OpenBSD is an open-source Unix-like computer operating system descended from Berkeley Software Distribution (BSD). Theo de Raadt forked it from NetBSD. A very serious security problem has been found and patched in the OpenBSD kernel.
A very serious security problem has been found in the Intel CPUs. Meltdown CPU Vulnerability CVE-2017-5754 breaks the most fundamental isolation between user applications and the operating system. This attack allows a program to access the memory, and thus also the secrets, of other programs and the operating system. It was announced on 3rd January 2018. It was independently discovered and reported by various teams including Google Project Zero. This page shows how to protect or patch Meltdown vulnerability on OpenBSD Unix.
Patch Meltdown vulnerability on OpenBSD
The Meltdown vulnerability backported to the OpenBSD version 6.1 and 6.2 (amd64) releases, and the syspatch update for version 6.2 is now available. First, login to your OpenBSD box using the ssh command or system console:
$ ssh email@example.com
Find current kernel version
Type the following uname command:
$ uname -r
Become a root user using the su command or doas command:
$ su -
OpenBSD uses a command called syspatch. It is a utility to fetch, verify, install and revert OpenBSD binary patches. It must run as root user. When run without any options, the syspatch command should install all missing patches including meltdown. Type the following syspatch command:
You can verify installed patches with the following command:
# syspatch -l
001_tcb_invalid 002_fktrace 003_mpls 004_libssl 005_ahopts 006_prevhdr 007_etherip 008_unbound 009_meltdown
See “How to apply patches on OpenBSD system/kernel and packages easily” for more info.
Reboot the box
Type the following reboot command:
# dmesg | grep -i meltdown
cpu0: FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,SSE3,PCLMUL,SSSE3,FMA3,CX16,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,OSXSAVE,AVX,HV,NXE,RDTSCP,LONG,LAHF,3DNOWP,FSGSBASE,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,RDSEED,ADX,SMAP,MELTDOWN cpu1: FPU,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,SSE3,PCLMUL,SSSE3,FMA3,CX16,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,OSXSAVE,AVX,HV,NXE,RDTSCP,LONG,LAHF,3DNOWP,FSGSBASE,BMI1,HLE,AVX2,SMEP,BMI2,ERMS,INVPCID,RTM,RDSEED,ADX,SMAP,MELTDOWN
You may want to upgrade packages too using the pkg_add command:
# pkg_add -Uuv
Update candidates: quirks-2.367 -> quirks-2.367 quirks-2.367 signed on 2017-10-03T11:21:28Z Update candidates: gettext-0.19.8.1p1 -> gettext-0.19.8.1p1 Update candidates: lftp-4.7.8 -> lftp-4.7.8 Update candidates: libiconv-1.14p3 -> libiconv-1.14p3 Update candidates: libidn-1.33 -> libidn-1.33 Update candidates: readline-6.3 -> readline-6.3 Update candidates: rsync-3.1.2p0 -> rsync-3.1.2p0
See OpenBSD commit message regarding Meltdown vulnerability on OpenBSD.
- How to patch Meltdown CPU Vulnerability CVE-2017-5754 on Linux
- How to patch Spectre Vulnerability CVE-2017-5753/CVE-2017-5715 on Linux
- How to check Linux for Spectre and Meltdown vulnerability
- How to install/update Intel microcode firmware on Linux
- How to patch Meltdown vulnerability on OpenBSD Unix
- How to patch Meltdown and Spectre vulnerabilities on FreeBSD