Re: Question on CVE-2017-5754 on Debian 8.9

[Michael Fothergill <michael.fothergill@gmail.com>]

On 24 January 2018 at 14:11, Vincent Lefevre <vincent@vinc17.net> wrote:

On 2018-01-24 14:44:18 +0100, Sven Hartge wrote:
> Michael Fothergill <michael.fothergill@gmail.com> wrote:
> > On 24 January 2018 at 12:58, Sven Hartge <sven@svenhartge.de> wrote:
>
> >> Michael Fothergill <michael.fothergill@gmail.com> wrote:
>
> >> > The link within the above one:
> >>> https://gcc.gnu.org/ml/gcc/2018-01/msg00148.html
> >>> also has a link to the ftp download for the release candidate version of
> >>> gcc 7.3 ie 7.3.0rc1 which does actually work for spectre and retpoline.
>
> >> Debian Sid got gcc-7.3.0rc2 last night, the package is still named gcc-7
> >> (7.2.0-20) though.
>
> > Does that mean that if you upgrade to sid and installed gcc 7.2.0 you
> > would actually get 7.3.0rc2 in practice?
>
> Unless I interpret the changelog wrong: yes.

But the changelogs don't mention anything about Spectre and retpoline.

​It's OK.  As long as you really do end up installing gcc 7.3.0 rc2 we know it can handle the compilation of kernel 4.14.14 correctly to

make the KPTI and retpoline patches work...........

So the changelog doesn't matter.

Cheers

MF​

 

--
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)