From 6106dce8d806325c25e3f1de2ab2dc5d362f66b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Lesimple?= Date: Mon, 6 Apr 2026 03:09:18 +0200 Subject: [PATCH] fix: CVE-2024-3635[0,7] don't print lines about TSA CPUID bits under non-AMD --- src/vulns/CVE-2024-36350.sh | 32 +++++++++++++++++--------------- src/vulns/CVE-2024-36357.sh | 32 +++++++++++++++++--------------- 2 files changed, 34 insertions(+), 30 deletions(-) diff --git a/src/vulns/CVE-2024-36350.sh b/src/vulns/CVE-2024-36350.sh index 4aec907..89cbe2e 100644 --- a/src/vulns/CVE-2024-36350.sh +++ b/src/vulns/CVE-2024-36350.sh @@ -93,22 +93,24 @@ check_CVE_2024_36350_linux() { pstatus yellow NO fi - pr_info_nol "* CPU explicitly indicates not vulnerable to TSA-SQ (TSA_SQ_NO): " - if [ "$cap_tsa_sq_no" = 1 ]; then - pstatus green YES - elif [ "$cap_tsa_sq_no" = 0 ]; then - pstatus yellow NO - else - pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" - fi + if is_amd || is_hygon; then + pr_info_nol "* CPU explicitly indicates not vulnerable to TSA-SQ (TSA_SQ_NO): " + if [ "$cap_tsa_sq_no" = 1 ]; then + pstatus green YES + elif [ "$cap_tsa_sq_no" = 0 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" + fi - pr_info_nol "* Microcode supports VERW buffer clearing: " - if [ "$cap_verw_clear" = 1 ]; then - pstatus green YES - elif [ "$cap_verw_clear" = 0 ]; then - pstatus yellow NO - else - pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" + pr_info_nol "* Microcode supports VERW buffer clearing: " + if [ "$cap_verw_clear" = 1 ]; then + pstatus green YES + elif [ "$cap_verw_clear" = 0 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" + fi fi pr_info_nol "* Hyper-Threading (SMT) is enabled: " diff --git a/src/vulns/CVE-2024-36357.sh b/src/vulns/CVE-2024-36357.sh index 858b50e..dc0e0fa 100644 --- a/src/vulns/CVE-2024-36357.sh +++ b/src/vulns/CVE-2024-36357.sh @@ -93,22 +93,24 @@ check_CVE_2024_36357_linux() { pstatus yellow NO fi - pr_info_nol "* CPU explicitly indicates not vulnerable to TSA-L1 (TSA_L1_NO): " - if [ "$cap_tsa_l1_no" = 1 ]; then - pstatus green YES - elif [ "$cap_tsa_l1_no" = 0 ]; then - pstatus yellow NO - else - pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" - fi + if is_amd || is_hygon; then + pr_info_nol "* CPU explicitly indicates not vulnerable to TSA-L1 (TSA_L1_NO): " + if [ "$cap_tsa_l1_no" = 1 ]; then + pstatus green YES + elif [ "$cap_tsa_l1_no" = 0 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" + fi - pr_info_nol "* Microcode supports VERW buffer clearing: " - if [ "$cap_verw_clear" = 1 ]; then - pstatus green YES - elif [ "$cap_verw_clear" = 0 ]; then - pstatus yellow NO - else - pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" + pr_info_nol "* Microcode supports VERW buffer clearing: " + if [ "$cap_verw_clear" = 1 ]; then + pstatus green YES + elif [ "$cap_verw_clear" = 0 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN "couldn't read CPUID leaf 0x80000021" + fi fi elif [ "$sys_interface_available" = 0 ]; then