I’ve updated my system and I’m now on kernel 6.1.41-1 but the spectre-meltdown-checker tool still says that my system is vulnerable to Zenbleed.
Did you also reboot your system?
Yes, an old habit from the windows times, always rebooting after a big update 
FYI my CPU information:
CPU:
Info: model: AMD Ryzen 9 3900X bits: 64 type: MT MCP arch: Zen 2 gen: 3
level: v3 note: check built: 2020-22 process: TSMC n7 (7nm) family: 0x17 (23)
model-id: 0x71 (113) stepping: 0 microcode: 0x8701021
Topology: cpus: 1x cores: 12 tpc: 2 threads: 24 smt: enabled cache:
L1: 768 KiB desc: d-12x32 KiB; i-12x32 KiB L2: 6 MiB desc: 12x512 KiB
L3: 64 MiB desc: 4x16 MiB
Speed (MHz): avg: 2267 high: 3800 min/max: 2200/4672 boost: enabled
scaling: driver: acpi-cpufreq governor: schedutil cores: 1: 3800 2: 2200
3: 2200 4: 2200 5: 2196 6: 2196 7: 2372 8: 2200 9: 2200 10: 2208 11: 2200
12: 2200 13: 2200 14: 2052 15: 2200 16: 2200 17: 2200 18: 2200 19: 2200
20: 2200 21: 2200 22: 2200 23: 2200 24: 2200 bogomips: 182125
Flags: 3dnowprefetch abm adx aes aperfmperf apic arat avic avx avx2 bmi1
bmi2 bpext cat_l3 cdp_l3 clflush clflushopt clwb clzero cmov cmp_legacy
constant_tsc cpb cpuid cqm cqm_llc cqm_mbm_local cqm_mbm_total
cqm_occup_llc cr8_legacy cx16 cx8 de decodeassists extapic extd_apicid
f16c flushbyasid fma fpu fsgsbase fxsr fxsr_opt ht hw_pstate ibpb ibs
irperf lahf_lm lbrv lm mba mca mce misalignsse mmx mmxext monitor movbe
msr mtrr mwaitx nonstop_tsc nopl npt nrip_save nx osvw overflow_recov pae
pat pausefilter pclmulqdq pdpe1gb perfctr_core perfctr_llc perfctr_nb
pfthreshold pge pni popcnt pse pse36 rapl rdpid rdpru rdrand rdseed rdt_a
rdtscp rep_good sep sev sev_es sha_ni skinit smap smca smep ssbd sse sse2
sse4_1 sse4_2 sse4a ssse3 stibp succor svm svm_lock syscall tce topoext
tsc tsc_scale umip v_spec_ctrl v_vmsave_vmload vgif vmcb_clean vme vmmcall
wbnoinvd wdt x2apic xgetbv1 xsave xsavec xsaveerptr xsaveopt
Vulnerabilities:
Type: itlb_multihit status: Not affected
Type: l1tf status: Not affected
Type: mds status: Not affected
Type: meltdown status: Not affected
Type: mmio_stale_data status: Not affected
Type: retbleed mitigation: untrained return thunk; SMT enabled with STIBP
protection
Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via
prctl
Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer
sanitization
Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, STIBP:
always-on, RSB filling, PBRSB-eIBRS: Not affected
Type: srbds status: Not affected
Type: tsx_async_abort status: Not affected
CVE-2023-20593 aka 'Zenbleed, cross-process information leak'
* Zenbleed mitigation is supported by kernel: YES (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active: UNKNOWN (No read permission for /dev/cpu/0/msr)
* Zenbleed mitigation is supported by CPU microcode: NO
> STATUS: VULNERABLE (Your kernel is too old to mitigate Zenbleed and your CPU microcode doesn't mitigate it either)
Output of uname -a:
Linux NYFB 6.1.41-1-MANJARO #1 SMP PREEMPT_DYNAMIC Tue Jul 25 09:17:30 UTC 2023 x86_64 GNU/Linux
Edit: Interesting that this shows 25th July, even if its the 27th
Ah so it is refering to that, thanks for the explanation.
Interesting that I’m currently the only one with that issue.
@philm
After running dmesg|grep microcode this is what it outputed:
[ 0.320220] Zenbleed: please update your microcode for the most optimal fix
[ 0.905046] microcode: CPU0: patch_level=0x08701021
[ 0.905050] microcode: CPU1: patch_level=0x08701021
[ 0.905053] microcode: CPU2: patch_level=0x08701021
[ 0.905059] microcode: CPU3: patch_level=0x08701021
[ 0.905066] microcode: CPU4: patch_level=0x08701021
[ 0.905071] microcode: CPU5: patch_level=0x08701021
[ 0.905076] microcode: CPU6: patch_level=0x08701021
[ 0.905083] microcode: CPU7: patch_level=0x08701021
[ 0.905087] microcode: CPU8: patch_level=0x08701021
[ 0.905093] microcode: CPU9: patch_level=0x08701021
[ 0.905098] microcode: CPU10: patch_level=0x08701021
[ 0.905103] microcode: CPU11: patch_level=0x08701021
[ 0.905107] microcode: CPU12: patch_level=0x08701021
[ 0.905109] microcode: CPU13: patch_level=0x08701021
[ 0.905112] microcode: CPU14: patch_level=0x08701021
[ 0.905116] microcode: CPU15: patch_level=0x08701021
[ 0.905121] microcode: CPU16: patch_level=0x08701021
[ 0.905125] microcode: CPU17: patch_level=0x08701021
[ 0.905130] microcode: CPU18: patch_level=0x08701021
[ 0.905135] microcode: CPU19: patch_level=0x08701021
[ 0.905139] microcode: CPU20: patch_level=0x08701021
[ 0.905143] microcode: CPU21: patch_level=0x08701021
[ 0.905148] microcode: CPU22: patch_level=0x08701021
[ 0.905152] microcode: CPU23: patch_level=0x08701021
[ 0.905155] microcode: Microcode Update Driver: v2.2.
It seems as if the microcode was somehow not installed or I need to do something additional?
For reference:
Running the tool as a normal user reports the vulnerable state for zenbleeed, same as posted above
Running with sudo (as recommended) does not in my case with a ryzen 5 CPU & 6.4.6-1 and updated amd-ucode (20230724.59fbffa9-1) (I’m on testing branch)
sudo spectre-meltdown-checker
...
CVE-2023-20593 aka 'Zenbleed, cross-process information leak'
* Zenbleed mitigation is supported by kernel: YES (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active: YES (FP_BACKUP_FIX bit set in DE_CFG)
* Zenbleed mitigation is supported by CPU microcode: NO
> STATUS: NOT VULNERABLE (Your kernel mitigates Zenbleed)
Edit: tested with kernel 6.1.41-1 and getting the same results.
[ 0.002423] Zenbleed: please update your microcode for the most optimal fix
[ 0.569140] microcode: CPU0: patch_level=0x08701021
[ 0.569144] microcode: CPU1: patch_level=0x08701021
[ 0.569149] microcode: CPU2: patch_level=0x08701021
[ 0.569156] microcode: CPU3: patch_level=0x08701021
[ 0.569161] microcode: CPU4: patch_level=0x08701021
[ 0.569167] microcode: CPU5: patch_level=0x08701021
[ 0.569171] microcode: CPU6: patch_level=0x08701021
[ 0.569175] microcode: CPU7: patch_level=0x08701021
[ 0.569178] microcode: CPU8: patch_level=0x08701021
[ 0.569182] microcode: CPU9: patch_level=0x08701021
[ 0.569186] microcode: CPU10: patch_level=0x08701021
[ 0.569191] microcode: CPU11: patch_level=0x08701021
[ 0.569194] microcode: Microcode Update Driver: v2.2.
I get the exact same output when running the command with normal privileges. Does running with sudo show the same error?
Hi Hanzel
You’re right, running spectre-meltdown-checker with sudo permissions seems to let it check the msr module and therfore it reports NOT VULNERABLE.
1 Like
Zenbleed: please update your microcode for the most optimal fix
From what I can find the message seems to be a notification to get the latest, however the microcode changes for my (and your) CPU is not released yet. Somewhere in this thread here: Stable kernels to address Zenbleed released [LWN.net]
You could be right. I’ve checked their ReadMe and only two models in my family did receive the patch:
Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107a Length=3200 bytes
Family=0x17 Model=0xa0 Stepping=0x00: Patch=0x08a00008 Length=3200 bytes
I found also this post which also says that only some models did receive the patch: oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors
Interesting statement from the forum:
the amd security bulletin at
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html
states that really only 2nd-gen epyc is fixed. etas for all other cpus (consumer
level) are in october/november/december.
quoting above:
2nd Gen AMD EPYC™ Processors "Rome" (fixed)
AMD Ryzen 3000 Series Desktop Processors "Matisse" (Target Dec 2023)
AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics "Renoir" AM4 (Target Dec 2023)
AMD Ryzen Threadripper 3000 Series Processors "Castle Peak" HEDT (Target Oct 2023)
AMD Ryzen Threadripper PRO 3000WX Series Processors "Castle Peak" WS SP3 (Target Nov 2023/Dec 2023)
AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics "Lucienne" (Target Dec 2023)
AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics "Renoir" (Target Nov 2023)
AMD Ryzen 7020 Series Processors "Mendocino" FT6 (Target Dec 2023)
this is a disaster of a security announcement from AMD. nothing is fixed except
for epyc. the only workaround anyone really has is the chicken bit, thankfully.
@philm
Maybe update the update post that only people with 2nd Gen AMD EPYCs have their vulnerability fixed, while the others have to wait for another few months… ^^
1 Like
Or just update to 6.4.6 why not? Sure the LTS Kernel is more stable, but Stable Kernels have latest Security fixes (earlier).
On the other Hand bios updates will came end of the year 2023. for consumer cpus. Server CPU will get it a Bit earlier.
That is not correct. The kernel patch fixes ALL affected CPUs - if updated microcode isn’t available then it sets the MSR chicken bit instead. The difference is that setting the MSR bit has a performance hit.
1 Like
grep . /sys/devices/system/cpu/vulnerabilities/*
You’re right, the ucode did only fix a very very few models of AMD so the linux kernel team had to make a temporary fix by setting the chicken bit, until AMD releases their updated AGESA at the end of the year… 
Exactly. Seems everyone has to chicken out 
I discoverd it now… my X570 board does not have the ComboV2PI 1.2.0.C which was release on 2024-02-07 