I've updated to 6.1.41 and my system still reports ZenBleed

I’ve updated my system and I’m now on kernel 6.1.41-1 but the spectre-meltdown-checker tool still says that my system is vulnerable to Zenbleed.

Did you also reboot your system?

Yes, an old habit from the windows times, always rebooting after a big update :wink:
FYI my CPU information:

  Info: model: AMD Ryzen 9 3900X bits: 64 type: MT MCP arch: Zen 2 gen: 3
    level: v3 note: check built: 2020-22 process: TSMC n7 (7nm) family: 0x17 (23)
    model-id: 0x71 (113) stepping: 0 microcode: 0x8701021
  Topology: cpus: 1x cores: 12 tpc: 2 threads: 24 smt: enabled cache:
    L1: 768 KiB desc: d-12x32 KiB; i-12x32 KiB L2: 6 MiB desc: 12x512 KiB
    L3: 64 MiB desc: 4x16 MiB
  Speed (MHz): avg: 2267 high: 3800 min/max: 2200/4672 boost: enabled
    scaling: driver: acpi-cpufreq governor: schedutil cores: 1: 3800 2: 2200
    3: 2200 4: 2200 5: 2196 6: 2196 7: 2372 8: 2200 9: 2200 10: 2208 11: 2200
    12: 2200 13: 2200 14: 2052 15: 2200 16: 2200 17: 2200 18: 2200 19: 2200
    20: 2200 21: 2200 22: 2200 23: 2200 24: 2200 bogomips: 182125
  Flags: 3dnowprefetch abm adx aes aperfmperf apic arat avic avx avx2 bmi1
    bmi2 bpext cat_l3 cdp_l3 clflush clflushopt clwb clzero cmov cmp_legacy
    constant_tsc cpb cpuid cqm cqm_llc cqm_mbm_local cqm_mbm_total
    cqm_occup_llc cr8_legacy cx16 cx8 de decodeassists extapic extd_apicid
    f16c flushbyasid fma fpu fsgsbase fxsr fxsr_opt ht hw_pstate ibpb ibs
    irperf lahf_lm lbrv lm mba mca mce misalignsse mmx mmxext monitor movbe
    msr mtrr mwaitx nonstop_tsc nopl npt nrip_save nx osvw overflow_recov pae
    pat pausefilter pclmulqdq pdpe1gb perfctr_core perfctr_llc perfctr_nb
    pfthreshold pge pni popcnt pse pse36 rapl rdpid rdpru rdrand rdseed rdt_a
    rdtscp rep_good sep sev sev_es sha_ni skinit smap smca smep ssbd sse sse2
    sse4_1 sse4_2 sse4a ssse3 stibp succor svm svm_lock syscall tce topoext
    tsc tsc_scale umip v_spec_ctrl v_vmsave_vmload vgif vmcb_clean vme vmmcall
    wbnoinvd wdt x2apic xgetbv1 xsave xsavec xsaveerptr xsaveopt
  Type: itlb_multihit status: Not affected
  Type: l1tf status: Not affected
  Type: mds status: Not affected
  Type: meltdown status: Not affected
  Type: mmio_stale_data status: Not affected
  Type: retbleed mitigation: untrained return thunk; SMT enabled with STIBP
  Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via
  Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer
  Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, STIBP:
    always-on, RSB filling, PBRSB-eIBRS: Not affected
  Type: srbds status: Not affected
  Type: tsx_async_abort status: Not affected
CVE-2023-20593 aka 'Zenbleed, cross-process information leak'
* Zenbleed mitigation is supported by kernel:  YES  (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active:  UNKNOWN  (No read permission for /dev/cpu/0/msr)
* Zenbleed mitigation is supported by CPU microcode:  NO 
> STATUS:  VULNERABLE  (Your kernel is too old to mitigate Zenbleed and your CPU microcode doesn't mitigate it either)

Did you also updated amd-ucode? It was fixed in 6.1.41. What is the output of uname -a.

Output of uname -a:
Linux NYFB 6.1.41-1-MANJARO #1 SMP PREEMPT_DYNAMIC Tue Jul 25 09:17:30 UTC 2023 x86_64 GNU/Linux

Edit: Interesting that this shows 25th July, even if its the 27th

It is the build date as you can see here: Releases · manjaro-kernels/linux61 · GitHub

Ah so it is refering to that, thanks for the explanation.

Interesting that I’m currently the only one with that issue.

After running dmesg|grep microcode this is what it outputed:

[    0.320220] Zenbleed: please update your microcode for the most optimal fix
[    0.905046] microcode: CPU0: patch_level=0x08701021
[    0.905050] microcode: CPU1: patch_level=0x08701021
[    0.905053] microcode: CPU2: patch_level=0x08701021
[    0.905059] microcode: CPU3: patch_level=0x08701021
[    0.905066] microcode: CPU4: patch_level=0x08701021
[    0.905071] microcode: CPU5: patch_level=0x08701021
[    0.905076] microcode: CPU6: patch_level=0x08701021
[    0.905083] microcode: CPU7: patch_level=0x08701021
[    0.905087] microcode: CPU8: patch_level=0x08701021
[    0.905093] microcode: CPU9: patch_level=0x08701021
[    0.905098] microcode: CPU10: patch_level=0x08701021
[    0.905103] microcode: CPU11: patch_level=0x08701021
[    0.905107] microcode: CPU12: patch_level=0x08701021
[    0.905109] microcode: CPU13: patch_level=0x08701021
[    0.905112] microcode: CPU14: patch_level=0x08701021
[    0.905116] microcode: CPU15: patch_level=0x08701021
[    0.905121] microcode: CPU16: patch_level=0x08701021
[    0.905125] microcode: CPU17: patch_level=0x08701021
[    0.905130] microcode: CPU18: patch_level=0x08701021
[    0.905135] microcode: CPU19: patch_level=0x08701021
[    0.905139] microcode: CPU20: patch_level=0x08701021
[    0.905143] microcode: CPU21: patch_level=0x08701021
[    0.905148] microcode: CPU22: patch_level=0x08701021
[    0.905152] microcode: CPU23: patch_level=0x08701021
[    0.905155] microcode: Microcode Update Driver: v2.2.

