible to attacks like Spectre and Meltdown?

Is it worth enabling the fixes in kernel (which hit performance) ?

Lets say high end laptop CPU such as the AMD Ryzen 7 7840U Processor. Is it fully immune in HW, or does it still require software mitigation in the kernel?

2
  • 1
    Meltdown was a specific bug that I think was fixed. Spectre will never be fixed. Dec 17, 2023 at 16:22
  • 1
    I've rolled back your significant addition to your original question. Please don't extend an already answered question. Ask a new question instead if you want to know more than you've originally asked for. Dec 20, 2023 at 8:26

2 Answers 2

3
+500

Are the most modern CPUs still susceptible to attacks like Spectre and Meltdown?

Spectre, yes, Meltdown has been fixed for good.

Is it worth enabling the fixes in kernel (which hit performance) ?

Normally the Linux kernel enables all the necessary defenses by default, nothing needs to be done:

The same CPU as yours, Linux 6.6.7:

$ dmesg
...
Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
Spectre V2 : Mitigation: Enhanced / Automatic IBRS
Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
Spectre V2 : User space: Mitigation: STIBP always-on protection
Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
Spectre V2 : Update user space SMT mitigation: STIBP always-on

$ grep -r . /sys/devices/system/cpu/vulnerabilities
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Enhanced / Automatic IBRS, IBPB: conditional, STIBP: always-on, RSB filling, PBRSB-eIBRS: Not affected
/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected
/sys/devices/system/cpu/vulnerabilities/mds:Not affected
/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Vulnerable
/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected

(Mitigation against Speculative Return Stack Overflow (SRSO) has been disabled manually using spec_rstack_overflow=off).

Lets say high end laptop CPU such as the AMD Ryzen 7 7840U Processor. Is it fully immune in HW, or does it still require software mitigation in the kernel?

There have been a ton of such vulnerabilities.

Some of them have been fixed in hardware, for some mitigations in the kernel (they are enabled by default) and in user space software (enabled by default in mainstream Linux distros) are required.

Spectre class vulnerabilities are unlikely to be fixed with the today's out of order architecture of modern CPUs:

6

There are still new attack vectors found which rely on the side effects of speculative execution. Some newly detects attacks are for older or still sold systems - see “Downfall” bug affects years of Intel CPUs, can leak encryption keys and more. Other attacks affect recent and even not yet released CPU - see SLAM Attack: New Spectre-based Vulnerability Impacts Intel, AMD, and Arm CPUs.

Is it worth enabling the fixes in kernel (which hit performance) ?

This depends on what you are doing with your system. If you are running a Desktop PC and regularly download code from untrusted sources then spectre-like attacks are probably not the most relevant risk to address, i.e. there are far greater risks like ransomware, spyware or other malware. If you instead provide a cloud platform where you need to guarantee proper isolation between tenants even if each can run their own code, then such side-channel attacks are important to address. And if you run a closed system were you are in full control of all code ever running, then the risk of a third party exploiting a side-channel attack does not exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .