Re: Is Debian Linux protected against the Meltdown and Spectre security flaws?

[Reco <recoverym4n@gmail.com>]

On Mon, Feb 19, 2018 at 05:24:18PM +0000, Michael Fothergill wrote:
> On 19 February 2018 at 17:03, Reco <recoverym4n@gmail.com> wrote:
> 
> >         Hi.
> >
> > On Mon, Feb 19, 2018 at 04:40:19PM +0000, Michael Fothergill wrote:
> > > I had thought up to now that e.g. kernel 4.15.4-1 was new enough that if
> > > you compiled it with gcc 7.3 then the spectre fix would then work.
> >
> > Not unless you apply the retpoline patch to the gcc.
> >
> > For instance, just today said patch was applied to the Debian stable
> > version of gcc, gcc-4.9:
> >
> > https://www.debian.org/security/2018/dsa-4117
> >
> > Reco
> >
> > Doesn't that mean that if you installed this version of gcc 4.9 and one
> of the most recent kernels debian has e.g. 4.15.4-1 above
> then it will be able to correct install the microcode or whatever it is
> called and you don't need a compiler as new as gcc 7.3?
> 
> If so that is excellent news indeed.

I'm unsure of linux-4.15, but it should be possible to use patched
gcc-4.9 to build backported linux-4.14+89. Whenever they applied the
second part of retpoline patch to this kernel remains to seen.

Being lazy I'll just wait while Debian Kernel Team builds a patched
kernel for all of us.

Reco