fbbb19f244
Fix cases where a CPU ucode version is not found in $procfs/cpuinfo. ( #246 )
...
* Fix cases where a CPU ucode version is not found in $procfs/cpuinfo.
When running whithin a virtual machine, it seems like $procfs/cpuinfo doesn't contain
a 'microcode' line, which triggers a script runtime error.
Fall back to '0x0' in this case, as other part of the script seems to already this
as a default value anyway.
* Double quote to prevent globbing and word splitting.
2018-09-19 22:00:59 +02:00
1571a56ce2
feat: add L1D flush cpuid feature bit detection
2018-09-19 09:05:23 +02:00
3cf9141601
fix: don't display summary if no CVE was tested (e.g. --hw-only)
2018-09-19 09:04:52 +02:00
bff38f1b26
BSD: add not-implemented-yet notice for Foreshadow-NG
2018-09-18 22:06:01 +02:00
b419fe7c63
feat(variant4): properly detect SSBD under BSD
2018-09-18 22:00:32 +02:00
f193484a4a
chore: fix deprecated SPDX license identifier ( #249 ) ( #251 )
...
The SPDX license identifier 'GPL-3.0' has been deprecated according to
<https://spdx.org/licenses/GPL-3.0.html >.
2018-09-18 20:00:53 +02:00
349d77b3b6
Fix kernel detection when /lib/kernel exists on a distro ( #252 )
...
Commit b48b2177b7#244 )") broke kernel
detection for distros using that directory for other purposes than
storing the kernel image.
Example:
# pacman -Qo /lib/kernel
/usr/lib/kernel/ is owned by mkinitcpio 24-2
/usr/lib/kernel/ is owned by systemd 239.2-1
Signed-off-by: Laszlo Toth <laszlth@gmail.com>
2018-09-18 20:00:20 +02:00
e589ed7f02
fix: don't test SGX again in check_CVE_2018_3615, already done by is_cpu_vulnerable
2018-09-17 22:28:04 +02:00
ae1206288f
fix: remove some harcoded /proc paths, use $procfs instead
2018-09-17 22:26:20 +02:00
7b72c20f89
feat(l1tf): explode L1TF in its 3 distinct CVEs
2018-09-17 21:44:48 +02:00
b48b2177b7
feat: Add Clear Linux Distro ( #244 )
...
Add path of Clear Linux kernel binary and kernel config file.
2018-09-15 15:51:49 +02:00
8f31634df6
feat(batch): Add a batch short option for one line result ( #243 )
...
When using this script on a large amount a machine (via clustershell or
instance) it can be easier to have a very short result on one line
showing only the vulnerabilities
2018-09-15 15:45:10 +02:00
96798b1932
chore: add SPDX GPL-3.0 license identifier ( #245 )
...
The spectre-meltdown-checker.sh file is missing licensing information.
The SPDX identifier is a legally binding shorthand, which can be
used instead of the full boiler plate text.
2018-09-15 15:33:41 +02:00
687ce1a7fa
fix: load cpuid module if absent even when /dev/cpu/0/cpuid is there
2018-09-08 23:15:50 +02:00
80e0db7cc4
fix: don't show erroneous ucode version when latest version is unknown ( fixes #238 )
2018-08-28 20:51:46 +02:00
e8890ffac6
feat(config): support for genkernel kernel config file ( #239 )
...
Add support for distributions using genkernel.
2018-08-28 20:24:37 +02:00
afb36c519d
Fix typo: 'RBS filling' => 'RSB filling' ( #237 )
2018-08-18 12:05:17 +02:00
0009c0d473
fix: --batch now implies --no-color to avoid colored warnings
2018-08-18 12:04:18 +02:00
dd67fd94d7
feat: add FLUSH_CMD MSR availability detection (part of L1TF mitigation)
2018-08-16 19:05:09 +02:00
339ad31757
fix: add missing l1tf CPU vulnerability display in hw section
2018-08-16 15:19:29 +02:00
794c5be1d2
feat: add optional git describe support to display inter-release version numbers
2018-08-16 15:18:47 +02:00
a7afc585a9
fix several incorrect ucode version numbers
2018-08-16 10:51:55 +02:00
fc1dffd09a
feat: implement detection of latest known versions of intel microcodes
2018-08-15 12:53:49 +02:00
e942616189
feat: initial support for L1TF
2018-08-15 12:05:08 +02:00
360be7b35f
fix: hide arch_capabilities_msr_not_read warning under !intel
2018-08-13 15:42:56 +02:00
5f59257826
bump to v0.39
2018-08-13 15:33:03 +02:00
92d59cbdc1
chore: adjust some comments, add 2 missing inits
2018-08-11 10:31:10 +02:00
4747b932e7
feat: add detection of RSBA feature bit and adjust logic accordingly
2018-08-10 10:26:23 +02:00
860023a806
fix: ARCH MSR was not read correctly, preventing proper SSB_NO and RDCL_NO detection
2018-08-10 10:26:23 +02:00
ab67a9221d
feat: read/write msr now supports msr-tools or perl as dd fallback
2018-08-10 10:26:23 +02:00
f4592bf3a8
Add Arch armv5/armv7 kernel image location ( #227 )
2018-08-09 22:13:30 +02:00
be15e47671
chore: setting master to v0.38+
2018-08-09 14:25:22 +02:00
d3481d9524
Add support for the kernel being within a btrfs subvolume ( #226 )
...
- /boot may be within a named root subvolume (eg. "/@/boot")
- /boot may be in its own subvolume (eg. "/@boot")
2018-08-09 14:00:35 +02:00
21af561148
bump to v0.38
2018-08-07 10:55:50 +02:00
cb740397f3
feat(arm32): add spectrev1 mitigation detection
2018-08-07 10:42:03 +02:00
84195689af
change: default to --no-explain, use --explain to get detailed mitigation help
2018-08-04 16:31:41 +02:00
b637681fa8
fix: debug output: msg inaccuracy for ARM checks
2018-08-04 16:19:54 +02:00
9316c30577
fix: armv8: models < 0xd07 are not vulnerable
2018-08-04 16:19:54 +02:00
f9dd9d8cb9
add guess for archlinuxarm aarch64 kernel image on raspberry pi 3 ( #222 )
2018-08-01 00:15:52 +02:00
0f0d103a89
fix: correctly init capabilities_ssb_no var in all cases
2018-07-26 10:18:14 +02:00
b262c40541
fix: remove spurious character after an else statement
2018-07-25 21:55:50 +02:00
cc2910fbbc
fix: read_cpuid: don't use iflag=skip_bytes for compat with old dd versions
...
This closes #215 #199 #193
2018-07-23 09:12:30 +02:00
30c4a1f6d2
arm64: cavium: Add CPU Implementer Cavium ( #216 )
...
This patch adds 0x43 check for cavium implementor id in function
parse_cpu_details. Also adds that Cavium Soc is not vulnerable to variant 3/3a
Signed-off-by: Manish Jaggi <manish.jagg@cavium.com>
2018-07-22 19:06:19 +02:00
cf06636a3f
fix: prometheus output: use printf for proper \n interpretation ( #204 )
2018-06-21 23:35:51 +02:00
60077c8d12
fix(arm): rewrite vuln logic from latest arm statement for Cortex A8 to A76
2018-06-21 23:24:18 +02:00
c181978d7c
fix(arm): Updated arm cortex status ( #209 )
...
* Cortex A8 Vulnerable
Arm Cortex A8 is vulnerable to variants 1 & 2 (https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability )
Part number is 0xc08 (https://developer.arm.com/docs/ddi0344/b/system-control-coprocessor/system-control-coprocessorregisters/c0-main-id-register )
False negative reported by @V10lator in #206
* ARM Cortex A12 Vulnerable to 1&2
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
* A76 vulnerable to variant 4
All arch 8 cortex A57-A76 are vulnerable to variant 4.
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
* Whitelist variant4 nonvuln Arms
* ARM Cortex Whitelist & Cumulative Blacklist
Applies all information about vulnerabilities of ARM Cortex processors (from https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability ).
Whitelist & blacklist approach, using both vulnerable and non vulnerable status for each identified CPU, with vulnerabilities tracked cumulatively for multi CPU systems.
2018-06-16 12:14:39 +02:00
5962d20ba7
fix(variant4): whitelist from common.c::cpu_no_spec_store_bypass ( #202 )
...
* variant4 from common.c::cpu_no_spec_store_bypass
Variant 4 - Add function to 'whitelist' the hand-full of CPUs unaffected by speculative store bypass.
This would allow improved determination of variant 4 status ( #189 ) of immune CPUs while waiting for the 4.17/stable patches to be backported to distro kernels.
Source of cpu list : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/common.c#n945 )
Modeled after is_cpu_specex_free()
* amd families fix
amd families are reported by parse_cpu_details() in decimal
* remove duplicates
Only list processors which speculate and are immune to variant 4.
Avoids duplication with non-speculating CPUs listed in is_cpu_specex_free()
2018-05-27 15:14:29 +02:00
17a3488505
fix(help): add missing references to variants 3a & 4 ( #201 )
2018-05-24 16:35:57 +02:00
e54e8b3e84
chore: remove warning in README, fix display indentation
2018-05-24 16:32:53 +02:00
39c778e3ac
fix(amd): AMD families 0x15-0x17 non-arch MSRs are a valid way to control SSB
2018-05-23 23:08:07 +02:00
2cde6e4649
feat(ssbd): add detection of proper CPUID bits on AMD
2018-05-23 22:50:52 +02:00
f4d51e7e53
fix(variant4): add another detection way for Red Hat kernel
2018-05-23 22:47:54 +02:00
85d46b2799
feat(variant4): add more detailed explanations
2018-05-23 21:08:58 +02:00
61e02abd0c
feat(variant3a): detect up to date microcode
2018-05-23 21:08:08 +02:00
114756fab7
fix(amd): not vulnerable to variant3a
2018-05-23 20:38:43 +02:00
ea75969eb7
fix(help): Update variant options in usage message ( #200 )
2018-05-22 15:54:25 +02:00
ca391cbfc9
fix(variant2): correctly detect IBRS/IBPB in SLES kernels
2018-05-22 12:06:46 +02:00
68af5c5f92
feat(variant4): detect SSBD-aware kernel
2018-05-22 12:05:46 +02:00
f75cc0bb6f
feat(variant4): add sysfs mitigation hint and some explanation about the vuln
2018-05-22 09:39:11 +02:00
f33d65ff71
feat(variant3a): add information about microcode-sufficient mitigation
2018-05-22 09:38:29 +02:00
725eaa8bf5
feat(arm): adjust vulnerable ARM CPUs for variant3a and variant4
2018-05-22 09:19:29 +02:00
c6ee0358d1
feat(variant4): report SSB_NO CPUs as not vulnerable
2018-05-22 09:18:30 +02:00
22d0b203da
fix(ssb_no): rename ssbd_no to ssb_no and fix shift
2018-05-22 00:38:31 +02:00
3062a8416a
fix(msg): add missing words
2018-05-22 00:10:08 +02:00
6a4318addf
feat(variant3a/4): initial support for 2 new CVEs
2018-05-22 00:06:56 +02:00
c19986188f
fix(variant2): adjust detection for SLES kernels
2018-05-19 09:53:12 +02:00
7e4899bcb8
ibrs can't be enabled on no ibrs cpu ( #195 )
...
* ibrs can't be enabled on no ibrs cpu
If the cpu is identified, and does not support SPEC_CTRL or IBRS, then ibrs can't be enabled, even if supported by the kernel.
Instead of reporting IBRS enabled and active UNKNOWN, report IBRS enabled and active NO.
2018-05-17 15:39:48 +02:00
5cc77741af
Update spectre-meltdown-checker.sh
2018-05-05 13:00:44 +02:00
1c0f6d9580
cpuid and msr module check
...
This adds a check before loading the cpuid and msr modules under linux, ensuring they are not unloaded in exit_cleanup() if they were initially present.
2018-05-05 13:00:44 +02:00
4acd0f647a
Suggestion to change VM to a CPU with IBRS capability
2018-04-20 20:35:12 +02:00
fb52dbe7bf
set master branch to v0.37+
2018-04-20 20:34:42 +02:00
edebe4dcd4
bump to v0.37
2018-04-18 23:51:45 +02:00
83ea78f523
fix: arm: also detect variant 1 mitigation when using native objdump
2018-04-17 18:50:32 +02:00
602b68d493
fix(spectrev2): explain that retpoline is possible for Skylake+ if there is RSB filling, even if IBRS is still better
2018-04-16 09:27:28 +02:00
97bccaa0d7
feat: rephrase IBPB warning when only retpoline is enabled in non-paranoid mode
2018-04-16 09:13:25 +02:00
68e619b0d3
feat: show RSB filling capability for non-Skylake in verbose mode
2018-04-16 09:08:25 +02:00
a6f4475cee
feat: make IBRS_FW blue instead of green
2018-04-16 09:07:54 +02:00
223f5028df
feat: add --paranoid to choose whether we require IBPB
2018-04-15 23:05:30 +02:00
c0108b9690
fix(spectre2): don't explain how to fix when NOT VULNERABLE
2018-04-15 20:55:55 +02:00
a3016134bd
feat: make RSB filling support mandatory for Skylake+ CPUs
2018-04-15 20:55:31 +02:00
59d85b39c9
feat: detect RSB filling capability in the kernel
2018-04-15 20:55:01 +02:00
baaefb0c31
fix: remove shellcheck warnings
2018-04-11 22:24:03 +02:00
d452aca03a
fix: invalid bash syntax when ibpb_enabled or ibrs_enabled are empty
2018-04-11 10:29:42 +02:00
10b8d94724
feat: detect latest Red Hat kernels' RO ibpb_enabled knob
2018-04-10 22:51:45 +02:00
8606e60ef7
refactor: no longer display the retoline-aware compiler test when we can't tell for sure
2018-04-10 22:51:45 +02:00
6a48251647
fix: regression in 51aeae25, when retpoline & ibpb are enabled
2018-04-10 22:51:45 +02:00
f4bf5e95ec
fix: typos
2018-04-10 22:51:45 +02:00
60eac1ad43
feat: also do PTI performance check with (inv)pcid for BSD
2018-04-10 22:51:45 +02:00
b3cc06a6ad
fix regression introduced by 82c25dc
2018-04-10 22:51:45 +02:00
5553576e31
feat(amd/zen): re-introduce IBRS for AMD except ZEN family
2018-04-10 22:51:45 +02:00
e16ad802da
feat(ibpb=2): add detection of SMT before concluding the system is not vulnerable
2018-04-10 22:51:45 +02:00
29c294edff
feat(bsd): explain how to mitigate variant2
2018-04-10 22:51:45 +02:00
59714011db
refactor: IBRS_ALL & RDCL_NO are Intel-only
2018-04-10 22:51:45 +02:00
51e8261a32
refactor: separate hw checks for Intel & AMD
2018-04-10 22:49:28 +02:00
2a4bfad835
refactor: add is_amd and is_intel funcs
2018-04-10 22:49:28 +02:00
7e52cea66e
feat(spectre2): refined how status of this vuln is decided and more precise explanations on how to fix
2018-04-10 22:49:28 +02:00
417d7aab91
Fix trailing whitespace and mixed indent styles;
2018-04-10 22:42:47 +02:00
67bf761029
Fix some user facing typos with codespell -w -q3 .
2018-04-08 18:44:13 +02:00
0eabd266ad
refactor: decrease default verbosity for some tests
2018-04-05 22:20:16 +02:00
b77fb0f226
fix: don't override ibrs/ibpb results with later tests
2018-04-05 22:04:20 +02:00
89c2e0fb21
fix(amd): show cpuinfo and ucode details
2018-04-05 21:39:27 +02:00
b88f32ed95
feat: print raw cpuid, and fetch ucode version under BSD
2018-04-05 00:07:12 +02:00
7a4ebe8009
refactor: rewrite read_cpuid to get more common code parts between BSD and Linux
2018-04-05 00:06:24 +02:00
0919f5c236
feat: add explanations of what to do when a vulnerability is not mitigated
2018-04-05 00:03:04 +02:00
de02dad909
feat: rework Spectre V2 mitigations detection w/ latest vanilla & Red Hat 7 kernels
2018-04-05 00:01:54 +02:00
07484d0ea7
add dump of variables at end of script in debug mode
2018-04-04 23:58:15 +02:00
a8b557b9e2
fix(cpu): skip CPU checks if asked to (--no-hw) or if inspecting a kernel of another architecture
2018-04-03 19:36:28 +02:00
619b2749d8
fix(sysfs): only check for sysfs for spectre2 when in live mode
2018-04-03 19:32:36 +02:00
056ed00baa
feat(arm): detect spectre variant 1 mitigation
2018-04-03 15:52:25 +02:00
aef99d20f3
fix(pti): when PTI activation is unknown, don't say we're vulnerable
2018-04-03 12:45:17 +02:00
e2d7ed2243
feat(arm): support for variant2 and meltdown mitigation detection
2018-04-01 17:50:18 +02:00
eeaeff8ec3
set version to v0.36+ for master branch between releases
2018-04-01 17:45:01 +02:00
f5269a362a
feat(bsd): add retpoline detection for BSD
2018-04-01 17:42:29 +02:00
f3883a37a0
fix(xen): adjust message for DomUs w/ sysfs
2018-03-31 13:44:04 +02:00
b6fd69a022
release: v0.36
2018-03-27 23:08:38 +02:00
7adb7661f3
enh: change colors and use red only to report vulnerability
2018-03-25 18:15:08 +02:00
aa74315df4
feat: speed up kernel version detection
2018-03-25 13:42:19 +02:00
0b8a09ec70
fix: mis adjustments for BSD compat
2018-03-25 13:26:00 +02:00
b42d8f2f27
fix(write_msr): use /dev/zero instead of manually echoing zeroes
2018-03-25 12:53:50 +02:00
f191ec7884
feat: add --hw-only to only show CPU microcode/cpuid/msr details
2018-03-25 12:48:37 +02:00
28da7a0103
misc: message clarifications
2018-03-25 12:48:03 +02:00
ece25b98a1
feat: implement support for NetBSD/FreeBSD/DragonFlyBSD
2018-03-25 12:28:02 +02:00
889172dbb1
feat: add special extract_vmlinux mode for old RHEL kernels
2018-03-25 11:55:44 +02:00
37ce032888
fix: bypass MSR/CPUID checks for non-x86 CPUs
2018-03-25 11:55:44 +02:00
701cf882ad
feat: more robust validation of extracted kernel image
2018-03-25 11:55:44 +02:00
6a94c3f158
feat(extract_vmlinux): look for ELF magic in decompressed blob and cut at found offset
2018-03-25 11:55:42 +02:00
2d993812ab
feat: add --prefix-arch for cross-arch kernel inspection
2018-03-25 11:55:10 +02:00
4961f8327f
fix(ucode): fix blacklist detection for some ucode versions
2018-03-19 12:09:39 +01:00
ecdc448531
Check MSR in each CPU/Thread ( #136 )
2018-03-17 17:17:15 +01:00
12ea49fe0c
fix(kvm): properly detect PVHVM mode ( fixes #163 )
2018-03-16 18:29:58 +01:00
053f1613de
fix(doc): use https:// URLs in the script comment header
2018-03-16 18:24:59 +01:00
bda18d04a0
fix: pine64: re-add vmlinuz location and some error checks
2018-03-10 16:02:44 +01:00
d5832dc1dc
feat: add ELF magic detection on kernel image blob for some arm64 systems
2018-03-10 14:57:25 +01:00
d2f46740e9
feat: enhance kernel image version detection for some old kernels
2018-03-10 14:57:25 +01:00
2f6a6554a2
Produce output for consumption by prometheus-node-exporter
...
A report of all vulnerable machines to be produced with a query such as:
spexec_vuln_status{status!="OK"}
2018-02-27 11:08:39 +01:00
30842dd9c0
release: bump to v0.35
2018-02-16 10:35:49 +01:00
b4ac5fcbe3
feat(variant2): better explanation when kernel supports IBRS but CPU does not
2018-02-16 10:34:01 +01:00
55a6fd3911
feat(variant1): better detection for Red Hat/Ubuntu patch
2018-02-15 21:19:49 +01:00
35c8a63de6
Remove the color in the title
2018-02-15 20:21:00 +01:00
5f914e555e
fix(xen): declare Xen's PTI patch as a valid mitigation for variant3
2018-02-14 14:24:55 +01:00
66dce2c158
fix(ucode): update blacklisted ucodes list from latest Intel info
2018-02-14 14:14:16 +01:00
155cac2102
Teach checker how to find kernels installed by systemd kernel-install
2018-02-10 20:51:33 +01:00
22cae605e1
fix(retpoline): remove the "retpoline enabled" test
...
This test worked for some early versions of the retpoline
implementation in vanilla kernels, but the corresponding
flag has been removed from /proc/cpuinfo in latest kernels.
The full information is available in /sys instead, which
was already implemented in the script.
2018-02-09 20:12:33 +01:00
eb75e51975
fix(ucode): update list of blacklisted ucodes from 2018-02-08 Intel document
...
Removed 2 ucodes and added 2 other ones
2018-02-09 19:56:27 +01:00
253e180807
Update spectre-meltdown-checker.sh
...
Dots better than colon for indicating waiting.
2018-02-06 19:02:56 +01:00
5d6102a00e
enh: show kernel version in offline mode
2018-02-02 11:27:04 +01:00
a2dfca671e
feat: detect disrepancy between found kernel image and running kernel
2018-02-02 11:13:54 +01:00
36bd80d75f
enh: speedup by not decompressing kernel on --sysfs-only
2018-02-02 11:13:31 +01:00
1834dd6201
feat: add skylake era cpu detection routine
2018-02-02 11:12:10 +01:00
3d765bc703
enh: lazy loading of cpu informations
2018-02-02 11:11:51 +01:00
Nicolas Sauzede
Stéphane Lesimple
alexvong1995
Laszlo Toth
Luis Ponce
Pierre Gaxatte
David Guglielmi
Karsten Weiss
0x9fff00
Nathan Parsons
Lily Wilson
manish jaggi
Rob Gill
rrobgill
Onno Zweers
Igor Lubashev
Benjamin Bouvier
Sylvestre Ledru
Alex
Sam Morris
Sylvestre Ledru
Calvin Walton
積丹尼 Dan Jacobson