mirror of
https://github.com/speed47/spectre-meltdown-checker.git
synced 2026-04-05 16:23:19 +02:00
doc: add CVE-2023-31315 (SinkClose) to the unsupported list, add categories
This commit is contained in:
Stéphane Lesimple
@@ -2,16 +2,81 @@
|
||||
|
||||
This document lists transient execution CVEs that have been evaluated and determined to be **out of scope** for this tool. See the [Which rules are governing the support of a CVE in this tool?](dist/FAQ.md#which-rules-are-governing-the-support-of-a-cve-in-this-tool) section in the FAQ for the general policy.
|
||||
|
||||
CVEs are grouped by reason for exclusion:
|
||||
|
||||
- [Already covered by an existing CVE check](#already-covered-by-an-existing-cve-check) — subvariants or subsets whose mitigations are already detected under a parent CVE.
|
||||
- [No kernel or microcode mitigations to check](#no-kernel-or-microcode-mitigations-to-check) — no fix has been issued, or the mitigation is not detectable by this tool.
|
||||
- [Not a transient/speculative execution vulnerability](#not-a-transientspeculative-execution-vulnerability) — wrong vulnerability class entirely.
|
||||
|
||||
---
|
||||
|
||||
# Already covered by an existing CVE check
|
||||
|
||||
These CVEs are subvariants or subsets of vulnerabilities already implemented in the tool. Their mitigations are detected as part of the parent CVE's checks.
|
||||
|
||||
## CVE-2018-3693 — Bounds Check Bypass Store (Spectre v1.1)
|
||||
|
||||
- **Issue:** [#236](https://github.com/speed47/spectre-meltdown-checker/issues/236)
|
||||
- **Red Hat advisory:** [Speculative Store Bypass / Bounds Check Bypass (CVE-2018-3693)](https://access.redhat.com/solutions/3523601)
|
||||
- **CVSS:** 5.6 (Medium)
|
||||
- **Covered by:** CVE-2017-5753 (Spectre V1)
|
||||
|
||||
A subvariant of Spectre V1 where speculative store operations can write beyond validated buffer boundaries before the bounds check resolves, allowing an attacker to alter cache state and leak information via side channels.
|
||||
|
||||
**Why out of scope:** The mitigations are identical to CVE-2017-5753 (Spectre V1): `lfence` instructions after bounds checks and `array_index_nospec()` barriers in kernel code. There is no separate sysfs entry, no new CPU feature flag, and no distinct microcode change. This tool's existing CVE-2017-5753 checks already detect these mitigations (`__user pointer sanitization`, `usercopy/swapgs barriers`), so CVE-2018-3693 is fully covered as part of Spectre V1.
|
||||
|
||||
## CVE-2018-15572 — SpectreRSB (Return Stack Buffer)
|
||||
|
||||
- **Issue:** [#224](https://github.com/speed47/spectre-meltdown-checker/issues/224)
|
||||
- **Research paper:** [Spectre Returns! Speculation Attacks using the Return Stack Buffer (WOOT'18)](https://arxiv.org/abs/1807.07940)
|
||||
- **Kernel fix:** [commit fdf82a7856b3](https://github.com/torvalds/linux/commit/fdf82a7856b32d905c39afc85e34364491e46346) (Linux 4.18.1)
|
||||
- **CVSS:** 6.5 (Medium)
|
||||
- **Covered by:** CVE-2017-5715 (Spectre V2)
|
||||
|
||||
The `spectre_v2_select_mitigation` function in the Linux kernel before 4.18.1 did not always fill the RSB upon a context switch, allowing userspace-to-userspace SpectreRSB attacks on Skylake+ CPUs where an empty RSB falls back to the BTB.
|
||||
|
||||
**Why out of scope:** This CVE is a Spectre V2 mitigation gap (missing RSB filling on context switch), not a distinct hardware vulnerability. It is already fully covered by this tool's CVE-2017-5715 (Spectre V2) checks, which detect whether the kernel performs RSB filling on CPUs vulnerable to RSB underflow (Skylake+ and RSBA-capable CPUs). A missing RSB fill is flagged as a caveat ("RSB filling missing on Skylake+") in the Spectre V2 verdict.
|
||||
|
||||
## CVE-2019-1125 — Spectre SWAPGS gadget
|
||||
|
||||
- **Issue:** [#301](https://github.com/speed47/spectre-meltdown-checker/issues/301)
|
||||
- **Kernel fix:** [commit 18ec54fdd6d1](https://github.com/torvalds/linux/commit/18ec54fdd6d18d92025af097cd042a75cf0ea24c) (Linux 5.3)
|
||||
- **CVSS:** 5.6 (Medium)
|
||||
- **Covered by:** CVE-2017-5753 (Spectre V1)
|
||||
|
||||
A Spectre V1 subvariant where the `SWAPGS` instruction can be speculatively executed on x86 CPUs, allowing an attacker to leak kernel memory via a side channel on the GS segment base value.
|
||||
|
||||
**Why out of scope:** This is a Spectre V1 subvariant whose mitigation (SWAPGS barriers) shares the same sysfs entry as CVE-2017-5753. This tool's existing CVE-2017-5753 checks already detect SWAPGS barriers: a mitigated kernel reports `"Mitigation: usercopy/swapgs barriers and __user pointer sanitization"`, while a kernel lacking the fix reports `"Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers"`. CVE-2019-1125 is therefore fully covered as part of Spectre V1.
|
||||
|
||||
## CVE-2025-20623 — Shared Microarchitectural Predictor State (10th Gen Intel)
|
||||
|
||||
- **Advisory:** [INTEL-SA-01247](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html)
|
||||
- **Affected CPUs:** Intel 10th Generation Core Processors only
|
||||
- **CVSS:** 5.6 (Medium)
|
||||
- **Covered by:** CVE-2024-45332 (BPI)
|
||||
|
||||
Shared microarchitectural predictor state on 10th generation Intel CPUs may allow information disclosure.
|
||||
|
||||
**Why out of scope:** Very narrow scope (single CPU generation). Mitigated by the same microcode update as CVE-2024-45332 (BPI) and handled through the existing Spectre V2 framework. No dedicated sysfs entry or kernel mitigation beyond what BPI already provides.
|
||||
|
||||
## CVE-2025-24495 — Lion Cove BPU Initialization
|
||||
|
||||
- **Advisory:** [INTEL-SA-01322](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01322.html)
|
||||
- **Research:** [Training Solo (VUSec)](https://www.vusec.net/projects/training-solo/)
|
||||
- **Affected CPUs:** Intel Core Ultra with Lion Cove core only (Lunar Lake, Arrow Lake)
|
||||
- **CVSS:** 6.8 (Medium, CVSS v4)
|
||||
- **Covered by:** CVE-2024-28956 (ITS)
|
||||
|
||||
A branch predictor initialization issue specific to Intel's Lion Cove microarchitecture, discovered as part of the "Training Solo" research.
|
||||
|
||||
**Why out of scope:** This is a subset of the ITS (Indirect Target Selection) vulnerability (CVE-2024-28956). It shares the same sysfs entry (`/sys/devices/system/cpu/vulnerabilities/indirect_target_selection`) and kernel mitigation framework. Since ITS (CVE-2024-28956) is implemented in this tool, Lion Cove BPU is already covered automatically.
|
||||
|
||||
---
|
||||
|
||||
# No kernel or microcode mitigations to check
|
||||
|
||||
These CVEs are real vulnerabilities, but no kernel or microcode fix has been issued, the mitigation is delegated to individual software, or the fix is not detectable by this tool.
|
||||
|
||||
## CVE-2018-9056 — BranchScope
|
||||
|
||||
- **Issue:** [#169](https://github.com/speed47/spectre-meltdown-checker/issues/169)
|
||||
@@ -23,29 +88,6 @@ A speculative execution attack exploiting the directional branch predictor, allo
|
||||
|
||||
**Why out of scope:** No kernel or microcode mitigations have been issued. Red Hat closed their tracking bug as "CLOSED CANTFIX", concluding that "this is a hardware processor issue, not a Linux kernel flaw" and that "it is specific to a target software which uses sensitive information in branching expressions." The mitigation responsibility falls on individual software to avoid using sensitive data in conditional branches, which is out of the scope of this tool.
|
||||
|
||||
## CVE-2018-15572 — SpectreRSB (Return Stack Buffer)
|
||||
|
||||
- **Issue:** [#224](https://github.com/speed47/spectre-meltdown-checker/issues/224)
|
||||
- **Research paper:** [Spectre Returns! Speculation Attacks using the Return Stack Buffer (WOOT'18)](https://arxiv.org/abs/1807.07940)
|
||||
- **Kernel fix:** [commit fdf82a7856b3](https://github.com/torvalds/linux/commit/fdf82a7856b32d905c39afc85e34364491e46346) (Linux 4.18.1)
|
||||
- **CVSS:** 6.5 (Medium)
|
||||
|
||||
The `spectre_v2_select_mitigation` function in the Linux kernel before 4.18.1 did not always fill the RSB upon a context switch, allowing userspace-to-userspace SpectreRSB attacks on Skylake+ CPUs where an empty RSB falls back to
|
||||
he BTB.
|
||||
|
||||
**Why out of scope:** This CVE is a Spectre V2 mitigation gap (missing RSB filling on context switch), not a distinct hardware vulnerability. It is already fully covered by this tool's CVE-2017-5715 (Spectre V2) checks, which dete
|
||||
ct whether the kernel performs RSB filling on CPUs vulnerable to RSB underflow (Skylake+ and RSBA-capable CPUs). A missing RSB fill is flagged as a caveat ("RSB filling missing on Skylake+") in the Spectre V2 verdict.
|
||||
|
||||
## CVE-2019-1125 — Spectre SWAPGS gadget
|
||||
|
||||
- **Issue:** [#301](https://github.com/speed47/spectre-meltdown-checker/issues/301)
|
||||
- **Kernel fix:** [commit 18ec54fdd6d1](https://github.com/torvalds/linux/commit/18ec54fdd6d18d92025af097cd042a75cf0ea24c) (Linux 5.3)
|
||||
- **CVSS:** 5.6 (Medium)
|
||||
|
||||
A Spectre V1 subvariant where the `SWAPGS` instruction can be speculatively executed on x86 CPUs, allowing an attacker to leak kernel memory via a side channel on the GS segment base value.
|
||||
|
||||
**Why out of scope:** This is a Spectre V1 subvariant whose mitigation (SWAPGS barriers) shares the same sysfs entry as CVE-2017-5753. This tool's existing CVE-2017-5753 checks already detect SWAPGS barriers: a mitigated kernel reports `"Mitigation: usercopy/swapgs barriers and __user pointer sanitization"`, while a kernel lacking the fix reports `"Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers"`. CVE-2019-1125 is therefore fully covered as part of Spectre V1.
|
||||
|
||||
## CVE-2019-15902 — Spectre V1 backport regression
|
||||
|
||||
- **Issue:** [#304](https://github.com/speed47/spectre-meltdown-checker/issues/304)
|
||||
@@ -75,45 +117,6 @@ The prefetch engine on certain ARM cores can fetch data from privileged memory l
|
||||
|
||||
**Why out of scope:** ARM-specific with very narrow scope and no Linux sysfs integration. The mitigation is a per-core register tweak, not a kernel or microcode update detectable by this tool.
|
||||
|
||||
## CVE-2024-56161 — EntrySign (AMD Microcode Signature Bypass)
|
||||
|
||||
- **Affected CPUs:** AMD Zen 1-5
|
||||
- **CVSS:** 7.2 (High)
|
||||
|
||||
A weakness in AMD's microcode signature verification (AES-CMAC hash) allows loading arbitrary unsigned microcode with administrator privileges.
|
||||
|
||||
**Why out of scope:** This is a microcode integrity/authentication issue, not a speculative execution vulnerability. It does not involve transient execution side channels and is outside the scope of this tool.
|
||||
|
||||
## CVE-2025-20623 — Shared Microarchitectural Predictor State (10th Gen Intel)
|
||||
|
||||
- **Advisory:** [INTEL-SA-01247](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html)
|
||||
- **Affected CPUs:** Intel 10th Generation Core Processors only
|
||||
- **CVSS:** 5.6 (Medium)
|
||||
|
||||
Shared microarchitectural predictor state on 10th generation Intel CPUs may allow information disclosure.
|
||||
|
||||
**Why out of scope:** Very narrow scope (single CPU generation). Mitigated by the same microcode update as CVE-2024-45332 (BPI) and handled through the existing Spectre V2 framework. No dedicated sysfs entry or kernel mitigation beyond what BPI already provides.
|
||||
|
||||
## CVE-2025-24495 — Lion Cove BPU Initialization
|
||||
|
||||
- **Advisory:** [INTEL-SA-01322](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01322.html)
|
||||
- **Research:** [Training Solo (VUSec)](https://www.vusec.net/projects/training-solo/)
|
||||
- **Affected CPUs:** Intel Core Ultra with Lion Cove core only (Lunar Lake, Arrow Lake)
|
||||
- **CVSS:** 6.8 (Medium, CVSS v4)
|
||||
|
||||
A branch predictor initialization issue specific to Intel's Lion Cove microarchitecture, discovered as part of the "Training Solo" research.
