peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2026-09-05 02:13:56 +02:00
Code Issues Projects Releases Wiki Activity
486 Commits 9 Branches 50 Tags
0ba71a443ecded271a12ec307baaa5ed29431b2e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Stéphane Lesimple 0ba71a443e fix: mcedb: v191 changed the MCE table format 
Also update the builtin db to v191+i20210217

Closes #400
 2021-05-24 12:55:44 +02:00
Stéphane Lesimple 3a486e9985 arm64: variant 4: detect ssbd mitigation from kernel img, system.map or kconfig 2021-04-02 15:38:31 +02:00
Stéphane Lesimple 23564cda5d fix: variant4: added case where prctl ssbd status is tagged as 'unknown' 2021-04-02 15:38:31 +02:00
Stéphane Lesimple 0ea21d09bd fix: extract_kernel: don't overwrite kernel_err if already set 
Fixes #395
 2021-04-02 15:33:02 +02:00
Stéphane Lesimple 08e30e156d chore: readme: framapic is gone, host the screenshots on GitHub 2021-02-22 21:22:11 +01:00
Stéphane Lesimple 4ec3154be0 chore: replace 'Vulnerable to' by 'Affected by' in the hw section 
This seems to be less confusing, suggested by #356
 2020-11-10 18:56:25 +01:00
Stéphane Lesimple 843f26630d feat: arm: add Cortex A77 and Neoverse-N1 (fixes #371) 2020-11-10 18:36:42 +01:00
Stéphane Lesimple 7fc2ec65b9 bump to v0.44 2020-11-09 18:41:43 +01:00
Stéphane Lesimple c8cdfd54da chore: fwdb: update to v165.20201021+i20200616 2020-11-08 21:25:18 +01:00
Stéphane Lesimple f0c33c7a32 fix: fwdb: use the commit date as the intel fwdb version 
fixes #379
 2020-11-08 21:25:18 +01:00
Stéphane Lesimple 9e874397da chore: fwdb: update to v163.20200930+i20200904 2020-10-05 20:06:49 +02:00
Stéphane Lesimple 76cb73f3cb fix: fwdb: update Intel's repository URL 2020-10-05 20:06:49 +02:00
Stéphane Lesimple 90f23d286e chore: update fwdb to v160.20200912+i20200722 2020-09-14 21:45:09 +02:00
Stéphane Lesimple e41e311a7f feat: add zstd kernel decompression (#370) 2020-09-14 21:42:55 +02:00
Stéphane Lesimple 1f75f01630 fwdb: update MCEdb to v148 & Intel firmwares to 2020-04-27 2020-06-13 18:11:12 +02:00
Stéphane Lesimple 14a53b19da chore: add CVE to the README 2020-06-10 00:07:14 +02:00
Stéphane Lesimple d8f0ddd7a5 chore: fix indentation 2020-06-10 00:07:14 +02:00
Stéphane Lesimple cb6d139629 chore: tests: now expect 15 CVEs instead of 14 (fix) 2020-06-09 22:56:25 +02:00
Stéphane Lesimple 7e2db09ed9 chore: tests: now expect 15 CVEs instead of 14 2020-06-09 22:51:50 +02:00
Stéphane Lesimple 33cf1cde79 enh: arm: add experimental support for binary arm images 2020-06-06 17:29:32 +02:00
Stéphane Lesimple 4a3006e196 fix: arm64: cve-2017-5753: kernels 4.19+ use a different nospec macro 2020-06-06 17:29:32 +02:00
Stéphane Lesimple 36f98eff95 fwdb: update MCEdb to v147 & Intel firmwares to 2020-04-27 2020-05-31 13:03:58 +02:00
Stéphane Lesimple 3beefc2587 enh: rsb filling: no longer need the 'strings' tool to check for kernel support in live mode 2020-03-10 22:29:54 +01:00
Stéphane Lesimple 27c36fdb80 fwdb: update to v135.20200303+i20200205 2020-03-10 22:29:39 +01:00
Stéphane Lesimple 7d2a510146 chore: update fwdb to v132.20200108+i20191124 2020-02-01 18:58:25 +01:00
