Bug 644026

Summary:	<x11-drivers/nvidia-drivers-{384.111,390.12}: Meltdown/Spectre mitigation (CVE-2017-5753)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	ajak, hardened, jer, viklevin2
Priority:	Normal	Flags:	nattka: sanity-check-
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://nvidia.custhelp.com/app/answers/detail/a_id/4611/~/security-bulletin%3A-nvidia-gpu-display-driver-security-updates-for-speculative
Whiteboard:	A4 [glsa cve]
Package list:	x11-drivers/nvidia-drivers-390.12 x11-drivers/nvidia-drivers-384.111	Runtime testing required:	---
Bug Depends on:
Bug Blocks:	643340

Description GLSAMaker/CVETool Bot gentoo-dev

2018-01-09 17:23:27 UTC

CVE-2017-5753 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5753):
  Systems with microprocessors utilizing speculative execution and branch
  prediction may allow unauthorized disclosure of information to an attacker
  with local user access via a side-channel analysis.

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2018-01-09 17:26:55 UTC

@ Maintainer(s): Please tell us when we can start stabilization of =x11-drivers/nvidia-drivers-390.12 or CC arches on your own.

Comment 2 kuzetsa CatSwarm (kuza for short) 2018-01-09 17:35:06 UTC

[Non-]minor note: Any masking which is done should not block 384.111, etc. for hardware which doesn't run on 390.x branch. The maintainer is unlikely to make this mistake even if the CVE bot didn't understand the nuance.

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev

2018-01-16 17:04:56 UTC

(In reply to Thomas Deutschmann from comment #1)
> =x11-drivers/nvidia-drivers-390.12 or CC arches on your own.

390.12 is a beta and is not going stable at all.

Comment 4 Aaron Bauman (RETIRED) gentoo-dev

2018-03-25 18:27:52 UTC

Fixed versions are stable.

@maintainer(s), please clean the vulnerable versions or put a mask in place noting the security vulnerability.

Comment 5 NATTkA bot gentoo-dev

2020-04-06 15:22:03 UTC

Unable to check for sanity:

> no match for package: x11-drivers/nvidia-drivers-390.12

Comment 6 John Helmert III archtester

2020-06-20 02:40:33 UTC

Last vulnerable 384 branch ebuilds were dropped March 2018 in bb2396e7bba.

Comment 7 Sam James archtester

2020-06-27 19:42:30 UTC

Tree clean, too old for GLSA.