Stéphane Lesimple
5788cec18b
fix(mds): ARM and CAVIUM are not thought to be vulnerable
2019-05-15 10:56:49 +02:00
Stéphane Lesimple
ae56ec0bc5
bump to v0.41
2019-05-15 09:57:28 +02:00
Stéphane Lesimple
871443c9db
fix typos in README
2019-05-15 00:28:55 +02:00
Stéphane Lesimple
8fd4e3ab01
fix(xen): remove xenbus and xenwatch as they also exist in domU
2019-05-15 00:23:05 +02:00
Stéphane Lesimple
de793a7204
feat(mds): more verbose info about kernel support and microcode support for mitigation
2019-05-15 00:21:08 +02:00
Stéphane Lesimple
11790027d3
feat(mds): add alias ZombieLoad for CVE-2018-12130
2019-05-14 21:42:36 +02:00
Stéphane Lesimple
5939c38c5c
update mcedb from v109 to v110 to better detect MDS microcodes
2019-05-14 20:31:27 +02:00
Stéphane Lesimple
db7d3206fd
feat(mds): add detection of availability of MD_CLEAR instruction
2019-05-14 20:30:47 +02:00
Stéphane Lesimple
1d13a423b8
adjust README
2019-05-14 20:16:01 +02:00
Stéphane Lesimple
d547ce4ab4
fix(ssb): fix error when no process uses prctl to set ssb mitigation
...
fixes #281
2019-05-13 15:35:58 +02:00
Stéphane Lesimple
d187827841
enh(vmm): add Xen daemons detection
2019-05-08 20:44:54 +02:00
Stéphane Lesimple
fcc04437e8
update builtin MCEdb from v96 to v109
2019-05-07 20:29:59 +02:00
Stéphane Lesimple
d31a9810e6
enhance previous commit logic
2019-05-05 20:09:53 +02:00
Stéphane Lesimple
4edb867def
fix(vmm): revert to checking the running processes to detect a hypervisor
...
More information available on #278
2019-05-05 20:04:25 +02:00
Stéphane Lesimple
1264b1c7a3
chore: more shellcheck 0.6 fixes
2019-05-05 18:34:09 +02:00
Stéphane Lesimple
7beca1ac50
fix: invalid names in json batch mode ( fixes #279 )
2019-05-05 18:15:41 +02:00
Stéphane Lesimple
bfa4de96e6
enh(l1tf): in paranoid mode, assume we're running a hypervisor unless stated otherwise
...
This change ensures we check for SMT and advise the user to disable it for maximum security.
Doing this, we'll help users mitigate a whole range of vulnerabilities taking advantage of SMT to attack purely from userland other userland processes, as seen in CVE-2018-5407 (also see #261 )
2019-04-21 14:05:43 +02:00
Stéphane Lesimple
b022b27a51
feat(ssbd): in live mode, report whether the mitigation is active ( fix #210 )
2019-04-20 20:27:45 +02:00
Stéphane Lesimple
23e7db044e
fix(bsd): load vmm if not already loaded, fixes #274
...
As we read sysctl values under the vmm hierarchy, the modules needs to be loaded,
so if not already done, we load it before testing for CVE-2018-3620 and CVE-2018-3646
2019-04-19 19:47:04 +02:00
Stéphane Lesimple
fc4981bb94
update MCEDB from v84 to v96
2019-01-20 19:52:46 +01:00
Stéphane Lesimple
d7d2e6934b
fix: typo in bare metal detection ( fixes #269 )
2018-12-12 00:24:17 +01:00
Stéphane Lesimple
c705afe764
bump to v0.40
2018-10-03 20:56:46 +02:00
Stéphane Lesimple
f5106b3c02
update MCEDB from v83 to v84 (no actual change)
2018-09-30 16:57:35 +02:00
Stéphane Lesimple
68289dae1e
feat: add --update-builtin-mcedb to update the DB inside the script
2018-09-30 16:56:58 +02:00
Stéphane Lesimple
3b2d529654
feat(l1tf): read & report ARCH_CAPABILITIES bit 3 (SKIP_VMENTRY_L1DFLUSH)
2018-09-29 13:16:07 +02:00
Stéphane Lesimple
cbb18cb6b6
fix(l1tf): properly detect status under Red Hat/CentOS kernels
2018-09-29 13:01:13 +02:00
Stéphane Lesimple
299103a3ae
some fixes when script is not started as root
2018-09-29 13:01:13 +02:00
Stéphane Lesimple
dc5402b349
chore: speed optimization of hw check and indentation fixes
2018-09-29 13:01:13 +02:00
Stéphane Lesimple
90c2ae5de2
feat: use the MCExtractor DB as the reference for the microcode versions
...
