Which intel-ucode file do I need?

[JP18]

I saw something that linked to this warning: https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html#tab-blade-1-1

It says to go to this GitHub to get the ucode file that will mitigate the risk. https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/intel-ucode

I can't tell which ucode file is the correct file to use. I'm using Linux. Here is information about my processor based on lscpu:

Architecture:            x86_64
 CPU op-mode(s):        32-bit, 64-bit
 Address sizes:         39 bits physical, 48 bits virtual
 Byte Order:            Little Endian
CPU(s):                  8
 On-line CPU(s) list:   0-7
Vendor ID:               GenuineIntel
 Model name:            Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
   CPU family:          6
   Model:               142
   Thread(s) per core:  2
   Core(s) per socket:  4
   Socket(s):           1
   Stepping:            10
   CPU max MHz:         4000.0000
   CPU min MHz:         400.0000
   BogoMIPS:            3999.93
   Flags:               fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clfl
                        ush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm con
                        stant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpui
                        d aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma  
                        cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes
                         xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_sin
                        gle pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid ept_ad fs
                        gsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid mpx rdseed adx smap clflu
                        shopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hw
                        p_notify hwp_act_window hwp_epp flush_l1d

Is there a ucode file in that GitHub linked above that matches what I need? My computer is at least 5 years old, so maybe it's not listed there?

[Mike_Intel]

Hello JP18,

Thank you for posting in Intel community Forum.

Before we proceed, let me gather more details.

1. When you say U-code, are you asking for Microcode for the processor?

2. What is the brand and model of your motherboard?

If you have questions, please let us know. Thank you.

Best regards,
Michael L.
Intel Customer Support Technician

[JP18]

Hi, Michael.

I am trying to find the solution to this warning regarding Spectre V2 threats on linux. https://kb.cert.org/vuls/id/155143

That post includes this language:

"Solution

Please update your software according to the recommendations from respective vendors with the latest mitigations available to address this vulnerability and its variants."

So, I'm trying to find code that applies a patch to my processor that can mitigate the threat from Spectre V2. I don't know if that's "U-code" or Microcode or what. There was a link to this page for solutions:

https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html

Specifically, Footnote 2. The GitHub page says "u-code", so that's why I called it u-code. Whatever it's called.

Here is the motherboard info:

# dmidecode 3.3
Getting SMBIOS data from sysfs.
SMBIOS 3.1.0 present.

Handle 0x0002, DMI type 2, 17 bytes
Base Board Information
       Manufacturer: HP
       Product Name: 8416
       Version: KBC Version 05.37.00
       Serial Number: PGWJP00WBC90EF
       Asset Tag:   
       Features:
               Board is a hosting board
       Location In Chassis:   
       Chassis Handle: 0x0000
       Type: Motherboard
       Contained Object Handles: 0

Sincerely,

JP

[JP18]

It occurs to me that I wrote "u-code" because that's what was on the GitHub page. The GitHub page used the English "u" as the closest thing to the Greek symbol for "micro". Something to do with UTF-8 vs ASCII or whatever and which of those is allowed in the title of a GitHub page. So, yes, I'm looking for microcode.

[Mike_Intel]

Hello JP18,

Thank you for the clarification.

Microcode can only be loaded via BIOS update. Usually, Please check this link for more details:

https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/microcode-update-guidance.html

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician

[JP18]

That link looks helpful, but it doesn't answer my question: which microcode file do I need from the GitHub repo I referred to in OP?

I used dmesg and I get this:

smpboot: CPU0: Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz (family: 0x6, model: 0x8e, ste
pping: 0xa)

So, I think the family+model+stepping is: 6-8e-a

Which leads me to think I need the microcode from here:

https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/main/intel-ucode/06-8e-0a

Is this correct?

[cowbat · Accepted solution]

"Microcode can only be loaded via BIOS update."

Most Linux distributions usually attempt to update the CPU microcode during boot, using microcode_ctl. Most Linux distributions supply an up-to-date microcode file (CPU microcode can also be updated from within Windows: VMware had a tool to do this called the 'VMware CPU Microcode Update Driver' aka cpumcupdate, but it is no longer available from them: https://web.archive.org/web/20230321132457/https://flings.vmware.com/vmware-cpu-microcode-update-driver ).

For JP18's processor (with family+model+stepping of 6-8e-a), no new microcode has been issued by Intel since the 20230808 release according to https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/intel-ucode . If they are running a Linux distribution with updates more recent than that, they are probably already using the most up-to-date microcode for that CPU.

[JP18]

Thanks for the reply, cowbat. I found a script for checking for CPU vulnerabilities. This is the GitHub repo for the script:

https://github.com/speed47/spectre-meltdown-checker/blob/master/FAQ.md

I ran the script. The result is lengthy.

The TL;DR is that there seem to be some vulnerabilities that could be addressed by an update to microcode.

