How to patch Meltdown vulnerability on OpenBSD Unix

in Categories , , last updated March 4, 2018

I read that OpenBSD is the first BSD family of the operating system to release updates for its stable releases to mitigate the Meltdown vulnerability. How do I patch Meltdown on OpenBSD Unix operating system?

OpenBSD is an open-source Unix-like computer operating system descended from Berkeley Software Distribution (BSD). Theo de Raadt forked it from NetBSD. A very serious security problem has been found and patched in the OpenBSD kernel.

A very serious security problem has been found in the Intel CPUs. Meltdown CPU Vulnerability CVE-2017-5754 breaks the most fundamental isolation between user applications and the operating system. This attack allows a program to access the memory, and thus also the secrets, of other programs and the operating system. It was announced on 3rd January 2018. It was independently discovered and reported by various teams including Google Project Zero. This page shows how to protect or patch Meltdown vulnerability on OpenBSD Unix.

Patch Meltdown vulnerability on OpenBSD

The Meltdown vulnerability backported to the OpenBSD version 6.1 and 6.2 (amd64) releases, and the syspatch update for version 6.2 is now available. First, login to your OpenBSD box using the ssh command or system console:
$ ssh vivek@

Find current kernel version

Type the following uname command:
$ uname -r
Sample outputs:


Become a root user using the su command or doas command:
$ su -

Apply patch

OpenBSD uses a command called syspatch. It is a utility to fetch, verify, install and revert OpenBSD binary patches. It must run as root user. When run without any options, the syspatch command should install all missing patches including meltdown. Type the following syspatch command:
# syspatch
How to patch Meltdown vulnerability on OpenBSD Unix
You can verify installed patches with the following command:
# syspatch -l
Sample outputs:


See “How to apply patches on OpenBSD system/kernel and packages easily” for more info.

Reboot the box

Type the following reboot command:
# reboot
Verify it:
# dmesg | grep -i meltdown
Sample outputs:


You may want to upgrade packages too using the pkg_add command:
# pkg_add -Uuv
Sample outputs:

Update candidates: quirks-2.367 -> quirks-2.367
quirks-2.367 signed on 2017-10-03T11:21:28Z
Update candidates: gettext- -> gettext-
Update candidates: lftp-4.7.8 -> lftp-4.7.8
Update candidates: libiconv-1.14p3 -> libiconv-1.14p3
Update candidates: libidn-1.33 -> libidn-1.33
Update candidates: readline-6.3 -> readline-6.3
Update candidates: rsync-3.1.2p0 -> rsync-3.1.2p0

See OpenBSD commit message regarding Meltdown vulnerability on OpenBSD.

This entry is 5 of 5 in the Processor/CPU Speculative Execution Patching on Linux Tutorial series. Keep reading the rest of the series:
  1. How to patch Meltdown CPU Vulnerability CVE-2017-5754 on Linux
  2. How to patch Spectre Vulnerability CVE-2017-5753/CVE-2017-5715 on Linux
  3. How to check Linux for Spectre and Meltdown vulnerability
  4. How to install/update Intel microcode firmware on Linux
  5. How to patch Meltdown vulnerability on OpenBSD Unix

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Share this on (or read 0 comments/add one below):

Start the discussion at