Thanks for the reply, cowbat. I found a script for checking for CPU vulnerabilities. This is the GitHub repo for the script:
https://github.com/speed47/spectre-meltdown-checker/blob/master/FAQ.md
I ran the script. The result is lengthy.
The TL;DR is that there seem to be some vulnerabilities that could be addressed by an update to microcode.
While I'd like to apply a patch due the apparent vulnerabilities, some of the reading I did about doing so advised against messing with microcode on one's own. I'm no guru and I've never tried to patch microcode before, thus I'm hesitant. I will try to see if there has been some kind of patch provided by my distro in the last couple of years.
This is the script's output:
Spectre and Meltdown mitigation detection tool v0.46+
Checking for vulnerabilities on current system
Kernel is [35mLinux 5.15.145 #1 SMP PREEMPT Sun Dec 24 00:07:06 CST 2023 x86_64[0m
CPU is [35mIntel(R) Core(TM) i7-8550U CPU @ 1.80GHz[0m
[1;34mHardware check[0m
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: [42m[30m YES [0m
* CPU indicates IBRS capability: [42m[30m YES [0m (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* CPU indicates IBPB capability: [42m[30m YES [0m (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: [42m[30m YES [0m
* CPU indicates STIBP capability: [42m[30m YES [0m (Intel STIBP feature bit)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: [42m[30m YES [0m (Intel SSBD)
* L1 data cache invalidation
* CPU indicates L1D flush capability: [42m[30m YES [0m (L1D flush feature bit)
* Microarchitectural Data Sampling
* VERW instruction is available: [43m[30m NO [0m
* Indirect Branch Predictor Controls
* Indirect Predictor Disable feature is available: [43m[30m NO [0m
* Bottomless RSB Disable feature is available: [43m[30m NO [0m
* BHB-Focused Indirect Predictor Disable feature is available: [43m[30m NO [0m
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: [43m[30m NO [0m
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: [43m[30m NO [0m
* CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): [43m[30m NO [0m
* CPU explicitly indicates not being affected by Variant 4 (SSB_NO): [43m[30m NO [0m
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: [43m[30m NO [0m
* Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): [44m[30m NO [0m
* CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): [43m[30m NO [0m
* CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): [43m[30m NO [0m
* CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): [43m[30m NO [0m
* CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): [43m[30m NO [0m
* CPU explicitly indicates being affected by GDS and having mitigation control (GDS_CTRL): [44m[30m NO [0m
* CPU explicitly indicates not being affected by GDS (GDS_NO): [43m[30m NO [0m
* CPU supports Transactional Synchronization Extensions (TSX): [43m[30m NO [0m
* CPU supports Software Guard Extensions (SGX): [44m[30m YES [0m
* CPU supports Special Register Buffer Data Sampling (SRBDS): [42m[30m NO [0m
* CPU microcode is known to cause stability problems: [44m[30m NO [0m (family 0x6 model 0x8e stepping 0xa ucode 0x9a cpuid 0x806ea pfid 0x1)
* CPU microcode is the latest known available version: [44m[30m UNKNOWN [0m (latest microcode version for your CPU model is unknown)
* CPU vulnerability to the speculative execution attack variants
* Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): [43m[30m YES [0m
* Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): [43m[30m YES [0m
* Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): [43m[30m YES [0m
* Affected by CVE-2018-3640 (Variant 3a, rogue system register read): [43m[30m YES [0m
* Affected by CVE-2018-3639 (Variant 4, speculative store bypass): [43m[30m YES [0m
* Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): [43m[30m YES [0m
* Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): [43m[30m YES [0m
* Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): [43m[30m YES [0m
* Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): [43m[30m YES [0m
* Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): [43m[30m YES [0m
* Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): [43m[30m YES [0m
* Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): [43m[30m YES [0m
* Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): [43m[30m YES [0m
* Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): [43m[30m YES [0m
* Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): [43m[30m YES [0m
* Affected by CVE-2023-20593 (Zenbleed, cross-process information leak): [42m[30m NO [0m
* Affected by CVE-2022-40982 (Downfall, gather data sampling (GDS)): [43m[30m YES [0m
* Affected by CVE-2023-20569 (Inception, return address security (RAS)): [42m[30m NO [0m
* Affected by CVE-2023-23583 (Reptar, redundant prefix issue): [42m[30m NO [0m
[1;34mCVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
* Kernel has array_index_mask_nospec: [42m[30m YES [0m (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: [43m[30m NO [0m
* Kernel has mask_nospec64 (arm64): [43m[30m NO [0m
* Kernel has array_index_nospec (arm64): [43m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
[1;34mCVE-2017-5715 aka 'Spectre Variant 2, branch target injection'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: IBRS, IBPB: conditional, STIBP: conditional, RSB filling, PBRSB-eIBRS: Not affected)
* Mitigation 1
* Kernel is compiled with IBRS support: [42m[30m YES [0m
* IBRS enabled and active: [42m[30m YES [0m
* Kernel is compiled with IBPB support: [42m[30m YES [0m
* IBPB enabled and active: [42m[30m YES [0m
* Mitigation 2
* Kernel has branch predictor hardening (arm): [43m[30m NO [0m
* Kernel compiled with retpoline option: [42m[30m YES [0m
* Kernel supports RSB filling: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (IBRS + IBPB are mitigating the vulnerability)
[1;34mCVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): [42m[30m YES [0m
* PTI enabled and active: [42m[30m YES [0m
* Reduced performance impact of PTI: [42m[30m YES [0m (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU: [44m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: PTI)
[1;34mCVE-2018-3640 aka 'Variant 3a, rogue system register read'[0m
* CPU microcode mitigates the vulnerability: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU microcode mitigates the vulnerability)
[1;34mCVE-2018-3639 aka 'Variant 4, speculative store bypass'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB): [42m[30m YES [0m (found in /proc/self/status)
* SSB mitigation is enabled and active: [42m[30m YES [0m (per-thread through prctl)
* SSB mitigation currently active for selected processes: [42m[30m YES [0m (dhcpcd firefox-bin)
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
[1;34mCVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'[0m
* CPU microcode mitigates the vulnerability: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU microcode mitigates the vulnerability)
[1;34mCVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
* Kernel supports PTE inversion: [42m[30m YES [0m (found in kernel image)
* PTE inversion enabled and active: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
[1;34mCVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'[0m
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor: [42m[30m NO [0m
* Mitigation 1 (KVM)
* EPT is disabled: [43m[30m NO [0m
* Mitigation 2
* L1D flush is supported by kernel: [42m[30m YES [0m (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: [42m[30m YES [0m (conditional flushes)
* Hardware-backed L1D flush supported: [42m[30m YES [0m (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: [43m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (this system is not running a hypervisor)
[1;34mCVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
[1;34mCVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
[1;34mCVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
[1;34mCVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation: [42m[30m YES [0m (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active: [43m[30m NO [0m
* SMT is either mitigated or disabled: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)
[1;34mCVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Not affected)
* TAA mitigation is supported by kernel: [42m[30m YES [0m (found tsx_async_abort in kernel image)
* TAA mitigation enabled and active: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (Not affected)
[1;34mCVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (KVM: Mitigation: VMX disabled)
* This system is a host running a hypervisor: [42m[30m NO [0m
* iTLB Multihit mitigation is supported by kernel: [42m[30m YES [0m (found itlb_multihit in kernel image)
* iTLB Multihit mitigation enabled and active: [42m[30m YES [0m (KVM: Mitigation: VMX disabled)
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (this system is not running a hypervisor)
[1;34mCVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: No microcode)
* SRBDS mitigation control is supported by the kernel: [42m[30m YES [0m (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Your CPU microcode may need to be updated to mitigate the vulnerability)
[1;34mCVE-2023-20593 aka 'Zenbleed, cross-process information leak'[0m
* Zenbleed mitigation is supported by kernel: [42m[30m YES [0m (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active: [44m[30m N/A [0m (CPU is incompatible)
* Zenbleed mitigation is supported by CPU microcode: [43m[30m NO [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU vendor reported your CPU model as not affected)
[1;34mCVE-2022-40982 aka 'Downfall, gather data sampling (GDS)'[0m
* Mitigated according to the /sys interface: [43m[30m NO [0m (Vulnerable: No microcode)
* GDS is mitigated by microcode: [43m[30m NO [0m
* Kernel supports software mitigation by disabling AVX: [42m[30m YES [0m (found gather_data_sampling in kernel image)
* Kernel has disabled AVX as a mitigation: [43m[30m NO [0m (AVX support is enabled)
> [46m[30mSTATUS:[0m [41m[30m VULNERABLE [0m (Vulnerable: No microcode)
[1;34mCVE-2023-20569 aka 'Inception, return address security (RAS)'[0m
* Mitigated according to the /sys interface: [42m[30m YES [0m (Not affected)
* Kernel supports mitigation: [42m[30m YES [0m (found spec_rstack_overflow in kernel image)
* Kernel compiled with SRSO support: [42m[30m YES [0m
* Kernel compiled with IBPB_ENTRY support: [42m[30m YES [0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU vendor reported your CPU model as not affected)
[1;34mCVE-2023-23583 aka 'Reptar, redundant prefix issue'[0m
> [46m[30mSTATUS:[0m [42m[30m NOT VULNERABLE [0m (your CPU vendor reported your CPU model as not affected)
> [46m[30mSUMMARY:[0m [42m[30mCVE-2017-5753:OK[0m [42m[30mCVE-2017-5715:OK[0m [42m[30mCVE-2017-5754:OK[0m [42m[30mCVE-2018-3640:OK[0m [42m[30mCVE-2018-3639:OK[0m [42m[30mCVE-2018-3615:OK[0m [42m[30mCVE-2018-3620:OK[0m [42m[30mCVE-2018-3646:OK[0m [41m[30mCVE-2018-12126:KO[0m [41m[30mCVE-2018-12130:KO[0m [41m[30mCVE-2018-12127:KO[0m [41m[30mCVE-2019-11091:KO[0m [42m[30mCVE-2019-11135:OK[0m [42m[30mCVE-2018-12207:OK[0m [41m[30mCVE-2020-0543:KO[0m [42m[30mCVE-2023-20593:OK[0m [41m[30mCVE-2022-40982:KO[0m [42m[30mCVE-2023-20569:OK[0m [42m[30mCVE-2023-23583:OK[0m
