How to check for Spectre vulnerabilities and similar threats for my relay to be secure?

Question

Setup

I'm running my new (2 days old) relay using:

• my own dedicated server Dell T20 with hardware:

  • CPU: Intel Xeon E3-1225 v3 @ 3.20GHz (Haswell)

  • RAM: 32 GB DDR3 ECC

  • NET: overall maximum bandwidth of 30 Mbit down / 30 Mbit up

• UEFI / BIOS patch version A19 (latest)

• Debian version 10 Buster (testing)

• kernel version 4.19.0-2 (latest)

• intel-microcode package installed

• Tor version 0.3.5.8 (recommended)

• I monitor the relay with Nyx all day long

---

Question

Nowadays, with all kinds of Spectre vulnerabilities and similar threats, I would like to know if my hardware and the operating system is safe from these and if I can do anything else than regularly check for all updates?

Answer 1

Spectre check script available

I have found one very good and maintained shell script to check for these vulnerabilities. It's hosted on GitHub:

https://github.com/speed47/spectre-meltdown-checker/releases/latest

So, today (2019-Mar-08), there is a release v0.40 available, but the link above will always take you to the latest release.

---

How to use it

It's as simple as downloading the Source code (tar.gz), extracting it, and running the script with root privileges like so:

sudo ./spectre-meltdown-checker.sh

Note, that you might get more information than you need or want. If you want quick and short info, run:

sudo ./spectre-meltdown-checker.sh --batch text

---

Example output

Taken from the short version on my server above:

CVE-2017-5753: OK (Mitigation: __user pointer sanitization)
CVE-2017-5715: OK (Full retpoline + IBPB are mitigating the vulnerability)
CVE-2017-5754: OK (Mitigation: PTI)
CVE-2018-3640: OK (your CPU microcode mitigates the vulnerability)
CVE-2018-3639: OK (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
CVE-2018-3615: OK (your CPU vendor reported your CPU model as not vulnerable)
CVE-2018-3620: OK (Mitigation: PTE Inversion)
CVE-2018-3646: OK (this system is not running an hypervisor)