peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2026-04-09 10:13:18 +02:00
Code Issues Projects Releases Wiki Activity

fix: better detect kernel lockdown & no longer require cap_flush_cmd to deem CVE-2018-3615 as mitigated (fix #296)

Browse Source
This commit is contained in:
Stéphane Lesimple
2026-04-06 12:29:26 +02:00
parent b0bb1f4676
commit 3c56ac35dd
4 changed files with 35 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/vulns/CVE-2018-3615.sh
View File

@@ -8,15 +8,10 @@ check_CVE_2018_3615() {
pr_info "\033[1;34m$cve aka '$(cve2name "$cve")'\033[0m"
pr_info_nol "* CPU microcode mitigates the vulnerability: "
if { [ "$cap_flush_cmd" = 1 ] || { [ "$g_msr_locked_down" = 1 ] && [ "$cap_l1df" = 1 ]; }; } && [ "$cap_sgx" = 1 ]; then
# no easy way to detect a fixed SGX but we know that
# microcodes that have the FLUSH_CMD MSR also have the
# fixed SGX (for CPUs that support it), because Intel
# delivered fixed microcodes for both issues at the same time
#
# if the system we're running on is locked down (no way to write MSRs),
# make the assumption that if the L1D flush CPUID bit is set, probably
# that FLUSH_CMD MSR is here too
if [ "$cap_l1df" = 1 ] && [ "$cap_sgx" = 1 ]; then
# the L1D flush CPUID bit indicates that the microcode supports L1D flushing,
# and microcodes that have this also have the fixed SGX (for CPUs that support it),
# because Intel delivered fixed microcodes for both issues at the same time
pstatus green YES
elif [ "$cap_sgx" = 1 ]; then
pstatus red NO
@@ -27,7 +22,7 @@ check_CVE_2018_3615() {
if ! is_cpu_affected "$cve"; then
# override status & msg in case CPU is not vulnerable after all
pvulnstatus "$cve" OK "your CPU vendor reported your CPU model as not affected"
elif [ "$cap_flush_cmd" = 1 ] || { [ "$g_msr_locked_down" = 1 ] && [ "$cap_l1df" = 1 ]; }; then
elif [ "$cap_l1df" = 1 ]; then
pvulnstatus "$cve" OK "your CPU microcode mitigates the vulnerability"
else
pvulnstatus "$cve" VULN "your CPU supports SGX and the microcode is not up to date"