Stéphane Lesimple a1a35c9b35 chore: github: add check run on pull requests 2020-01-10 13:19:36 +01:00
Stéphane Lesimple eec77e1ab9 fix: fwdb update: remove Intel extract tempdir on exit 2019-12-10 20:21:52 +01:00
Stéphane Lesimple 5633d374de fix: has_vmm: ignore kernel threads when looking for a hypervisor (fixes #278) 2019-12-10 19:10:45 +01:00
Stéphane Lesimple a343bccb49 bump to v0.43 2019-12-08 15:37:17 +01:00
Stéphane Lesimple 1f604c119b fix var typo 2019-12-08 15:25:54 +01:00
Stéphane Lesimple bfed3187a6 fix: variant3a: Silvermont CPUs are not vulnerable to variant 3a 2019-12-08 14:39:31 +01:00
Stéphane Lesimple 0cd7e1164f feat: detect vanilla 5.4+ locked down mode 2019-12-06 23:03:36 +01:00
Stéphane Lesimple 71129d6b48 fix: tsx: rtm feature bit is in EBX(11) 2019-12-02 19:07:10 +01:00
Stéphane Lesimple 6e799e8b01 fix: mcepsc: fix logic error on non-speculative CPUs that prevented detection of MCEPSC immunity 2019-11-25 23:03:04 +01:00
Stéphane Lesimple 4993b04922 fix: taa: CPUs having TAA_NO bit set are not vulnerable 2019-11-25 21:14:54 +01:00
Stéphane Lesimple 4fc2afe1bc feat: add TSX_CTRL MSR detection in hardware info 2019-11-25 20:58:49 +01:00
Stéphane Lesimple bd47275501 feat: add detection of iTLB Multihit vuln/mitigation (CVE-2018-12207) 2019-11-25 19:13:09 +01:00
Stéphane Lesimple 8ddf6b2d6d enh: replace shell wildcard by a find to avoid potiental error (list of args too long) 2019-11-24 17:26:13 +01:00
Stéphane Lesimple 16b6490ffc chore: avoid ${var:-]} syntax, badly confusing vim's syntax highlighter 2019-11-24 17:26:13 +01:00
Stéphane Lesimple 18df38fae6 fix: sgx: on locked down kernels, fallback to CPUID bit for detection 
on locked down kernels (Fedora / Red Hat feature that prevents writing
to MSRs from userspace, even if root), we can't write to FLUSH_CMD MSR
to verify that it's present. So fallback to checking the existence of
the L1D flush CPUID feature bit to infer that the microcode has been
updated in a recent enough version that also mitigates SGX (fixes for
both issues have been included in the same microcode updates for all
Intel CPUs)
 2019-11-24 17:26:01 +01:00
Stéphane Lesimple a306757c22 fix: detect Red Hat locked down kernels (impacts MSR writes) 2019-11-24 17:26:01 +01:00
Stéphane Lesimple e01f97ee75 fix: fwdb: don't use local db if it's older than our builtin version 2019-11-24 17:25:41 +01:00
Stéphane Lesimple fa7f814f4f chore: rename mcedb cmdline parameters to fwdb 2019-11-24 17:25:41 +01:00
Stéphane Lesimple bb32a16a86 update fwdb to v130.20191104+i20191027 2019-11-24 17:25:41 +01:00
Stéphane Lesimple 8c84c0ba17 enh: fwdb: use both Intel GitHub repo and MCEdb to build our database 2019-11-24 17:25:41 +01:00
Stéphane Lesimple 6abe1bc62b enh: kernel decompression: better tolerance over missing tools 
fixes #297
 2019-11-23 16:43:00 +01:00
Stéphane Lesimple 5ca7fe91ff fix: pteinv: don't check kernel image if not available 2019-11-23 14:01:56 +01:00
Stéphane Lesimple 4ba68fba74 fix: silence useless error from grep (fixes #322) 2019-11-23 13:51:00 +01:00
