peter/spectre-meltdown-checker
peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2024-12-21 10:38:04 +01:00
Code Issues Projects Releases Wiki Activity

v0.19: introduce --no-color

Browse Source
This commit is contained in:
Stéphane Lesimple 2018-01-09 10:32:51 +01:00
parent 6f1bdba1d9
commit f0f2ea9b11
1 changed files with 99 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

150
spectre-meltdown-checker.sh
View File

@ -8,21 +8,25 @@
# #
# Stephane Lesimple # Stephane Lesimple
# #
VERSION=0.18 VERSION=0.19
# print status function # print status function
pstatus() pstatus()
{ {
case "$1" in if [ "$opt_no_color" = 1 ]; then
red) col="\033[101m\033[30m";; _echo_nol "$2"
green) col="\033[102m\033[30m";; else
yellow) col="\033[103m\033[30m";; case "$1" in
blue) col="\033[104m\033[30m";; red) col="\033[101m\033[30m";;
*) col="";; green) col="\033[102m\033[30m";;
esac yellow) col="\033[103m\033[30m";;
/bin/echo -ne "$col $2 \033[0m" blue) col="\033[104m\033[30m";;
[ -n "$3" ] && /bin/echo -n " ($3)" *) col="";;
/bin/echo esac
_echo_nol "$col $2 \033[0m"
fi
[ -n "$3" ] && _echo_nol " ($3)"
_echo
} }
# The 3 below functions are taken from the extract-linux script, available here: # The 3 below functions are taken from the extract-linux script, available here:
@ -97,13 +101,14 @@ show_usage()
{ {
cat <<EOF cat <<EOF
Usage: Usage:
Live mode: $0 Live mode: $0 [options] [--live]
Offline mode: $0 [--kernel <vmlinux_file>] [--config <kernel_config>] [--map <kernel_map_file>] Offline mode: $0 [options] [--kernel <vmlinux_file>] [--config <kernel_config>] [--map <kernel_map_file>]
Options:
Modes:
Two modes are available. Two modes are available.
First mode is the "live" mode (default), it does its best to find information about the currently running kernel. First mode is the "live" mode (default), it does its best to find information about the currently running kernel.
To run under this mode, just start the script without any option. To run under this mode, just start the script without any option (you can also use --live explicitely)
Second mode is the "offline" mode, where you can inspect a non-running kernel. Second mode is the "offline" mode, where you can inspect a non-running kernel.
You'll need to specify the location of the vmlinux file, and if possible, the corresponding config and System.map files: You'll need to specify the location of the vmlinux file, and if possible, the corresponding config and System.map files:
@ -112,17 +117,45 @@ show_usage()
--config kernel_config Specify a kernel config file --config kernel_config Specify a kernel config file
--map kernel_map_file Specify a kernel System.map file --map kernel_map_file Specify a kernel System.map file
Options:
--no-color Don't use color codes
EOF EOF
} }
/bin/echo -e "\033[1;34mSpectre and Meltdown mitigation detection tool v$VERSION\033[0m" __echo()
/bin/echo {
opt="$1"
shift
msg="$@"
if [ "$opt_no_color" = 1 ] ; then
# strip ANSI color codes
msg=$(echo "$msg" | sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g")
fi
# explicitely call /bin/echo to avoid shell builtins that might not take options
/bin/echo $opt -e "$msg"
}
_echo()
{
__echo '' "$@"
}
_echo_nol()
{
__echo -n "$@"
}
_echo "\033[1;34mSpectre and Meltdown mitigation detection tool v$VERSION\033[0m"
_echo
# parse options # parse options
opt_kernel='' opt_kernel=''
opt_config='' opt_config=''
opt_map='' opt_map=''
opt_live_explicit=0
opt_live=1 opt_live=1
opt_no_color=0
parse_opt_file() parse_opt_file()
{ {
@ -163,6 +196,12 @@ while [ -n "$1" ]; do
[ $? -ne 0 ] && exit $? [ $? -ne 0 ] && exit $?
