Skip to content

Please update microcode for 06-5e-03 #100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alkisg opened this issue Apr 30, 2025 · 6 comments
Open

Please update microcode for 06-5e-03 #100

alkisg opened this issue Apr 30, 2025 · 6 comments

Comments

@alkisg
Copy link

alkisg commented Apr 30, 2025

Hi, using the latest microcode, I'm still vulnerable to GDS.
Here is my CPU and microcode information:

root@gpmd:~# grep -r Vulnerable /sys/devices/system/cpu/vulnerabilities/
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Vulnerable: No microcode

root@gpmd:~# dmesg
[    0.194670] smpboot: CPU0: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz (family: 0x6, model: 0x5e, stepping: 0x3)
[    0.155725] GDS: Vulnerable: No microcode
[    0.791740] microcode: Current revision: 0x000000f0
[    0.791752] microcode: Updated early from: 0x00000033

root@gpmd:~# dpkg -l intel-microcode
ii  intel-microcode 3.20250211.1 amd64        Processor microcode firmware for Intel CPUs

root@gpmd:~# iucode-tool -l /lib/firmware/intel-ucode/06-5e-03.initramfs
microcode bundle 1: /lib/firmware/intel-ucode/06-5e-03.initramfs
selected microcodes:
  001/001: sig 0x000506e3, pf_mask 0x36, 2021-11-12, rev 0x00f0, size 109568
@alexmurray
Copy link

This is a bug in the debian package - it explicitly blacklists this microcode file (hence the .initramfs suffix).

@alkisg
Copy link
Author

alkisg commented Apr 30, 2025

Thank you! Although, if I'm reading the dmesg output above correctly, it says that:

  • BIOS had revision 0x00000033
  • And the initramfs successfully updated it to 0x000000f0

While in apt changelog intel-microcode, I see:

ucode-blacklist: do not late-load 0x406e3 and 0x506e3.
When the BIOS microcode is older than revision 0x7f (and perhaps in some
other cases as well), the latest microcode updates for 0x406e3 and
0x506e3 must be applied using the early update method. Otherwise, the
system might hang. Also: there must not be any other intermediate
microcode update attempts [other than the one done by the BIOS itself],
either. It must go from the BIOS microcode update directly to the
latest microcode update.

I.e. they blacklist the late-loading, not the initramfs loading, which is successful as dmesg reports.
Right?

@alkisg
Copy link
Author

alkisg commented May 4, 2025

I've booted that server with the latest Fedora 42 live CD; the same problem happens there. I.e. it doesn't appear to be a bug with the Debian packaging.
I've also done the latest motherboard firmware updates, which got the UEFI/BIOS Intel microcode revision from 0x00000033 to 0x000000d6, to no avail.
Here is the latest troubleshooting information, from the Fedora live CD:

root@gpmd:~# grep -r Vulnerable /sys/devices/system/cpu/vulnerabilities/
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Vulnerable: No microcode

root@gpmd:~# dmesg
[    0.184848] GDS: Vulnerable: No microcode
[    0.225478] smpboot: CPU0: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz (family: 0x6, model: 0x5e, stepping: 0x3)
[    0.775377] microcode: Current revision: 0x000000f0
[    0.775379] microcode: Updated early from: 0x000000d6

root@gpmd:~# rpm -qf /lib/firmware/intel-ucode
microcode_ctl-2.1-69.fc42.x86_64

root@gpmd:~# uname -a
Linux localhost-live 6.14.0-63.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Mar 24 19:53:37 UTC 2025 x86_64 GNU/Linux

root@gpmd:~# grep PRETTY_NAME /etc/os-release
PRETTY_NAME="Fedora Linux 42 (Workstation Edition)"

@hmh
Copy link

hmh commented May 6, 2025

Well, the Intel CPU microcode guide recommends revison 0xf6 for signature 0x506e3, but that revision is not available for public distribution for some reason. The latest available is revision 0xf0.

Maybe Intel can either publish it in a future release, or tell us why (most likely reason: requires full firmware update) ?

https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html

@whpenner
Copy link

whpenner commented May 6, 2025

@hmh: Checking...

@whpenner
Copy link

whpenner commented May 8, 2025

This product has reached its End of Servicing Update (ESU) date. See our Support webpage for further information. For OEM customers interested in extended updates beyond ESU, contact your Intel representative for details. For end users, to determine if your system is supported beyond ESU, contact your system manufacturer for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants