Re: CVE-2017-5715

To: Georgi Naplatanov <gosho@oles.biz>, debian-security@lists.debian.org
Subject: Re: CVE-2017-5715
From: Leandro Cunha <leandrocunha016@gmail.com>
Date: Fri, 25 Mar 2022 14:19:21 -0300
Message-id: <[🔎] CAGEayXNJ3SjjWoUnTU3vjLFvcuSJ-chDdMUrHrjhWoBYNEaqOQ@mail.gmail.com>
In-reply-to: <[🔎] 6f953dc4-0986-ae48-149b-016c143c2db5@oles.biz>
References: <[🔎] a959b794-e226-1dbd-45ec-ff727601db36@oles.biz> <[🔎] 5f697f73-192f-4bed-975f-20466a99046d@gmx.com> <[🔎] fc5189eb-4105-5e73-fc0a-ec0bf7b19b67@oles.biz> <[🔎] CAGEayXMP-KXznSyFkf44ydT8Mxo=Xq9SoEiJX=yfXKUdYzE_+g@mail.gmail.com> <[🔎] 54c4196b-16b9-de95-bdd6-51323c685c17@gmx.com> <[🔎] 7396efab-f7bb-3984-cb41-3df2350bb6ca@oles.biz> <[🔎] CAGEayXMfkjNz9ouL34PzDvpte-ZQiwn-V3GOkCfeWM+hRNcJ_g@mail.gmail.com> <[🔎] ffc3925d-58cf-3782-efd9-3b12e4114d4d@oles.biz> <[🔎] CAGEayXNJ5ONmS=uyXMcDf_zW+8djF0fE_2PSH7627YqbGNkt7g@mail.gmail.com> <[🔎] 6f953dc4-0986-ae48-149b-016c143c2db5@oles.biz>

Hi,

On Fri, Mar 25, 2022 at 4:19 AM Georgi Naplatanov <gosho@oles.biz> wrote:
>
> On 3/25/22 03:24, Leandro Cunha wrote:
> > Hi,
> >
> > On Wed, Mar 23, 2022 at 6:18 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>
> >> On 3/23/22 22:43, Leandro Cunha wrote:
> >>> Hi,
> >>>
> >>> On Wed, Mar 23, 2022 at 2:33 PM Georgi Naplatanov <gosho@oles.biz> wrote:
> >>>>
> >>>> On 3/23/22 18:35, piorunz wrote:
> >>>>> On 23/03/2022 15:41, Leandro Cunha wrote:
> >>>>>
> >>>>>> Please, take into consideration what is in the link and you can
> >>>>>> consult through
> >>>>>> it about CVE: https://security-tracker.debian.org/tracker/CVE-2017-5715
> >>>>>
> >>>>> Leandro,
> >>>>> I've been on this website before I posted with spectre-meltdown-checker
> >>>>> results. I have vulnerable status just like author of this topic. I am
> >>>>> on intel-microcode 3.20210608.2, and by the look of it, this bug
> >>>>> supposed to be fixed in:
> >>>>>
> >>>>> "intel-microcode: Some microcode updates to partially adress
> >>>>> CVE-2017-5715 included in 3.20171215.1
> >>>>> Further updates in 3.20180312.1"
> >>>>>
> >>>>> So my version of microcode is 3-4 years newer than that.
> >>>>>
> >>>>> Is it microcode problem, or spectre-meltdown-checker displaying wrong
> >>>>> information, or something else entirely?
> >>>>>
> >>>>
> >>>> I want to mention that on the same computer with kernel Debian 5.10.92-2
> >>>>
> >>>> spectre-meltdown-checker
> >>>>
> >>>> reports that the system is not vulnerable to CVE-2017-5715
> >>>>
> >>>> Kind regards
> >>>> Georgi
> >>>>
> >>>
> >>> This script is reporting an already patched CVE as vulnerable.
> >>
> >>
> >> Are you sure this behavior on 5.10.103-1 is not some kind of regression?
> >> What is the evidence that vulnerability is still fixed?
> >>
> >>
> >> Kind regards
> >> Georgi
> >>
> >
> > When replying to your email I was aware of the script issue that was reporting
> > several already resolved CVEs as unresolved. As Salvatore sent the issue link.
> > But it seems to me that this problem was solved 7 days ago, it would be
> > interesting if there was an update or a backport to stable.
> >
>
> Hi Leandro,
>
> I also think that an update would be nice.
>
> Kind regards
> Georgi
>

I applied a patch from upstream and repackaged it from unstable.
And this CVE is displayed as resolved.

-- 
Cheers,
Leandro Cunha
Software Engineer and Debian Contributor

Reply to:

Follow-Ups:
- Re: CVE-2017-5715
  - From: Georgi Naplatanov <gosho@oles.biz>

References:
- CVE-2017-5715
  - From: Georgi Naplatanov <gosho@oles.biz>
- Re: CVE-2017-5715
  - From: piorunz <piorunz@gmx.com>
- Re: CVE-2017-5715
  - From: Georgi Naplatanov <gosho@oles.biz>
- Re: CVE-2017-5715
  - From: Leandro Cunha <leandrocunha016@gmail.com>
- Re: CVE-2017-5715
  - From: piorunz <piorunz@gmx.com>
- Re: CVE-2017-5715
  - From: Georgi Naplatanov <gosho@oles.biz>
- Re: CVE-2017-5715
  - From: Leandro Cunha <leandrocunha016@gmail.com>
- Re: CVE-2017-5715
  - From: Georgi Naplatanov <gosho@oles.biz>
- Re: CVE-2017-5715
  - From: Leandro Cunha <leandrocunha016@gmail.com>
- Re: CVE-2017-5715
  - From: Georgi Naplatanov <gosho@oles.biz>

Prev by Date: Re: CVE-2017-5715
Next by Date: Re: CVE-2017-5715
Previous by thread: Re: CVE-2017-5715
Next by thread: Re: CVE-2017-5715
Index(es):
- Date
- Thread