feat: implement CVE-2025-40300 (VMScape) and CVE-2024-45332 (BTI)

2026-06-06 06:33:04 +02:00 · 2026-04-04 14:41:09 +02:00
parent e0b818f8fa
commit a00fab131f
7 changed files with 323 additions and 4 deletions
@@ -0,0 +1,40 @@
+# vim: set ts=4 sw=4 sts=4 et:
+###############################
+# CVE-2024-45332, BPI, Branch Privilege Injection
+
+check_CVE_2024_45332() {
+    check_cve 'CVE-2024-45332'
+}
+
+check_CVE_2024_45332_linux() {
+    local status sys_interface_available msg
+    status=UNK
+    sys_interface_available=0
+    msg=''
+
+    # There is no dedicated sysfs file for this vulnerability, and no kernel
+    # mitigation code.  The fix is purely a microcode update (intel-microcode
+    # 20250512+) that corrects the asynchronous branch predictor update timing
+    # so that eIBRS and IBPB work as originally intended.  There is no new
+    # CPUID bit, MSR bit, or ARCH_CAP flag to detect the fix.  The only
+    # reliable indicator is the microcode version, which we cannot check
+    # without violating design principle 3 (never hardcode microcode versions).
+
+    if ! is_cpu_affected "$cve"; then
+        pvulnstatus "$cve" OK "your CPU vendor reported your CPU model as not affected"
+    else
+        pvulnstatus "$cve" UNK "the microcode fix for this vulnerability cannot be detected (no CPUID/MSR indicator); ensure you have intel-microcode 20250512 or later installed"
+        explain "CVE-2024-45332 (Branch Privilege Injection) is a race condition in the branch predictor\n" \
+            "that undermines eIBRS and IBPB protections. The fix is a microcode update only (intel-microcode\n" \
+            "20250512+). No kernel changes are required. Verify your microcode version with: grep microcode\n" \
+            "/proc/cpuinfo. Contact your OS vendor to ensure the latest Intel microcode package is installed."
+    fi
+}
+
+check_CVE_2024_45332_bsd() {
+    if ! is_cpu_affected "$cve"; then
+        pvulnstatus "$cve" OK "your CPU vendor reported your CPU model as not affected"
+    else
+        pvulnstatus "$cve" UNK "your CPU is affected, but mitigation detection has not yet been implemented for BSD in this script"
+    fi
+}