shift 2 shift 2
opt_live=0 opt_live=0
elif [ "$1" = "--live" ]; then
opt_live_explicit=1
shift
elif [ "$1" = "--no-color" ]; then
opt_no_color=1
shift
elif [ "$1" = "-h" -o "$1" = "--help" ]; then elif [ "$1" = "-h" -o "$1" = "--help" ]; then
show_usage show_usage
exit 0 exit 0
@ -173,16 +212,25 @@ while [ -n "$1" ]; do
fi fi
done done
# check for mode selection inconsistency
if [ "$opt_live_explicit" = 1 ]; then
if [ -n "$opt_kernel" -o -n "$opt_config" -o -n "$opt_map" ]; then
show_usage
echo "$0: error: incompatible modes specified, use either --live or --kernel/--config/--map"
exit 1
fi
fi
# root check (only for live mode, for offline mode, we already checked if we could read the files) # root check (only for live mode, for offline mode, we already checked if we could read the files)
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
if [ "$(id -u)" -ne 0 ]; then if [ "$(id -u)" -ne 0 ]; then
/bin/echo -e "\033[31mNote that you should launch this script with root privileges to get accurate information.\033[0m" _echo "\033[31mNote that you should launch this script with root privileges to get accurate information.\033[0m"
/bin/echo -e "\033[31mWe'll proceed but you might see permission denied errors.\033[0m" _echo "\033[31mWe'll proceed but you might see permission denied errors.\033[0m"
/bin/echo -e "\033[31mTo run it as root, you can try the following command: sudo $0\033[0m" _echo "\033[31mTo run it as root, you can try the following command: sudo $0\033[0m"
/bin/echo _echo
fi fi
/bin/echo -e "Checking for vulnerabilities against live running kernel \033[35m"$(uname -s) $(uname -r) $(uname -v) $(uname -m)"\033[0m" _echo "Checking for vulnerabilities against live running kernel \033[35m"$(uname -s) $(uname -r) $(uname -v) $(uname -m)"\033[0m"
# try to find the image of the current running kernel # try to find the image of the current running kernel
[ -e /boot/vmlinuz-linux ] && opt_kernel=/boot/vmlinuz-linux [ -e /boot/vmlinuz-linux ] && opt_kernel=/boot/vmlinuz-linux
@ -209,24 +257,24 @@ if [ "$opt_live" = 1 ]; then
opt_config=/boot/config-$(uname -r) opt_config=/boot/config-$(uname -r)
fi fi
else else
/bin/echo "Checking for vulnerabilities against specified kernel" _echo "Checking for vulnerabilities against specified kernel"
fi fi
if [ -n "$opt_kernel" ]; then if [ -n "$opt_kernel" ]; then
/bin/echo -e "Will use vmlinux image \033[35m$opt_kernel\033[0m" _echo "Will use vmlinux image \033[35m$opt_kernel\033[0m"
else else
/bin/echo "Will use no vmlinux image (accuracy might be reduced)" _echo "Will use no vmlinux image (accuracy might be reduced)"
fi fi
if [ -n "$dumped_config" ]; then if [ -n "$dumped_config" ]; then
/bin/echo -e "Will use kconfig \033[35m/proc/config.gz\033[0m" _echo "Will use kconfig \033[35m/proc/config.gz\033[0m"
elif [ -n "$opt_config" ]; then elif [ -n "$opt_config" ]; then
/bin/echo -e "Will use kconfig \033[35m$opt_config\033[0m" _echo "Will use kconfig \033[35m$opt_config\033[0m"
else else
/bin/echo "Will use no kconfig (accuracy might be reduced)" _echo "Will use no kconfig (accuracy might be reduced)"
fi fi
if [ -n "$opt_map" ]; then if [ -n "$opt_map" ]; then
/bin/echo -e "Will use System.map file \033[35m$opt_map\033[0m" _echo "Will use System.map file \033[35m$opt_map\033[0m"
else else
/bin/echo "Will use no System.map file (accuracy might be reduced)" _echo "Will use no System.map file (accuracy might be reduced)"
fi fi
if [ -e "$opt_kernel" ]; then if [ -e "$opt_kernel" ]; then
@ -242,12 +290,12 @@ if [ -z "$vmlinux" -o ! -r "$vmlinux" ]; then
[ -z "$vmlinux_err" ] && vmlinux_err="couldn't extract your kernel from $opt_kernel" [ -z "$vmlinux_err" ] && vmlinux_err="couldn't extract your kernel from $opt_kernel"
fi fi
/bin/echo _echo
########### ###########
# SPECTRE 1 # SPECTRE 1
/bin/echo -e "\033[1;34mCVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'\033[0m" _echo "\033[1;34mCVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'\033[0m"
/bin/echo -n "* Checking count of LFENCE opcodes in kernel: " _echo_nol "* Checking count of LFENCE opcodes in kernel: "
status=0 status=0
if [ -n "$vmlinux_err" ]; then if [ -n "$vmlinux_err" ]; then
@ -273,17 +321,17 @@ else
fi fi
fi fi
/bin/echo -ne "> \033[46m\033[30mSTATUS:\033[0m " _echo_nol "> \033[46m\033[30mSTATUS:\033[0m "
[ "$status" = 0 ] && pstatus yellow UNKNOWN [ "$status" = 0 ] && pstatus yellow UNKNOWN
[ "$status" = 1 ] && pstatus red 'VULNERABLE' 'heuristic to be improved when official patches become available' [ "$status" = 1 ] && pstatus red 'VULNERABLE' 'heuristic to be improved when official patches become available'
[ "$status" = 2 ] && pstatus green 'NOT VULNERABLE' 'heuristic to be improved when official patches become available' [ "$status" = 2 ] && pstatus green 'NOT VULNERABLE' 'heuristic to be improved when official patches become available'
########### ###########
# VARIANT 2 # VARIANT 2
/bin/echo _echo
/bin/echo -e "\033[1;34mCVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'\033[0m" _echo "\033[1;34mCVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'\033[0m"
/bin/echo "* Mitigation 1" _echo "* Mitigation 1"
/bin/echo -n "* Hardware (CPU microcode) support for mitigation: " _echo_nol "* Hardware (CPU microcode) support for mitigation: "
if [ ! -e /dev/cpu/0/msr ]; then if [ ! -e /dev/cpu/0/msr ]; then
# try to load the module ourselves (and remember it so we can rmmod it afterwards) # try to load the module ourselves (and remember it so we can rmmod it afterwards)
modprobe msr 2>/dev/null && insmod_msr=1 modprobe msr 2>/dev/null && insmod_msr=1
@ -307,7 +355,7 @@ if [ "$insmod_msr" = 1 ]; then
rmmod msr 2>/dev/null rmmod msr 2>/dev/null
fi fi
/bin/echo -n "* Kernel support for IBRS: " _echo_nol "* Kernel support for IBRS: "
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
if [ ! -e /sys/kernel/debug/sched_features ]; then if [ ! -e /sys/kernel/debug/sched_features ]; then
# try to mount the debugfs hierarchy ourselves and remember it to umount afterwards # try to mount the debugfs hierarchy ourselves and remember it to umount afterwards
@ -335,7 +383,7 @@ if [ "$ibrs_supported" != 1 ]; then
pstatus red NO pstatus red NO
fi fi
/bin/echo -n "* IBRS enabled for Kernel space: " _echo_nol "* IBRS enabled for Kernel space: "
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
# 0 means disabled # 0 means disabled
# 1 is enabled only for kernel space # 1 is enabled only for kernel space
@ -350,7 +398,7 @@ else
pstatus blue N/A "not testable in offline mode" pstatus blue N/A "not testable in offline mode"
fi fi
/bin/echo -n "* IBRS enabled for User space: " _echo_nol "* IBRS enabled for User space: "
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
case "$ibrs_enabled" in case "$ibrs_enabled" in
"") [ "$ibrs_supported" = 1 ] && pstatus yellow UNKNOWN || pstatus red NO;; "") [ "$ibrs_supported" = 1 ] && pstatus yellow UNKNOWN || pstatus red NO;;
@ -362,8 +410,8 @@ else
pstatus blue N/A "not testable in offline mode" pstatus blue N/A "not testable in offline mode"
fi fi
/bin/echo "* Mitigation 2" _echo "* Mitigation 2"