Use platomav's MCExtractor DB as the reference to decide whether our CPU microcode is the latest or not.
We have a builtin version of the DB in the script, but an updated version can be fetched and stored locally with --update-mcedb
2018-09-29 13:01:13 +02:00
Stéphane Lesimple
297d890ce9
fix ucode version check regression introduced by fbbb19f under BSD
2018-09-23 15:00:39 +02:00
Stéphane Lesimple
0252e74f94
feat(bsd): implement CVE-2018-3620 and CVE-2018-3646 mitigation detection
2018-09-22 12:26:56 +02:00
Stéphane Lesimple
1571a56ce2
feat: add L1D flush cpuid feature bit detection
2018-09-19 09:05:23 +02:00
Stéphane Lesimple
3cf9141601
fix: don't display summary if no CVE was tested (e.g. --hw-only)
2018-09-19 09:04:52 +02:00
Stéphane Lesimple
bff38f1b26
BSD: add not-implemented-yet notice for Foreshadow-NG
2018-09-18 22:06:01 +02:00
Stéphane Lesimple
b419fe7c63
feat(variant4): properly detect SSBD under BSD
2018-09-18 22:00:32 +02:00
Stéphane Lesimple
e589ed7f02
fix: don't test SGX again in check_CVE_2018_3615, already done by is_cpu_vulnerable
2018-09-17 22:28:04 +02:00
Stéphane Lesimple
ae1206288f
fix: remove some harcoded /proc paths, use $procfs instead
2018-09-17 22:26:20 +02:00
Stéphane Lesimple
b44d2b5470
chore: remove 'experimental' notice of Foreshadow from README
2018-09-17 21:48:20 +02:00
Stéphane Lesimple
7b72c20f89
feat(l1tf): explode L1TF in its 3 distinct CVEs
2018-09-17 21:44:48 +02:00
Stéphane Lesimple
687ce1a7fa
fix: load cpuid module if absent even when /dev/cpu/0/cpuid is there
2018-09-08 23:15:50 +02:00
Stéphane Lesimple
80e0db7cc4
fix: don't show erroneous ucode version when latest version is unknown ( fixes #238 )
2018-08-28 20:51:46 +02:00
Stéphane Lesimple
b2f64e1132
fix README after merge
2018-08-18 12:09:34 +02:00
Stéphane Lesimple
0009c0d473
fix: --batch now implies --no-color to avoid colored warnings
2018-08-18 12:04:18 +02:00
Stéphane Lesimple
dd67fd94d7
feat: add FLUSH_CMD MSR availability detection (part of L1TF mitigation)
2018-08-16 19:05:09 +02:00
Stéphane Lesimple
339ad31757
fix: add missing l1tf CPU vulnerability display in hw section
2018-08-16 15:19:29 +02:00
Stéphane Lesimple
794c5be1d2
feat: add optional git describe support to display inter-release version numbers
2018-08-16 15:18:47 +02:00
Stéphane Lesimple
a7afc585a9
fix several incorrect ucode version numbers
2018-08-16 10:51:55 +02:00
Stéphane Lesimple
fc1dffd09a
feat: implement detection of latest known versions of intel microcodes
2018-08-15 12:53:49 +02:00
Stéphane Lesimple
e942616189
feat: initial support for L1TF
2018-08-15 12:05:08 +02:00
Stéphane Lesimple
360be7b35f
fix: hide arch_capabilities_msr_not_read warning under !intel
2018-08-13 15:42:56 +02:00
Stéphane Lesimple
5f59257826
bump to v0.39
2018-08-13 15:33:03 +02:00