Stéphane Lesimple 59ad312773 fix: msr: fix msr module detection under Ubuntu 19.10 (fixes #316) 2019-11-19 22:35:08 +01:00
Stéphane Lesimple 418533c47e chore: remove LICENSE file, SPDX id is enough 2019-11-18 11:28:20 -08:00
Stéphane Lesimple 3e757b6177 chore: add github check workflow 2019-11-18 11:28:20 -08:00
Stéphane Lesimple f724f94085 enh: kernel: autodetect customized arch kernels from cmdline 2019-11-17 13:36:52 -08:00
Stéphane Lesimple dcf540888d enh: mock: implement reading from /proc/cmdline 2019-11-17 13:36:52 -08:00
Stéphane Lesimple 9911c243b2 feat: use --live with --kernel/--config/--map to override file detection in live mode 2019-11-17 13:36:52 -08:00
Stéphane Lesimple cb279a49ec enh(taa): more complete version 2019-11-13 01:07:10 +01:00
Stéphane Lesimple c100ce4c0d mcedb: update from v112 to v130 2019-11-12 21:19:03 +01:00
Stéphane Lesimple 4741b06160 fix: batch mode for TAA 2019-11-12 21:16:21 +01:00
Stéphane Lesimple e0a1c2ec77 fix shellcheck warnings 2019-11-12 20:06:12 +01:00
Stéphane Lesimple f5ec320fe5 enh: rework the vuln logic of MDS with --paranoid (fixes #307) 2019-09-22 04:02:33 +02:00
Stéphane Lesimple cc224c0522 fix: mocking value for read_msr 
we were returning the mocking value before actually setting it.
also remove spaces around the returned value (no behavior change)
 2019-09-22 01:38:18 +02:00
Stéphane Lesimple f835f4d07d Explain that Enhanced IBRS is better for performance than classic IBRS 2019-08-16 12:53:39 +02:00
Stéphane Lesimple fcc4ff4de2 update MCEdb from v110 to v111, bump to v0.42 2019-05-24 22:49:45 +02:00
Stéphane Lesimple 0bd38ddda0 enh: -v -v now implies --dump-mock-data 2019-05-24 11:36:39 +02:00
Stéphane Lesimple e83dc818cd feat(mds): implement FreeBSD mitigation detection 2019-05-24 11:17:04 +02:00
Stéphane Lesimple d69ea67101 feat(mock): add --dump-mock-data 2019-05-24 10:49:40 +02:00
Stéphane Lesimple dfe0d10f2a fix(mds): remove useless display of MD_CLEAR info in non-hw section 2019-05-24 10:20:48 +02:00
Stéphane Lesimple 58a5acfdbb fix(bsd): read_msr returned data in an incorrect format 2019-05-24 09:33:56 +02:00
Stéphane Lesimple ccb4dbef7c enh(mock): avoid reading the sysfs interface outside sys_interface_check() for higher mocking coverage 2019-05-24 09:28:18 +02:00
Stéphane Lesimple afbb26277f feat(mock): add mocking functionality to help reproducing issues under specific CPUs 2019-05-24 09:28:18 +02:00
Stéphane Lesimple 77b34d48c6 fix(mds): check MDS_NO bit in is_cpu_mds_free() 2019-05-24 09:28:18 +02:00
Stéphane Lesimple 497efe6a82 fix(l1tf): RDCL_NO bit didn't take precedence for vulnerability check on some Intel CPUs 2019-05-24 09:28:18 +02:00
Stéphane Lesimple 62b46df4e7 fix(l1tf): remove libvirtd from hypervisor detection (#278) 2019-05-18 14:22:42 +02:00
Stéphane Lesimple 7d1f269bed fix(mds): AMD confirms they're not vulnerable 2019-05-16 11:31:28 +02:00
Stéphane Lesimple 5788cec18b fix(mds): ARM and CAVIUM are not thought to be vulnerable 2019-05-15 10:56:49 +02:00
Stéphane Lesimple ae56ec0bc5 bump to v0.41 2019-05-15 09:57:28 +02:00
Stéphane Lesimple 871443c9db fix typos in README 2019-05-15 00:28:55 +02:00
Stéphane Lesimple 8fd4e3ab01 fix(xen): remove xenbus and xenwatch as they also exist in domU 2019-05-15 00:23:05 +02:00
Stéphane Lesimple de793a7204 feat(mds): more verbose info about kernel support and microcode support for mitigation 2019-05-15 00:21:08 +02:00
Stéphane Lesimple 11790027d3 feat(mds): add alias ZombieLoad for CVE-2018-12130 2019-05-14 21:42:36 +02:00
Stéphane Lesimple 5939c38c5c update mcedb from v109 to v110 to better detect MDS microcodes 2019-05-14 20:31:27 +02:00
Stéphane Lesimple db7d3206fd feat(mds): add detection of availability of MD_CLEAR instruction 2019-05-14 20:30:47 +02:00
Stéphane Lesimple 1d13a423b8 adjust README 2019-05-14 20:16:01 +02:00
Stéphane Lesimple d547ce4ab4 fix(ssb): fix error when no process uses prctl to set ssb mitigation 
fixes #281
 2019-05-13 15:35:58 +02:00
Stéphane Lesimple d187827841 enh(vmm): add Xen daemons detection 2019-05-08 20:44:54 +02:00
Stéphane Lesimple fcc04437e8 update builtin MCEdb from v96 to v109 2019-05-07 20:29:59 +02:00
Stéphane Lesimple d31a9810e6 enhance previous commit logic 2019-05-05 20:09:53 +02:00
Stéphane Lesimple 4edb867def fix(vmm): revert to checking the running processes to detect a hypervisor 
More information available on #278
 2019-05-05 20:04:25 +02:00
Stéphane Lesimple 1264b1c7a3 chore: more shellcheck 0.6 fixes 2019-05-05 18:34:09 +02:00
Stéphane Lesimple 7beca1ac50 fix: invalid names in json batch mode (fixes #279) 2019-05-05 18:15:41 +02:00
Stéphane Lesimple bfa4de96e6 enh(l1tf): in paranoid mode, assume we're running a hypervisor unless stated otherwise 
This change ensures we check for SMT and advise the user to disable it for maximum security.
Doing this, we'll help users mitigate a whole range of vulnerabilities taking advantage of SMT to attack purely from userland other userland processes, as seen in CVE-2018-5407 (also see #261)
 2019-04-21 14:05:43 +02:00
Stéphane Lesimple b022b27a51 feat(ssbd): in live mode, report whether the mitigation is active (fix #210) 2019-04-20 20:27:45 +02:00
Stéphane Lesimple 23e7db044e fix(bsd): load vmm if not already loaded, fixes #274 
As we read sysctl values under the vmm hierarchy, the modules needs to be loaded,
so if not already done, we load it before testing for CVE-2018-3620 and CVE-2018-3646
 2019-04-19 19:47:04 +02:00
Stéphane Lesimple fc4981bb94 update MCEDB from v84 to v96 2019-01-20 19:52:46 +01:00
Stéphane Lesimple d7d2e6934b fix: typo in bare metal detection (fixes #269) 2018-12-12 00:24:17 +01:00
Stéphane Lesimple c705afe764 bump to v0.40 2018-10-03 20:56:46 +02:00
Stéphane Lesimple f5106b3c02 update MCEDB from v83 to v84 (no actual change) 2018-09-30 16:57:35 +02:00
Stéphane Lesimple 68289dae1e feat: add --update-builtin-mcedb to update the DB inside the script 2018-09-30 16:56:58 +02:00
Stéphane Lesimple 3b2d529654 feat(l1tf): read & report ARCH_CAPABILITIES bit 3 (SKIP_VMENTRY_L1DFLUSH) 2018-09-29 13:16:07 +02:00
Stéphane Lesimple cbb18cb6b6 fix(l1tf): properly detect status under Red Hat/CentOS kernels 2018-09-29 13:01:13 +02:00
Stéphane Lesimple 299103a3ae some fixes when script is not started as root 2018-09-29 13:01:13 +02:00