While I'd like to apply a patch due the apparent vulnerabilities, some of the reading I did about doing so advised against messing with microcode on one's own. I'm no guru and I've never tried to patch microcode before, thus I'm hesitant. I will try to see if there has been some kind of patch provided by my distro in the last couple of years.

This is the script's output:

Spectre and Meltdown mitigation detection tool v0.46+

Checking for vulnerabilities on current system
Kernel is Linux 5.15.145 #1 SMP PREEMPT Sun Dec 24 00:07:06 CST 2023 x86_64
CPU is Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available:  YES 
* CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available:  YES 
* CPU indicates STIBP capability:  YES  (Intel STIBP feature bit)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability:  YES  (Intel SSBD)
* L1 data cache invalidation
* CPU indicates L1D flush capability:  YES  (L1D flush feature bit)
* Microarchitectural Data Sampling
* VERW instruction is available:  NO 
* Indirect Branch Predictor Controls
* Indirect Predictor Disable feature is available:  NO 
* Bottomless RSB Disable feature is available:  NO 
* BHB-Focused Indirect Predictor Disable feature is available:  NO 
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability:  NO 
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO 
* CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO):  NO 
* CPU explicitly indicates not being affected by Variant 4 (SSB_NO):  NO 
* CPU/Hypervisor indicates L1D flushing is not necessary on this system:  NO 
* Hypervisor indicates host CPU might be affected by RSB underflow (RSBA):  NO 
* CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO):  NO 
* CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO):  NO 
* CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO):  NO 
* CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR):  NO 
* CPU explicitly indicates being affected by GDS and having mitigation control (GDS_CTRL):  NO 
* CPU explicitly indicates not being affected by GDS (GDS_NO):  NO 
* CPU supports Transactional Synchronization Extensions (TSX):  NO 
* CPU supports Software Guard Extensions (SGX):  YES 
* CPU supports Special Register Buffer Data Sampling (SRBDS):  NO 
* CPU microcode is known to cause stability problems:  NO  (family 0x6 model 0x8e stepping 0xa ucode 0x9a cpuid 0x806ea pfid 0x1)
* CPU microcode is the latest known available version:  UNKNOWN  (latest microcode version for your CPU model is unknown)
* CPU vulnerability to the speculative execution attack variants
* Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass):  YES 
* Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES 
* Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  YES 
* Affected by CVE-2018-3640 (Variant 3a, rogue system register read):  YES 
* Affected by CVE-2018-3639 (Variant 4, speculative store bypass):  YES 
* Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  YES 
* Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  YES 
* Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  YES 
* Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)):  YES 
* Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)):  YES 
* Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)):  YES 
* Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)):  YES 
* Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)):  YES 
* Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)):  YES 
* Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)):  YES 
* Affected by CVE-2023-20593 (Zenbleed, cross-process information leak):  NO 
* Affected by CVE-2022-40982 (Downfall, gather data sampling (GDS)):  YES 
* Affected by CVE-2023-20569 (Inception, return address security (RAS)):  NO 
* Affected by CVE-2023-23583 (Reptar, redundant prefix issue):  NO 

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface:  YES  (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)
* Kernel has array_index_mask_nospec:  YES  (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch:  NO 
* Kernel has mask_nospec64 (arm64):  NO 
* Kernel has array_index_nospec (arm64):  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: usercopy/swapgs barriers and __user pointer sanitization)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface:  YES  (Mitigation: IBRS, IBPB: conditional, STIBP: conditional, RSB filling, PBRSB-eIBRS: Not affected)
* Mitigation 1
* Kernel is compiled with IBRS support:  YES 
* IBRS enabled and active:  YES 
* Kernel is compiled with IBPB support:  YES 
* IBPB enabled and active:  YES 
* Mitigation 2
* Kernel has branch predictor hardening (arm):  NO 
* Kernel compiled with retpoline option:  YES 
* Kernel supports RSB filling:  YES 
> STATUS:  NOT VULNERABLE  (IBRS + IBPB are mitigating the vulnerability)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface:  YES  (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI):  YES 
* PTI enabled and active:  YES 
* Reduced performance impact of PTI:  YES  (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: PTI)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability:  YES 
> STATUS:  NOT VULNERABLE  (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface:  YES  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB):  YES  (found in /proc/self/status)
* SSB mitigation is enabled and active:  YES  (per-thread through prctl)
* SSB mitigation currently active for selected processes:  YES  (dhcpcd firefox-bin)
> STATUS:  NOT VULNERABLE  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability:  YES 
> STATUS:  NOT VULNERABLE  (your CPU microcode mitigates the vulnerability)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface:  YES  (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)
* Kernel supports PTE inversion:  YES  (found in kernel image)
* PTE inversion enabled and active:  YES 
> STATUS:  NOT VULNERABLE  (Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor:  NO 
* Mitigation 1 (KVM)
* EPT is disabled:  NO 
* Mitigation 2
* L1D flush is supported by kernel:  YES  (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled:  YES  (conditional flushes)
* Hardware-backed L1D flush supported:  YES  (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled:  YES 
> STATUS:  NOT VULNERABLE  (this system is not running a hypervisor)

CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active:  NO 
* SMT is either mitigated or disabled:  NO 
> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active:  NO 
* SMT is either mitigated or disabled:  NO 
> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active:  NO 
* SMT is either mitigated or disabled:  NO 
> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: Clear CPU buffers attempted, no microcode; SMT vulnerable)
* Kernel supports using MD_CLEAR mitigation:  YES  (found md_clear implementation evidence in kernel image)
* Kernel mitigation is enabled and active:  NO 
* SMT is either mitigated or disabled:  NO 
> STATUS:  VULNERABLE  (Your kernel supports mitigation, but your CPU microcode also needs to be updated to mitigate the vulnerability)

CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'
* Mitigated according to the /sys interface:  YES  (Not affected)
* TAA mitigation is supported by kernel:  YES  (found tsx_async_abort in kernel image)
* TAA mitigation enabled and active:  NO 
> STATUS:  NOT VULNERABLE  (Not affected)

CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'
* Mitigated according to the /sys interface:  YES  (KVM: Mitigation: VMX disabled)
* This system is a host running a hypervisor:  NO 
* iTLB Multihit mitigation is supported by kernel:  YES  (found itlb_multihit in kernel image)
* iTLB Multihit mitigation enabled and active:  YES  (KVM: Mitigation: VMX disabled)
> STATUS:  NOT VULNERABLE  (this system is not running a hypervisor)

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: No microcode)
* SRBDS mitigation control is supported by the kernel:  YES  (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active:  NO 
> STATUS:  VULNERABLE  (Your CPU microcode may need to be updated to mitigate the vulnerability)

CVE-2023-20593 aka 'Zenbleed, cross-process information leak'
* Zenbleed mitigation is supported by kernel:  YES  (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active:  N/A  (CPU is incompatible)
* Zenbleed mitigation is supported by CPU microcode:  NO 
> STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected)

CVE-2022-40982 aka 'Downfall, gather data sampling (GDS)'
* Mitigated according to the /sys interface:  NO  (Vulnerable: No microcode)
* GDS is mitigated by microcode:  NO 
* Kernel supports software mitigation by disabling AVX:  YES  (found gather_data_sampling in kernel image)
* Kernel has disabled AVX as a mitigation:  NO  (AVX support is enabled)
> STATUS:  VULNERABLE  (Vulnerable: No microcode)

CVE-2023-20569 aka 'Inception, return address security (RAS)'
* Mitigated according to the /sys interface:  YES  (Not affected)
* Kernel supports mitigation:  YES  (found spec_rstack_overflow in kernel image)
* Kernel compiled with SRSO support:  YES 
* Kernel compiled with IBPB_ENTRY support:  YES 
> STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected)

CVE-2023-23583 aka 'Reptar, redundant prefix issue'
> STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected)

> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:KO CVE-2023-20593:OK CVE-2022-40982:KO CVE-2023-20569:OK CVE-2023-23583:OK

[JP18]

I thought I replied to this. I used a script that can find vulnerabilities in a CPU. https://github.com/speed47/spectre-meltdown-checker and it indicates that the CPU is vulnerable and that there are some microcode updates that can address some of the vulnerabilities. It seems like I'll have to see what updates my distro has provided and maybe contemplate how to proceed.

I appreciate cowbat confirming the version of microcode I need. That was all I was asking for to begin with.

[cowbat]

What's the full output of the spectre-meltdown-checker script on the system with that CPU?

What Linux distro are you using?

According to the data source it uses, https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html , CPUID Family_Model 06_8E with Stepping A is advised by Intel to have the 0xf4 microcode update (MCU) in order to mitigate the most recent vulnerability (https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) that requires a microcode update. INTEL-SA-00828 was released on 08/08/2023 which agrees with the most recent microcode for your CPU from https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/main/intel-ucode

I'd be amazed (and disappointed) if any current Linux distro isn't shipping CPU microcode updates that include that 20230808 release, some 9 months after Intel released it. Frankly, I'd expect even the most recent 20240312 release to be included by now, nearly 2 months later. If you're missing the most recent microcode update, perhaps you don't have the microcode_ctl package installed or configured to run on boot?

[JP18]

The output is quite lengthy.

The distro is Slackware. I have to look to see if the update was installed or not.

[Mike_Intel]

Hello JP18,

Thank you for the quick reply. 

It is recommended to contact the manufacturer of the board for more details microcode since it is updated via BIOS update.

They should be able to explained if your system already have the needed update. 

If you have questions, please let us know. Thank you.

Best regards,

Michael L.

Intel Customer Support Technician