Stéphane Lesimple
92d59cbdc1
chore: adjust some comments, add 2 missing inits
2018-08-11 10:31:10 +02:00
Stéphane Lesimple
4747b932e7
feat: add detection of RSBA feature bit and adjust logic accordingly
2018-08-10 10:26:23 +02:00
Stéphane Lesimple
860023a806
fix: ARCH MSR was not read correctly, preventing proper SSB_NO and RDCL_NO detection
2018-08-10 10:26:23 +02:00
Stéphane Lesimple
ab67a9221d
feat: read/write msr now supports msr-tools or perl as dd fallback
2018-08-10 10:26:23 +02:00
Stéphane Lesimple
be15e47671
chore: setting master to v0.38+
2018-08-09 14:25:22 +02:00
Stéphane Lesimple
21af561148
bump to v0.38
2018-08-07 10:55:50 +02:00
Stéphane Lesimple
cb740397f3
feat(arm32): add spectrev1 mitigation detection
2018-08-07 10:42:03 +02:00
Stéphane Lesimple
84195689af
change: default to --no-explain, use --explain to get detailed mitigation help
2018-08-04 16:31:41 +02:00
Stéphane Lesimple
b637681fa8
fix: debug output: msg inaccuracy for ARM checks
2018-08-04 16:19:54 +02:00
Stéphane Lesimple
9316c30577
fix: armv8: models < 0xd07 are not vulnerable
2018-08-04 16:19:54 +02:00
Stéphane Lesimple
0f0d103a89
fix: correctly init capabilities_ssb_no var in all cases
2018-07-26 10:18:14 +02:00
Stéphane Lesimple
b262c40541
fix: remove spurious character after an else statement
2018-07-25 21:55:50 +02:00
Stéphane Lesimple
cc2910fbbc
fix: read_cpuid: don't use iflag=skip_bytes for compat with old dd versions
...
This closes #215 #199 #193
2018-07-23 09:12:30 +02:00
Stéphane Lesimple
cf06636a3f
fix: prometheus output: use printf for proper \n interpretation ( #204 )
2018-06-21 23:35:51 +02:00
Stéphane Lesimple
60077c8d12
fix(arm): rewrite vuln logic from latest arm statement for Cortex A8 to A76
2018-06-21 23:24:18 +02:00
Stéphane Lesimple
e54e8b3e84
chore: remove warning in README, fix display indentation
2018-05-24 16:32:53 +02:00
Stéphane Lesimple
39c778e3ac
fix(amd): AMD families 0x15-0x17 non-arch MSRs are a valid way to control SSB
2018-05-23 23:08:07 +02:00
Stéphane Lesimple
2cde6e4649
feat(ssbd): add detection of proper CPUID bits on AMD
2018-05-23 22:50:52 +02:00
Stéphane Lesimple
f4d51e7e53
fix(variant4): add another detection way for Red Hat kernel
2018-05-23 22:47:54 +02:00
Stéphane Lesimple
85d46b2799
feat(variant4): add more detailed explanations
2018-05-23 21:08:58 +02:00
Stéphane Lesimple
61e02abd0c
feat(variant3a): detect up to date microcode
2018-05-23 21:08:08 +02:00
Stéphane Lesimple
114756fab7
fix(amd): not vulnerable to variant3a
2018-05-23 20:38:43 +02:00
Stéphane Lesimple
ca391cbfc9
fix(variant2): correctly detect IBRS/IBPB in SLES kernels
2018-05-22 12:06:46 +02:00
Stéphane Lesimple
68af5c5f92
feat(variant4): detect SSBD-aware kernel
2018-05-22 12:05:46 +02:00
Stéphane Lesimple
19be8f79eb
