Bug#818689: jessie-pu: package amd64-microcode/2.20160316.1~deb8u1
Package: release.debian.org
Severity: normal
Tags: jessie security
User: release.debian.org@packages.debian.org
Usertags: pu
Unfortunately, the microcode for the earlier AMD Piledriver processors being
distributed in the amd64-microcode packages currently in non-free oldstable,
stable, testing and unstable has been found to be extremely dangerous.
More details:
http://seclists.org/oss-sec/2016/q1/450
http://www.theregister.co.uk/2016/03/06/amd_microcode_6000836_fix/
https://www.reddit.com/r/linux/comments/47s8a8/new_amd_microcode_vulnerability_from_unprivileged/
An urgency=critical upload to unstable is already installed, and waiting for
the next mirror pulse.
I would like to update the packages in stable, with basically the same
package that was already uploaded to unstable. The only difference is an
extra debian/changelog entry for the stable upload.
Thank you!
debdiff output:
diffstat for amd64-microcode-2.20141028.1 amd64-microcode-2.20160316.1~deb8u1
README | 14 ++++++++++++++
debian/changelog | 33 +++++++++++++++++++++++++++++++++
debian/control | 2 +-
microcode_amd_fam15h.bin |binary
microcode_amd_fam15h.bin.asc | 14 +++++++-------
5 files changed, 55 insertions(+), 8 deletions(-)
diff -Nru amd64-microcode-2.20141028.1/debian/changelog amd64-microcode-2.20160316.1~deb8u1/debian/changelog
--- amd64-microcode-2.20141028.1/debian/changelog 2014-12-18 13:36:29.000000000 -0200
+++ amd64-microcode-2.20160316.1~deb8u1/debian/changelog 2016-03-19 14:22:44.000000000 -0300
@@ -1,3 +1,36 @@
+amd64-microcode (2.20160316.1~deb8u1) stable; urgency=critical
+
+ * This is exactly the same release as 2.20160316.1
+
+ -- Henrique de Moraes Holschuh <hmh@debian.org> Sat, 19 Mar 2016 14:21:54 -0300
+
+amd64-microcode (2.20160316.1) unstable; urgency=critical
+
+ * Upstream release 20160316 built from linux-firmware:
+ + Updated Microcodes:
+ sig 0x00600f20, patch id 0x0600084f, 2016-01-25
+ + This microcode updates fixes a critical erratum on NMI handling
+ introduced by microcode patch id 0x6000832 from the 20141028 update.
+ The erratum is also present on microcode patch id 0x6000836.
+ + THIS IS A CRITICAL STABILITY AND SECURITY UPDATE FOR THE EARLIER
+ AMD PILEDRIVER PROCESSORS, including:
+ + AMD Opteron 3300, 4300, 6300
+ + AMD FX "Vishera" (43xx, 63xx, 83xx, 93xx, 95xx)
+ + AMD processors with family 21, model 2, stepping 0
+ * Robert Święcki, while fuzzing the kernel using the syzkaller tool,
+ uncovered very strange behavior on an AMD FX-8320, later reproduced on
+ other AMD Piledriver model 2, stepping 0 processors including the Opteron
+ 6300. Robert discovered, using his proof-of-concept exploit code, that
+ the incorrect behavior allows an unpriviledged attacker on an unpriviledged
+ VM to corrupt the return stack of the host kernel's NMI handler. At best,
+ this results in unpredictable host behavior. At worst, it allows for an
+ unpriviledged user on unpriviledged VM to carry a sucessful host-kernel
+ ring 0 code injection attack.
+ * The erratum is timing-dependant, easily triggered by workloads that cause
+ a high number of NMIs, such as running the "perf" tool.
+
+ -- Henrique de Moraes Holschuh <hmh@debian.org> Sat, 19 Mar 2016 14:02:44 -0300
+
amd64-microcode (2.20141028.1) unstable; urgency=medium
* Upstream release 20141028 built from linux-firmware:
diff -Nru amd64-microcode-2.20141028.1/debian/control amd64-microcode-2.20160316.1~deb8u1/debian/control
--- amd64-microcode-2.20141028.1/debian/control 2014-12-18 13:29:09.000000000 -0200
+++ amd64-microcode-2.20160316.1~deb8u1/debian/control 2016-03-19 14:21:48.000000000 -0300
@@ -10,7 +10,7 @@
XS-Autobuild: yes
Package: amd64-microcode
-Architecture: i386 amd64
+Architecture: i386 amd64 x32
Depends: ${misc:Depends}
Breaks: intel-microcode (<< 2)
Description: Processor microcode firmware for AMD CPUs
Binary files /tmp/fBt3hF3hZL/amd64-microcode-2.20141028.1/microcode_amd_fam15h.bin and /tmp/Xa6pgjObby/amd64-microcode-2.20160316.1~deb8u1/microcode_amd_fam15h.bin differ
diff -Nru amd64-microcode-2.20141028.1/microcode_amd_fam15h.bin.asc amd64-microcode-2.20160316.1~deb8u1/microcode_amd_fam15h.bin.asc
--- amd64-microcode-2.20141028.1/microcode_amd_fam15h.bin.asc 2014-12-17 18:30:04.000000000 -0200
+++ amd64-microcode-2.20160316.1~deb8u1/microcode_amd_fam15h.bin.asc 2016-03-19 14:21:48.000000000 -0300
@@ -1,11 +1,11 @@
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-iQEcBAABAgAGBQJUTqLvAAoJEOS+UznzKK5zyaIIAKZcXmU+sBO4YGH5Aq2SdRYe
-rlwE5oeYNh+AdzzLm9EqHwSC+MciFI7HqQz8PvKAsfaoD17mQjonIXga8l2/w3OW
-/vIJjJnu9QB2C9XpjAiQCxS5QaMtIfEEjVld+MeHs6Ld3PwGuAXCkxKcJ2sHLZd3
-UcwwHxcm98KYouogjVZoJeb226cjz6fzUVJK9t9yi2S+SWmIvkjSZEI6W0WFoFCL
-x0jM7lFNcusGtg5K6UsyAdwPwvfbBN5FoV29/DaP+/HA4GP/W/cgbQxS72skDJg5
-c/icP0ntAND2iprtTQXF9//mWdX2FLYD55eu+pShZmO8t4Qvq4tJgiVz3hJiK+U=
-=KBP3
+iQEcBAABAgAGBQJW6d1MAAoJEOS+UznzKK5zSxkH+gJLffKGRM9BHe0D0/fkb0Gs
+FZVp0eUNREOQoYwHJq9Ms1RebaZJkaUnd8SXCODJrqxDsxqUgunUtP6Qfh3Ru6fV
+n0wgFVISKSQVLDP+I/ANFbWA2KhV5e4LuLQp5cDSItv6916kmNlM5kxtJ5QBrNXu
+kr5bNReYgYTl7PSoCPuPfVILToG0ltZQMdKI1GImRCMVrYjGMbv8EyUC3r8ZbChG
+Lv6K0AsULA81lXBAW0JYlxu6cNv1MJ3mxttwCswaJNcd+Y11ZQA8r2sjJoWbNSlS
+nsDPLsUKE/RsW9MlMxiI2Jqo9PrZz923bu/cWMU1FPp+cJII0T7idWGUTVhQjc8=
+=MTxP
-----END PGP SIGNATURE-----
diff -Nru amd64-microcode-2.20141028.1/README amd64-microcode-2.20160316.1~deb8u1/README
--- amd64-microcode-2.20141028.1/README 2014-12-17 18:30:04.000000000 -0200
+++ amd64-microcode-2.20160316.1~deb8u1/README 2016-03-19 14:21:48.000000000 -0300
@@ -1,5 +1,19 @@
This amd64-microcode release was based on the linux-firmware tree.
+From: Sherry Hurwitz <sherry.hurwitz@amd.com>
+Subject: [PATCH 1/1] linux-firmware: Update AMD microcode patch firmware
+Date: 2016-03-17 06:56:11 GMT
+
+ linux-firmware: Update AMD microcode patch firmware
+
+ For AMD Family 15h Processors to fix bugs in prior microcode patch
+ file: amd-ucode/microcode_amd_fam15h.bin
+ md5sum: 2384ef1d8ec8ca3930b62d82ea5a3813
+
+ Version: 2016_03_16
+
+ Signed-off-by: Sherry Hurwitz <sherry.hurwitz@amd.com>
+
commit 8ac569dd3ca3ca685bd47ee86c1eeb6050864db3
Author: Sherry Hurwitz <sherry.hurwitz@amd.com>
Date: Thu Nov 6 19:38:26 2014 -0600
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: