Footnotes and Experimental Spectre / Meltdown Defenses
Please press on expand on the right.
Testers only! For more information please press on expand on the right.
These experimental Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:
- A host microcode upgrade.
- A host kernel upgrade.
- A VM kernel upgrade.
- A "not vulnerable" result from spectre-meltdown-checker run on the host.
- Installation of the latest VirtualBox version. 
- All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.
To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed and the associated VirtualBox forum discussion.  Users must patiently wait for VirtualBox developers to fix this bug.
VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-exit on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-vm-entry on VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-sched on VBoxManage modifyvm "Whonix-Gateway" --spec-ctrl on VBoxManage modifyvm "Whonix-Workstation" --spec-ctrl on VBoxManage modifyvm "Whonix-Gateway" --nestedpaging off VBoxManage modifyvm "Whonix-Workstation" --nestedpaging off
|These steps must be repeated for every Whonix or non-Whonix VirtualBox VM, including multiple and custom VMs.|
The above instructions only apply to the default VM names Whonix-Gateway and Whonix-Workstation. Therefore, if Multiple Whonix-Workstations and/or Multiple Whonix-Gateways are configured, then repeat these instructions using the relevant name/s.
- This change reduces the number of steps users are required to apply (one download instead of two). No functionality was lost. This improves usability, makes Whonix downloads more standardized compared to other software, and simplifies Whonix infrastructure maintenance work. The Whonix split VM design (separate Whonix-Gateway and Whonix-Workstation) remains unmodified.
- By using the Tor Browser Bundle (TBB). For an introduction, see Tor Browser. See also Hide Tor and Whonix from your ISP.
- It does not matter if the bulk download is done over an insecure channel if OpenPGP verification is used at the end.
- OpenPGP is a standard for data encryption that provides cryptographic privacy and authentication through the use of keys owned by its users.
This is required since VirtualBox in unavailable in Debian
- This is non-ideal, see next footnote.
- Users should Prefer Packages from Debian Stable Repository, but using backports is better than manual software installation or using third party package managers since this prefers APT. To contain the risk, Non-Qubes-Whonix users might want to consider using Multiple Whonix-Workstations and Qubes-Whonix users might want to consider using Multiple Qubes-Whonix TemplateVMs or Software Installation in a TemplateBasedVM.
- Or alternatively use the .onion mirror.
sudo su -c "echo -e 'deb tor+http://vwakviie2ienjx6t.onion/debian stretch-backports main contrib' > /etc/apt/sources.list.d/backports.list"
- Most often this step applies before attempting major Whonix upgrades; upgrade instructions are also made available at that time (see stay tuned).
Read License Agreement.
vboxmanage import Whonix-XFCE-220.127.116.11.6.ova --vsys 0 --eula show --vsys 1 --eula show
vboxmanage import Whonix-XFCE-18.104.22.168.6.ova --vsys 0 --eula accept --vsys 1 --eula accept
5.2.18or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.
- Also see the following Whonix forum discussion: Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)
--ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
There is a mistake in the VirtualBox manual stating
enterwhich does not work. It is actually
--l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.
For users not concerned by this security issue, the default mitigation can be disabled using
VBoxManage modifyvm name --l1d-flush-on-sched off
Since we want to enable the security feature we set
--spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
According to this VirtualBox ticket
--spec-ctrlshould be set to
--nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.
No user support in comments. See Support.
Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix, then Edit! Edits are held for moderation.
Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix is a trademark. Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix itself. (Why?)