|
||||
|
||||
**Why out of scope:** This is a subset of the ITS (Indirect Target Selection) vulnerability (CVE-2024-28956). It shares the same sysfs entry (`/sys/devices/system/cpu/vulnerabilities/indirect_target_selection`) and kernel mitigation framework. Since ITS (CVE-2024-28956) is implemented in this tool, Lion Cove BPU is already covered automatically.
|
||||
|
||||
## CVE-2025-29943 — StackWarp (AMD SEV-SNP)
|
||||
|
||||
- **Affected CPUs:** AMD Zen 1-5
|
||||
- **CVSS:** Low
|
||||
|
||||
Exploits a synchronization failure in the AMD stack engine via an undocumented MSR bit, targeting AMD SEV-SNP confidential VMs. Requires hypervisor-level (ring 0) access.
|
||||
|
||||
**Why out of scope:** Not a transient/speculative execution side channel. This is an architectural attack on AMD SEV-SNP confidential computing that requires hypervisor access, which is outside the threat model of this tool.
|
||||
|
||||
## CVE-2024-36348 — AMD Transient Scheduler Attack (UMIP bypass)
|
||||
|
||||
- **Bulletin:** [AMD-SB-7029](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html)
|
||||
@@ -131,3 +134,39 @@ A transient execution vulnerability in some AMD processors may allow a user proc
|
||||
A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled.
|
||||
|
||||
**Why out of scope:** AMD has determined that "leakage of TSC_AUX does not result in leakage of sensitive information" and has marked this CVE as "No fix planned" across all affected product lines. No microcode or kernel mitigations have been issued, leaving nothing for this script to check.
|
||||
|
||||
---
|
||||
|
||||
# Not a transient/speculative execution vulnerability
|
||||
|
||||
These are hardware flaws but not side-channel or speculative execution issues. They fall outside the vulnerability class this tool is designed to detect.
|
||||
|
||||
## CVE-2023-31315 — SinkClose (AMD SMM Lock Bypass)
|
||||
|
||||
- **Issue:** [#499](https://github.com/speed47/spectre-meltdown-checker/issues/499)
|
||||
- **Bulletin:** [AMD-SB-7014](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html)
|
||||
- **Research:** [AMD SinkClose (IOActive, DEF CON 32)](https://www.ioactive.com/resources/amd-sinkclose-universal-ring-2-privilege-escalation)
|
||||
- **Affected CPUs:** AMD Zen 1–5 (EPYC, Ryzen, Threadripper, Embedded)
|
||||
- **CVSS:** 7.5 (High)
|
||||
|
||||
Improper validation in a model-specific register (MSR) allows a program with ring 0 (kernel) access to modify System Management Mode (SMM) configuration while SMI lock is enabled, escalating privileges from ring 0 to ring -2 (SMM). AMD provides two mitigation paths: BIOS/AGESA firmware updates (all product lines) and hot-loadable microcode updates (EPYC server processors only).
|
||||
|
||||
**Why out of scope:** Not a transient or speculative execution vulnerability — this is a privilege escalation via MSR manipulation, with no side-channel component. It requires ring 0 access as a prerequisite, fundamentally different from Spectre/Meltdown-class attacks where unprivileged code can leak data across privilege boundaries. There is no Linux kernel sysfs entry and no kernel-side mitigation. Although AMD provides hot-loadable microcode for some EPYC processors, the client and embedded product lines are mitigated only through BIOS firmware updates, which this tool cannot detect.
|
||||
|
||||
## CVE-2024-56161 — EntrySign (AMD Microcode Signature Bypass)
|
||||
|
||||
- **Affected CPUs:** AMD Zen 1-5
|
||||
- **CVSS:** 7.2 (High)
|
||||
|
||||
A weakness in AMD's microcode signature verification (AES-CMAC hash) allows loading arbitrary unsigned microcode with administrator privileges.
|
||||
|
||||
**Why out of scope:** This is a microcode integrity/authentication issue, not a speculative execution vulnerability. It does not involve transient execution side channels and is outside the scope of this tool.
|
||||
|
||||
## CVE-2025-29943 — StackWarp (AMD SEV-SNP)
|
||||
|
||||
- **Affected CPUs:** AMD Zen 1-5
|
||||
- **CVSS:** Low
|
||||
|
||||
Exploits a synchronization failure in the AMD stack engine via an undocumented MSR bit, targeting AMD SEV-SNP confidential VMs. Requires hypervisor-level (ring 0) access.
|
||||
|
||||
**Why out of scope:** Not a transient/speculative execution side channel. This is an architectural attack on AMD SEV-SNP confidential computing that requires hypervisor access, which is outside the threat model of this tool.
|
||||
|
||||
Reference in New Issue
Block a user