It seems as if the microcode was somehow not installed or I need to do something additional?

For reference:
Running the tool as a normal user reports the vulnerable state for zenbleeed, same as posted above
Running with sudo (as recommended) does not in my case with a ryzen 5 CPU & 6.4.6-1 and updated amd-ucode (20230724.59fbffa9-1) (I’m on testing branch)

sudo spectre-meltdown-checker

CVE-2023-20593 aka 'Zenbleed, cross-process information leak'
* Zenbleed mitigation is supported by kernel:  YES  (found zenbleed message in kernel image)
* Zenbleed kernel mitigation enabled and active:  YES  (FP_BACKUP_FIX bit set in DE_CFG)
* Zenbleed mitigation is supported by CPU microcode:  NO 
> STATUS:  NOT VULNERABLE  (Your kernel mitigates Zenbleed)

Edit: tested with kernel 6.1.41-1 and getting the same results.

[    0.002423] Zenbleed: please update your microcode for the most optimal fix
[    0.569140] microcode: CPU0: patch_level=0x08701021
[    0.569144] microcode: CPU1: patch_level=0x08701021
[    0.569149] microcode: CPU2: patch_level=0x08701021
[    0.569156] microcode: CPU3: patch_level=0x08701021
[    0.569161] microcode: CPU4: patch_level=0x08701021
[    0.569167] microcode: CPU5: patch_level=0x08701021
[    0.569171] microcode: CPU6: patch_level=0x08701021
[    0.569175] microcode: CPU7: patch_level=0x08701021
[    0.569178] microcode: CPU8: patch_level=0x08701021
[    0.569182] microcode: CPU9: patch_level=0x08701021
[    0.569186] microcode: CPU10: patch_level=0x08701021
[    0.569191] microcode: CPU11: patch_level=0x08701021
[    0.569194] microcode: Microcode Update Driver: v2.2.

I get the exact same output when running the command with normal privileges. Does running with sudo show the same error?

Hi Hanzel

You’re right, running spectre-meltdown-checker with sudo permissions seems to let it check the msr module and therfore it reports NOT VULNERABLE.

1 Like

Zenbleed: please update your microcode for the most optimal fix

From what I can find the message seems to be a notification to get the latest, however the microcode changes for my (and your) CPU is not released yet. Somewhere in this thread here: Stable kernels to address Zenbleed released [LWN.net]

You could be right. I’ve checked their ReadMe and only two models in my family did receive the patch:

Family=0x17 Model=0x31 Stepping=0x00: Patch=0x0830107a Length=3200 bytes
Family=0x17 Model=0xa0 Stepping=0x00: Patch=0x08a00008 Length=3200 bytes

I found also this post which also says that only some models did receive the patch: oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors

Interesting statement from the forum:

the amd security bulletin at
states that really only 2nd-gen epyc is fixed. etas for all other cpus (consumer
level) are in october/november/december.

quoting above:
2nd Gen AMD EPYC™ Processors "Rome" (fixed)
AMD Ryzen 3000 Series Desktop Processors "Matisse" (Target Dec 2023)
AMD Ryzen 4000 Series Desktop Processors with Radeon Graphics "Renoir" AM4 (Target Dec 2023)
AMD Ryzen Threadripper 3000 Series Processors "Castle Peak" HEDT (Target Oct 2023)
AMD Ryzen Threadripper PRO 3000WX Series Processors "Castle Peak" WS SP3 (Target Nov 2023/Dec 2023)
AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics "Lucienne" (Target Dec 2023)
AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics "Renoir" (Target Nov 2023)
AMD Ryzen 7020 Series Processors "Mendocino" FT6 (Target Dec 2023)

this is a disaster of a security announcement from AMD. nothing is fixed except
for epyc. the only workaround anyone really has is the chicken bit, thankfully.

Maybe update the update post that only people with 2nd Gen AMD EPYCs have their vulnerability fixed, while the others have to wait for another few months… ^^

1 Like

Or just update to 6.4.6 why not? Sure the LTS Kernel is more stable, but Stable Kernels have latest Security fixes (earlier). :wink:
On the other Hand bios updates will came end of the year 2023. for consumer cpus. Server CPU will get it a Bit earlier.

That is not correct. The kernel patch fixes ALL affected CPUs - if updated microcode isn’t available then it sets the MSR chicken bit instead. The difference is that setting the MSR bit has a performance hit.


1 Like
grep . /sys/devices/system/cpu/vulnerabilities/*

You’re right, the ucode did only fix a very very few models of AMD so the linux kernel team had to make a temporary fix by setting the chicken bit, until AMD releases their updated AGESA at the end of the year… :slight_smile:

Exactly. Seems everyone has to chicken out :smile: