En Windows hay InSpectre (pequeño Standalone app, 126Kb)
GRC | InSpectre
No sé yo si ese InSpectre está bien actualizado.
Estoy usando un portátil de HP con la BIOS actualizada a la última semana y Windows 10 Pro actualizado a la última, y me dice que es vulnerable a Meltdown.
Y esto es lo que cuenta leyendo el texto que acompaña debajo:
This system's present situation:
This 64-bit version of Windows has been updated for full awareness of both the Spectre and the Meltdown vulnerabilities. If the system's hardware (see below) has also been updated, this system will not be vulnerable to these attacks.
This system's hardware has been updated with new features required to allow its operating system to protect against the Spectre vulnerabilities and/or to minimize their impact upon the system's performance. (Protection from the Meltdown vulnerability does not require BIOS or processor updates.)
This system's Intel processor provides high-performance protection from the Meltdown vulnerability. A properly updated operating system will be able to provide protection without significant system slowdown.
This system is not currently providing any protection against the Meltdown vulnerability. Either the operating system is unaware of this problem (which can be resolved by any operating system) or the operating system's protection has been deliberately disabled.
Due to the potential performance impact of these vulnerability protections, which may be particularly burdensome on older hardware and operating systems that cannot be updated, either one or both of these protections may be disabled with Windows registry settings. This system's "protection disable" is currently set as follows:
The system's registry is configured to enable both of the Spectre and Meltdown protections. Within the bounds of any limitations described above, Windows will work with the system's processor to prevent the exploitation of these vulnerabilities.
Hablamos de este tema
en este mismo hilo hace ya tiempo y a priori me fiaría más del script de PowerShell que mantiene el equipo de Microsoft, aunque su última versión 1.0.4 es del 15 de mayo de 2019
El script SpeculationControl es la versión 1.0.14 y se puede ejecutar desde PowerShell con el comando
Insertar CODE, HTML o PHP:
Install-Module -Name SpeculationControl
Y antes de ejecutarlo guardamos la directiva de ejecución con estos dos comandos, pues la cambiaremos para hacer el test.
Insertar CODE, HTML o PHP:
$SaveExecutionPolicy = Get-ExecutionPolicy
Set-ExecutionPolicy RemoteSigned -Scope Currentuser
A continuación ejecutamos el script descargado, importándolo
Insertar CODE, HTML o PHP:
Import-Module SpeculationControl
Get-SpeculationControlSettings
Viendo el resultado, no me queda claro que esté protegido al 100%. Antes ponía en rojo cuando tenías un problema y en verde cuando no, y era más fácil leerlo.
Y por último volvemos a dejar la directiva de ejecución como estaba:
Insertar CODE, HTML o PHP:
Set-ExecutionPolicy $SaveExecutionPolicy -Scope Currentuser
www.elotrolado.net
www.linuxadictos.com
www.genbeta.com
elpais.com
CVE-2017-5753 Bounds Check Bypass (Spectre Variant 1)
theobjective.com
cincodias.elpais.com
github.com
vuldb.com
