peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2026-04-07 09:13:20 +02:00
Code Issues Projects Releases Wiki Activity

fix: better detect kernel lockdown & no longer require cap_flush_cmd to deem CVE-2018-3615 as mitigated (fix #296)

Browse Source
This commit is contained in:
Stéphane Lesimple
2026-04-06 12:29:26 +02:00
parent 435f72de25
commit 7ed95384b5
4 changed files with 35 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/libs/400_hw_check.sh
View File

@@ -626,17 +626,16 @@ check_cpu() {
if [ "$opt_allow_msr_write" = 1 ]; then
pr_info_nol " * FLUSH_CMD MSR is available: "
# the new MSR 'FLUSH_CMD' is at offset 0x10b, write-only
# this is probed for informational purposes only, the CPUID L1D flush bit
# (cap_l1df) is the authoritative indicator per Intel guidance
write_msr 0x10b
ret=$?
if [ $ret = $WRITE_MSR_RET_OK ]; then
pstatus green YES
cap_flush_cmd=1
elif [ $ret = $WRITE_MSR_RET_KO ]; then
pstatus yellow NO
cap_flush_cmd=0
else
pstatus yellow UNKNOWN "$ret_write_msr_msg"
cap_flush_cmd=-1
fi
fi
@@ -655,12 +654,6 @@ check_cpu() {
cap_l1df=-1
fi
# if we weren't allowed to probe the write-only MSR but the CPUID
# bit says that it shoul be there, make the assumption that it is
if [ "$opt_allow_msr_write" != 1 ]; then
cap_flush_cmd=$cap_l1df
fi
if is_intel; then
pr_info " * Microarchitectural Data Sampling"
pr_info_nol " * VERW instruction is available: "