Re: [RFC][PATCH] x86/cpu/bugs: Consider having old Intel microcode to be a vulnerability

[Andrew Cooper <andrew.cooper3@citrix.com>]

> You can't practically run old microcode and consider a system secure
> these days.  So, let's call old microcode what it is: a vulnerability.

The list becomes stale 4 times a year, so you need to identify when it's
out of date, and whatever that something is has to be strong enough to
cause distros to backport too.  Perhaps a date in the header, so you can
at least report "status vulnerable, metadata out of date".

Also, you want to identify EOL CPUs.  Just because they're on the most
recent published ucode doesn't mean they're not vulnerable.

Under some hypervisors, you get fed the revision 0x7fffffff.  Others
might tell you the truth, or it may be the truth from when you booted. 
For this, probably best to say "consult your hypervisor".

Failure to publish information, or not publishing fixes for in-support
parts should be considered a vulnerability.  (*ahem*, AMD)

Or you could just simplify the whole path to "yes".  It's true, even if
people don't know.

I really want to like this, but it's a giant can of worms, with as many
political challenges as technical.

~Andrew

P.S. I do like that you've labelled debug microcode as vulnerable.  It's
just software in a different form factor, and we know how buggy software
generally is.