Actions

Spectre Meltdown

From Whonix

whonixcheck might have refereed you to this page.

Note:

  • whonixcheck is a diagnostic tool which automates showing the diagnostic output of other diagnostic tools.
  • Whonix ™ is not the cause of the issue. Don't kill the messenger.
  • Spectre/Meltdown is a security vulnerability caused by flaws in processors.
  • This page explains the state of affairs on how to protect form this security vulnerability.

Platform Specific[edit]

Qubes[edit]

After getting all dom0 host upgrades and reboot this should be ok.

To launch a dom0 terminal, click the Qubes App Launcher (blue/grey "Q") and then open the Terminal Emulator (Xfce Terminal).

Qubes-whonix1.png

Upgrade Qubes dom0. This step is mandatory. [1]

sudo qubes-dom0-update

Reboot.

reboot

VirtualBox[edit]

There is no solution for VirtualBox yet. The bug has been reported to the VirtualBox developers. See VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed. The Whonix ™ developers depend on the VirtualBox developers for fixing this VirtualBox issue. Nevertheless:

Testers only! For more information please press on expand on the right.

These experimental Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:

  1. A host microcode upgrade.
  2. A host kernel upgrade.
  3. A VM kernel upgrade.
  4. A "not vulnerable" result from spectre-meltdown-checker run on the host.
  5. Installation of the latest VirtualBox version. [2]
  6. All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.

To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed and the associated VirtualBox forum discussion. [3] Users must patiently wait for VirtualBox developers to fix this bug.

On the host. [4] [5] [6] [7] [8] [9] [10]

VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-entry on
VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-entry on
VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-exit on
VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-exit on
VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-vm-entry on
VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-vm-entry on
VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-sched on
VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-sched on
VBoxManage modifyvm "Whonix-Gateway" --spec-ctrl on
VBoxManage modifyvm "Whonix-Workstation" --spec-ctrl on
VBoxManage modifyvm "Whonix-Gateway" --nestedpaging off
VBoxManage modifyvm "Whonix-Workstation" --nestedpaging off

Info These steps must be repeated for every Whonix or non-Whonix VirtualBox VM, including multiple and custom VMs.

The above instructions only apply to the default VM names Whonix-Gateway ™ and Whonix-Workstation ™. Therefore, if Multiple Whonix-Workstation ™s and/or Multiple Whonix-Gateway ™s are configured, then repeat these instructions using the relevant name/s.


  • Check back later for updated instructions. Stay Tuned.

KVM[edit]

Apply #Processor Microcode Updates on your host operating system. The updated mitigative host CPU instructions are passed through by default. No further action is needed.

Processor Microcode Updates[edit]

One recent example of a firmware vulnerability is the processor microcode update for modern chips to address speculative execution flaws. The Debian package is non-free software, therefore only available in the Debian nonfree repository, meaning it is not installed by default in all Whonix variants. [11] [12] Whonix recommends to avoid nonfree software but in this case idealism would result in insecurity.

It is unnecessary to apply these updates in standard Non-Qubes-Whonix ™ and Qubes-Whonix ™ guest VMs, as they do not have the ability to alter the microcode. However, processor microcode updates should always be applied on the host operating system (for processors by Intel or AMD) [13] and baremetal configurations like Physical Isolation. [14]

Microcode Package Check[edit]

In the following checks, the package is not installed if there is no output.

To check whether the microcode package is installed.

Debian based[edit]

On the host. Run.

dpkg -l | grep microcode

Qubes[edit]

In dom0. Run.

dnf list | grep microcode

The Qubes check should confirm the microcode_ctl.x86_64 package is already installed. [15]

Install Microcode Package[edit]

Intel[edit]

For Debian hosts

Package intel-microcode can be installed from Debian backports. This is non-ideal, see footnote. [16]

Note: the following instructions apply only to the Debian buster host operating system using Whonix 15.0.0.4.9. Other host operating systems and other Whonix versions may use a codename different to buster.

1. Open a terminal on the host.

2. Add the current Debian stable backports codename buster-backports to Debian apt sources. [17]

sudo su -c "echo -e 'deb http://http.debian.net/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/backports.list"

3. Update the package lists.

sudo apt-get update

4. Install the selected software.

sudo apt-get -t buster-backports install intel-microcode

The procedure is now complete.

5. Undo.

On occasion it is necessary to undo this configuration, for example when upgrading from Debian buster to bullseye. [18] To proceed, run.

sudo rm /etc/apt/sources.list.d/backports.list

AMD[edit]

For Debian hosts

Package amd64-microcode can be installed from Debian backports. This is non-ideal, see footnote. [16]

Note: the following instructions apply only to the Debian buster host operating system using Whonix 15.0.0.4.9. Other host operating systems and other Whonix versions may use a codename different to buster.

1. Open a terminal on the host.

2. Add the current Debian stable backports codename buster-backports to Debian apt sources. [19]

sudo su -c "echo -e 'deb http://http.debian.net/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/backports.list"

3. Update the package lists.

sudo apt-get update

4. Install the selected software.

sudo apt-get -t buster-backports install amd64-microcode

The procedure is now complete.

5. Undo.

On occasion it is necessary to undo this configuration, for example when upgrading from Debian buster to bullseye. [20] To proceed, run.

sudo rm /etc/apt/sources.list.d/backports.list

spectre-meltdown-checker[edit]

It is possible to check if the system is vulnerable to the Spectre and Meltdown attacks, which use flaws in modern chip design to bypass system protections.

Installation[edit]

Package spectre-meltdown-checker can be installed from Debian backports. This is non-ideal, see footnote. [21]

1. Boot Whonix-Workstation ™ (whonix-ws-15) TemplateVM.

2. Add the current Debian stable backports codename buster-backports to Debian apt sources.

Note: this applies to Whonix 15.0.0.4.9. Later Whonix versions may use a codename different to buster.

In Whonix-Workstation ™ (whonix-ws-15) TemplateVM, run.

sudo su -c "echo -e 'deb https://deb.debian.org/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/backports.list"

Alternatively, users who like Onionizing Repositories can set the .onion mirror.

sudo su -c "echo -e 'deb tor+http://vwakviie2ienjx6t.onion/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/backports.list"

3. Update the package lists.

sudo apt-get update

4. Install the select software.

sudo apt-get -t buster-backports install spectre-meltdown-checker

The procedure is now complete.

5. Undo.

On occasion it is necessary to undo this configuration, for example when upgrading from Debian buster to bullseye. [22] To proceed, run.

sudo rm /etc/apt/sources.list.d/backports.list

Usage[edit]

sudo spectre-meltdown-checker --paranoid ; echo $?

Forum Discussion[edit]

See: https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739

References[edit]

  1. VirtualBox version 5.2.18 or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.
  2. Also see the following Whonix forum discussion: Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)
  3. --ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
    https://www.virtualbox.org/manual/ch08.html

    There is a mistake in the VirtualBox manual stating enter which does not work. It is actually entry.

  4. https://www.virtualbox.org/manual/ch08.html

    --l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.

  5. --l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646”.
    https://www.virtualbox.org/manual/ch08.html

  6. https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646

    For users not concerned by this security issue, the default mitigation can be disabled using

    VBoxManage modifyvm name --l1d-flush-on-sched off

    Since we want to enable the security feature we set --l1d-flush-on-sched on.

  7. --spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
    https://www.virtualbox.org/manual/ch08.html

  8. According to this VirtualBox ticket --spec-ctrl should be set to on.
  9. --nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.

  10. Relevant Debian packages for processor microcode: Intel and amd64.
  11. Installing these updates by default would require the Debian nonfree repository, and logically also make Whonix images nonfree.
  12. ARM is less affected than Intel architecture.
  13. See: https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739
  14. This package is installed by default in Qubes to automatically protect users against hardware threats.
  15. 16.0 16.1 Users should Prefer Packages from Debian Stable Repository, but using backports is better than manual software installation or using third party package managers since this prefers APT. To contain the risk, Non-Qubes-Whonix ™ users might want to consider using Multiple Whonix-Workstation ™ and Qubes-Whonix ™ users might want to consider using Multiple Qubes-Whonix ™ TemplateVMs or Software Installation in a TemplateBasedVM.
  16. Or alternatively use the .onion mirror.
    sudo su -c "echo -e 'deb tor+http://vwakviie2ienjx6t.onion/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/backports.list"
  17. Most often this step applies before attempting major Whonix upgrades; upgrade instructions are also made available at that time (see Stay Tuned).
  18. Or alternatively use the .onion mirror.
    sudo su -c "echo -e 'deb tor+http://vwakviie2ienjx6t.onion/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/backports.list"
  19. Most often this step applies before attempting major Whonix upgrades; upgrade instructions are also made available at that time (see Stay Tuned).
  20. Users should Prefer Packages from Debian Stable Repository, but using backports is better than manual software installation or using third party package managers since this prefers APT. To contain the risk, Non-Qubes-Whonix ™ users might want to consider using Multiple Whonix-Workstation ™ and Qubes-Whonix ™ users might want to consider using Multiple Qubes-Whonix ™ TemplateVMs or Software Installation in a TemplateBasedVM.
  21. Most often this step applies before attempting major Whonix upgrades; upgrade instructions are also made available at that time (see Stay Tuned).

No user support in comments. See Support. Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.


Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.


Random News:

Check out the Whonix News Blog.


https | (forcing) onion

Follow: Twitter | Facebook | gab.ai | Stay Tuned | Whonix News

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian. Debian is a registered trademark owned by Software in the Public Interest, Inc.

Whonix ™ is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.