mirror of
https://github.com/speed47/spectre-meltdown-checker.git
synced 2024-12-12 06:08:03 +01:00
add variant 1 check
This commit is contained in:
parent
3b760822ff
commit
ef7c0d7ec5
@ -16,15 +16,85 @@ pstatus()
|
||||
/bin/echo
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------
|
||||
# extract-vmlinux - Extract uncompressed vmlinux from a kernel image
|
||||
#
|
||||
# Inspired from extract-ikconfig
|
||||
# (c) 2009,2010 Dick Streefland <dick@streefland.net>
|
||||
#
|
||||
# (c) 2011 Corentin Chary <corentin.chary@gmail.com>
|
||||
#
|
||||
# Licensed under the GNU General Public License, version 2 (GPLv2).
|
||||
# ----------------------------------------------------------------------
|
||||
|
||||
check_vmlinux()
|
||||
{
|
||||
file "$1" 2>/dev/null | grep -q ELF || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
try_decompress()
|
||||
{
|
||||
# The obscure use of the "tr" filter is to work around older versions of
|
||||
# "grep" that report the byte offset of the line instead of the pattern.
|
||||
|
||||
# Try to find the header ($1) and decompress from here
|
||||
for pos in `tr "$1\n$2" "\n$2=" < "$img" | grep -abo "^$2"`
|
||||
do
|
||||
pos=${pos%%:*}
|
||||
tail -c+$pos "$img" | $3 > $vmlinuxtmp 2> /dev/null
|
||||
check_vmlinux $vmlinuxtmp && echo $vmlinuxtmp || rm -f $vmlinuxtmp
|
||||
done
|
||||
}
|
||||
|
||||
extract_vmlinux()
|
||||
{
|
||||
img="$1"
|
||||
|
||||
# Prepare temp files:
|
||||
vmlinuxtmp=$(mktemp /tmp/vmlinux-XXX)
|
||||
|
||||
# Initial attempt for uncompressed images or objects:
|
||||
check_vmlinux $img
|
||||
|
||||
# That didn't work, so retry after decompression.
|
||||
try_decompress '\037\213\010' xy gunzip || \
|
||||
try_decompress '\3757zXZ\000' abcde unxz || \
|
||||
try_decompress 'BZh' xy bunzip2 || \
|
||||
try_decompress '\135\0\0\0' xxx unlzma || \
|
||||
try_decompress '\211\114\132' xy 'lzop -d'
|
||||
}
|
||||
|
||||
|
||||
/bin/echo "Spectre and Meltdown mitigation detection tool v$VERSION"
|
||||
/bin/echo
|
||||
|
||||
# SPECTRE 1
|
||||
/bin/echo -e "\033[1;34mCVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'\033[0m"
|
||||
/bin/echo -n "* Kernel recompiled with LFENCE opcode insertion: "
|
||||
pstatus yellow UNKNOWN "check not yet implemented"
|
||||
/bin/echo -n "* Kernel compiled with LFENCE opcode inserted at the proper places: "
|
||||
|
||||
vmlinux=$(extract_vmlinux /boot/vmlinuz-4.4.110)
|
||||
status=0
|
||||
if [ -z "$vmlinux" -o ! -r "$vmlinux" ]; then
|
||||
pstatus yellow UNKNOWN "couldn't extract your kernel"
|
||||
elif ! which objdump >/dev/null 2>&1; then
|
||||
pstatus yellow UNKNOWN "missing 'objdump' tool, please install it, usually it's in the binutils package"
|
||||
else
|
||||
nb_lfence=$(objdump -D "$vmlinux" | grep -wc lfence)
|
||||
if [ "$nb_lfence" -lt 50 ]; then
|
||||
pstatus red NO "only $nb_lfence lfence opcodes found, should be >= 50"
|
||||
status=1
|
||||
else
|
||||
pstatus green YES "$nb_lfence opcodes found, which is >= 50"
|
||||
status=2
|
||||
fi
|
||||
rm -f $vmlinux
|
||||
fi
|
||||
|
||||
/bin/echo -ne "> \033[46m\033[30mSTATUS:\033[0m "
|
||||
pstatus yellow UNKNOWN "not implemented, but real answer is most probably VULNERABLE at this stage"
|
||||
[ "$status" = 0 ] && pstatus yellow UNKNOWN
|
||||
[ "$status" = 1 ] && pstatus red VULNERABLE
|
||||
[ "$status" = 2 ] && pstatus green 'NOT VULNERABLE'
|
||||
|
||||
|
||||
# VARIANT 2
|
||||
@ -153,4 +223,3 @@ if [ "$USER" != root ]; then
|
||||
/bin/echo "You can try the following command: sudo $0"
|
||||
fi
|
||||
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user