/bin/echo -n "* Kernel compiled with retpoline option: " _echo_nol "* Kernel compiled with retpoline option: "
# We check the RETPOLINE kernel options # We check the RETPOLINE kernel options
if [ -r "$opt_config" ]; then if [ -r "$opt_config" ]; then
if grep -q '^CONFIG_RETPOLINE=y' "$opt_config"; then if grep -q '^CONFIG_RETPOLINE=y' "$opt_config"; then
@ -376,7 +424,7 @@ else
pstatus yellow UNKNOWN "couldn't read your kernel configuration" pstatus yellow UNKNOWN "couldn't read your kernel configuration"
fi fi
/bin/echo -n "* Kernel compiled with a retpoline-aware compiler: " _echo_nol "* Kernel compiled with a retpoline-aware compiler: "
# Now check if the compiler used to compile the kernel knows how to insert retpolines in generated asm # Now check if the compiler used to compile the kernel knows how to insert retpolines in generated asm
# For gcc, this is -mindirect-branch=thunk-extern (detected by the kernel makefiles) # For gcc, this is -mindirect-branch=thunk-extern (detected by the kernel makefiles)
# See gcc commit https://github.com/hjl-tools/gcc/commit/23b517d4a67c02d3ef80b6109218f2aadad7bd79 # See gcc commit https://github.com/hjl-tools/gcc/commit/23b517d4a67c02d3ef80b6109218f2aadad7bd79
@ -412,7 +460,7 @@ else
pstatus yellow UNKNOWN "couldn't find your kernel image or System.map" pstatus yellow UNKNOWN "couldn't find your kernel image or System.map"
fi fi
/bin/echo -ne "> \033[46m\033[30mSTATUS:\033[0m " _echo_nol "> \033[46m\033[30mSTATUS:\033[0m "
if grep -q AMD /proc/cpuinfo; then if grep -q AMD /proc/cpuinfo; then
pstatus green "NOT VULNERABLE" "your CPU is not vulnerable as per the vendor" pstatus green "NOT VULNERABLE" "your CPU is not vulnerable as per the vendor"
elif [ "$retpoline" = 1 -a "$retpoline_compiler" = 1 ]; then elif [ "$retpoline" = 1 -a "$retpoline_compiler" = 1 ]; then
@ -433,9 +481,9 @@ fi
########## ##########
# MELTDOWN # MELTDOWN
/bin/echo _echo
/bin/echo -e "\033[1;34mCVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'\033[0m" _echo "\033[1;34mCVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'\033[0m"
/bin/echo -n "* Kernel supports Page Table Isolation (PTI): " _echo_nol "* Kernel supports Page Table Isolation (PTI): "
kpti_support=0 kpti_support=0
kpti_can_tell=0 kpti_can_tell=0
if [ -n "$opt_config" ]; then if [ -n "$opt_config" ]; then
@ -473,7 +521,7 @@ else
pstatus yellow UNKNOWN "couldn't read your kernel configuration nor System.map file" pstatus yellow UNKNOWN "couldn't read your kernel configuration nor System.map file"
fi fi
/bin/echo -n "* PTI enabled and active: " _echo_nol "* PTI enabled and active: "
if [ "$opt_live" = 1 ]; then if [ "$opt_live" = 1 ]; then
if grep ^flags /proc/cpuinfo | grep -qw pti; then if grep ^flags /proc/cpuinfo | grep -qw pti; then
# vanilla PTI patch sets the 'pti' flag in cpuinfo # vanilla PTI patch sets the 'pti' flag in cpuinfo
@ -504,7 +552,7 @@ if [ "$mounted_debugfs" = 1 ]; then
umount /sys/kernel/debug umount /sys/kernel/debug
fi fi
/bin/echo -ne "> \033[46m\033[30mSTATUS:\033[0m " _echo_nol "> \033[46m\033[30mSTATUS:\033[0m "
if grep -q AMD /proc/cpuinfo; then if grep -q AMD /proc/cpuinfo; then
pstatus green "NOT VULNERABLE" "your CPU is not vulnerable as per the vendor" pstatus green "NOT VULNERABLE" "your CPU is not vulnerable as per the vendor"
elif [ "$opt_live" = 1 ]; then elif [ "$opt_live" = 1 ]; then
@ -521,6 +569,6 @@ else
fi fi
fi fi
/bin/echo _echo
[ -n "$dumped_config" ] && rm -f "$dumped_config" [ -n "$dumped_config" ] && rm -f "$dumped_config"