doc: update README with some info about variant3 and variant4
2018-05-22 09:43:29 +02:00
Stéphane Lesimple
f75cc0bb6f
feat(variant4): add sysfs mitigation hint and some explanation about the vuln
2018-05-22 09:39:11 +02:00
Stéphane Lesimple
f33d65ff71
feat(variant3a): add information about microcode-sufficient mitigation
2018-05-22 09:38:29 +02:00
Stéphane Lesimple
725eaa8bf5
feat(arm): adjust vulnerable ARM CPUs for variant3a and variant4
2018-05-22 09:19:29 +02:00
Stéphane Lesimple
c6ee0358d1
feat(variant4): report SSB_NO CPUs as not vulnerable
2018-05-22 09:18:30 +02:00
Stéphane Lesimple
22d0b203da
fix(ssb_no): rename ssbd_no to ssb_no and fix shift
2018-05-22 00:38:31 +02:00
Stéphane Lesimple
3062a8416a
fix(msg): add missing words
2018-05-22 00:10:08 +02:00
Stéphane Lesimple
6a4318addf
feat(variant3a/4): initial support for 2 new CVEs
2018-05-22 00:06:56 +02:00
Stéphane Lesimple
c19986188f
fix(variant2): adjust detection for SLES kernels
2018-05-19 09:53:12 +02:00
Stéphane Lesimple
fb52dbe7bf
set master branch to v0.37+
2018-04-20 20:34:42 +02:00
Stéphane Lesimple
edebe4dcd4
bump to v0.37
2018-04-18 23:51:45 +02:00
Stéphane Lesimple
83ea78f523
fix: arm: also detect variant 1 mitigation when using native objdump
2018-04-17 18:50:32 +02:00
Stéphane Lesimple
602b68d493
fix(spectrev2): explain that retpoline is possible for Skylake+ if there is RSB filling, even if IBRS is still better
2018-04-16 09:27:28 +02:00
Stéphane Lesimple
97bccaa0d7
feat: rephrase IBPB warning when only retpoline is enabled in non-paranoid mode
2018-04-16 09:13:25 +02:00
Stéphane Lesimple
68e619b0d3
feat: show RSB filling capability for non-Skylake in verbose mode
2018-04-16 09:08:25 +02:00
Stéphane Lesimple
a6f4475cee
feat: make IBRS_FW blue instead of green
2018-04-16 09:07:54 +02:00
Stéphane Lesimple
223f5028df
feat: add --paranoid to choose whether we require IBPB
2018-04-15 23:05:30 +02:00
Stéphane Lesimple
c0108b9690
fix(spectre2): don't explain how to fix when NOT VULNERABLE
2018-04-15 20:55:55 +02:00
Stéphane Lesimple
a3016134bd
feat: make RSB filling support mandatory for Skylake+ CPUs
2018-04-15 20:55:31 +02:00
Stéphane Lesimple
59d85b39c9
feat: detect RSB filling capability in the kernel
2018-04-15 20:55:01 +02:00
Stéphane Lesimple
baaefb0c31
fix: remove shellcheck warnings
2018-04-11 22:24:03 +02:00
Stéphane Lesimple
10b8d94724
feat: detect latest Red Hat kernels' RO ibpb_enabled knob
2018-04-10 22:51:45 +02:00
Stéphane Lesimple
8606e60ef7
refactor: no longer display the retoline-aware compiler test when we can't tell for sure
2018-04-10 22:51:45 +02:00
Stéphane Lesimple
6a48251647
fix: regression in 51aeae25, when retpoline & ibpb are enabled
2018-04-10 22:51:45 +02:00
Stéphane Lesimple
f4bf5e95ec
fix: typos
2018-04-10 22:51:45 +02:00
Stéphane Lesimple