peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2026-09-05 18:33:56 +02:00
Code Issues Projects Releases Wiki Activity
611 Commits 9 Branches 50 Tags
536dfb8701182d73e0ff31330bce641a62afaf46
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Stéphane Lesimple 536dfb8701 enh: massive update for Spectre v2 (CVE-2017-5715) 
The state of the mitigations for spectre v2 has been
updated several times in the kernel, this commit brings
up the script to par with the view of the most recent kernels.

When run on old kernels, that might deem the vulnerability as
mitigated, we'll reclassify it as vulnerable if applicable, unless
the `--sysfs-only` parameter is passed, which instructs the script
to blindly trust what the kernel has to say.

A full inventory of all mitigation strings found in mainline,
stable and redhat kernels since the first spectre v2 mitigation
has been added as a gigantic comment to help understanding the context.

Gory details below:

  1. New structured sub-mitigation parsing ("Mitigation 3")

  A new section parses the sysfs message into discrete variables for each sub-mitigation component:
  - v2_base_mode: The primary mitigation (eibrs, eibrs_lfence, eibrs_retpoline, ibrs, retpoline, lfence, none) - parsed from sysfs with hardware fallback
  - v2_stibp_status: STIBP state (always-on, forced, conditional, disabled, eibrs-implicit, etc.)
  - v2_ibpb_mode: IBPB mode (always-on, conditional, disabled)
  - v2_pbrsb_status: PBRSB-eIBRS mitigation (not-affected, sw-sequence, vulnerable)
  - v2_bhi_status: BHI mitigation (not-affected, bhi_dis_s, sw-loop, retpoline, vulnerable)
  - v2_vuln_module: Whether a non-retpoline kernel module is loaded
  - v2_is_autoibrs: Distinguishes AMD AutoIBRS from Intel eIBRS (they have different cross-thread properties)

  2. Rewritten verdict logic (Phase 4)

  The old flat if/elif chain is replaced with per-base-mode branches, each checking all relevant sub-mitigations:
  - LFENCE: Always VULN (reclassified in kernel v5.17)
  - eIBRS path: Checks BHI, PBRSB (VMM-only), AutoIBRS STIBP, vulnerable modules, paranoid mode (IBPB always-on + SMT off)
  - IBRS path: Checks IBPB, STIBP+SMT, RSB filling on Skylake+, BHI, paranoid mode
  - Retpoline path: Checks compiler, runtime enable, RSB filling, BHI+RRSBA, IBPB, vulnerable modules, paranoid mode

  3. Caveat accumulation pattern

  A _v2_add_caveat helper collects all gaps into a single string, producing verdicts like "eIBRS active but insufficient: BHI vulnerable; STIBP not active with SMT on AMD AutoIBRS" instead of the old single-issue messages.

