spectre/meltdown vulnerability - CVE-2018-3639

[newtwork_noob_2878237843]

I just updated my CPU's micro code (Celeron 3855U) and I ran the spectre & meltdown checker afterwards. I get a warning about a vulnerability to CVE-2018-3639 as shown in the attached image. Does anyone know why the mitigation isn't turned on? Cheers

[Patrick M. Hausen]

Side channel attacks are most relevant in a multi-tenant context, i.e. "cloud" servers used by multiple customers in parallel. A firewall with most processes running as root, anyway, and no user logins, is not considered a target.
You would need remote code execution first and then the system is pwned, anyway.

HTH,
Patrick

[newtwork_noob_2878237843]

Thanks Patrick. So simply running a VPN does not expose you to the vulnerability? If there is any risk, do you know if there's a performance penalty to turning on the mitigation? If not, do you do know how to turn it on?

[Patrick M. Hausen]

There is a performance penalty. I don't see any risk, but some might disagree.
That's why the mitigation defaults to "off" - the developers seem to agree with me.