  4. Other changes

  - check_has_vmm called early in Phase 2 (for PBRSB VMM-awareness)
  - explain_hypervisor variable removed - its advice is now folded into the per-path explain calls
  - Offline mode gains eIBRS/AutoIBRS detection via cap_ibrs_all/cap_autoibrs
  - smt_enabled variable added (via is_cpu_smt_enabled) for cross-thread checks
 2026-04-01 21:12:23 +02:00
Stéphane Lesimple e09d0cf221 enh: check_cpu: look for cap_stibp and cap_autoibrs 2026-04-01 21:12:23 +02:00
Stéphane Lesimple b062fe2184 enh: CVE-2017-5715: inventory of all sysfs strings, fix --sysfs-only path 2026-04-01 21:12:23 +02:00
Stéphane Lesimple dfe48d67ce enh: CVE-2018-3646: document all sysfs variations, fix --sysfs-only path 2026-04-01 21:12:23 +02:00
Stéphane Lesimple 35d83e19a8 fix: --sysfs-only path for CVE-2018-12207 CVE-2018-3620 2026-04-01 21:12:23 +02:00
Stéphane Lesimple 123ad1c8e6 CVE-2023-20569: detect old kernels sysfs saying mitigations are correct whereas they are not 2026-04-01 21:12:23 +02:00
Stéphane Lesimple b9e7f7cb8a docs: update development guidelines 2026-04-01 21:12:23 +02:00
Stéphane Lesimple 278989d550 fix: cap_rdcl_no, cap_gds_no, cap_tsa_*_no were not setting the current CPU status as immune for their respective vulns 2026-04-01 00:47:41 +02:00
Stéphane Lesimple b4f4d11106 fix: CVE-2018-3620: false 'VULN' status on kernels reporting CPU as unaffected and RDCL_NO can't be parsed 2026-04-01 00:41:32 +02:00
Stéphane Lesimple 4738e8f0ad enh: draft rework of CVE-2017-5753 aka spectre v1 2026-04-01 00:22:07 +02:00
Stéphane Lesimple b32f05b8d2 chore: readme: add a second table one about impact/mitigation, rework sections 2026-04-01 00:21:35 +02:00
Stéphane Lesimple 295324a545 chore: prepare for dev-build renaming to test-build 2026-03-31 19:49:39 +02:00
Stéphane Lesimple efa07e7fd9 chore: set VERSION when building 2026-03-31 00:18:09 +02:00
Stéphane Lesimple eabddf3d72 update dev docs and refactor CVE list in readme 2026-03-30 23:35:48 +02:00
Stéphane Lesimple 04221cf8c8 chore: add .gitignore 2026-03-30 23:07:59 +02:00
Stéphane Lesimple a0032a44ef chore: adjust workflow for dev-build 2026-03-30 23:07:59 +02:00
Stéphane Lesimple 6eb70ab52d chore: move dist files to the dist/ subdir 2026-03-30 23:07:59 +02:00
Stéphane Lesimple 05e09bb7f4 feat: implement CVE-2024-36350 CVE-2024-36357 (Transient Scheduler Attack) 2026-03-30 23:07:59 +02:00
Stéphane Lesimple 5a0c391b06 doc: update development guidelines 2026-03-30 23:07:59 +02:00
Stéphane Lesimple ebc9e91d78 chore: shfmt 2026-03-30 23:07:59 +02:00
Stéphane Lesimple c2542e9940 dev-build workflow 2026-03-30 23:07:59 +02:00
Stéphane Lesimple 994608a90a use MSR names for read_msr for readability 2026-03-30 21:01:13 +02:00
Stéphane Lesimple 3d6acc460e fix: rework read_msr for values > INT32_MAX (#507) 2026-03-30 20:53:13 +02:00
Stéphane Lesimple 72824deea5 doc: add a note about the mandatory POSIX compliance of used tools 2026-03-30 20:48:10 +02:00
Stéphane Lesimple a7cf525b6e POSIX compatibility fix: replace sort -V by a manual comparison 2026-03-30 20:39:05 +02:00
Stéphane Lesimple 70d531ba09 BSD compatibility fix: stat -f and date -r fallbacks 2026-03-30 20:30:29 +02:00
Stéphane Lesimple cd79597e9a POSIX compatibility fix: sed -r => sed -E 2026-03-30 20:24:04 +02:00
Stéphane Lesimple b8477d0e4d POSIX compatibility fix: cut -w => awk 2026-03-30 20:15:21 +02:00
Stéphane Lesimple cebda01d05 split script in multiple files, reassembled through build.sh 2026-03-30 20:04:16 +02:00
Stéphane Lesimple 7e660812e9 standardize function naming and add doc headers to all of them 2026-03-30 19:55:15 +02:00
Stéphane Lesimple 45b26322c4 refactor functions that record/output results 2026-03-30 19:40:26 +02:00
Stéphane Lesimple a74111bfcd use global readonly vars for common paths/basedirs 2026-03-30 19:31:22 +02:00
Stéphane Lesimple 5a3362a7ed factorize/standardize check_CVE_*() funcs 2026-03-30 19:22:57 +02:00
Stéphane Lesimple 76a6d476ae factorize CVE metadata into a single CVE_REGISTRY global var 2026-03-30 19:15:10 +02:00
Stéphane Lesimple 80a31d25cc second vars renaming pass 2026-03-30 07:13:45 +00:00
Stéphane Lesimple 34c7b221f0 chore: rename status_* to affected_* 2026-03-30 00:28:14 +00:00
Stéphane Lesimple 2029fe10ef chore: apply variables naming convention 2026-03-30 00:25:27 +00:00
Stéphane Lesimple c34517dc99 chore: add variables naming convention documentation 2026-03-30 00:09:24 +00:00
Stéphane Lesimple a20641fbad fix: handle non-numeric ARM CPU architecture values 
Some old ARM processors (e.g., ARM926EJ-S) report CPU architecture
with suffix in /proc/cpuinfo (e.g., "5TEJ" for ARMv5TEJ).

This caused an "integer expression expected" error when comparing
against numeric values. Extract the numeric prefix before integer comparisons.

Fixes #505.
 2026-01-25 12:57:41 +01:00
Stéphane Lesimple d550ea8c85 fix: harmless 'dmesg: write error' that could happen on some systems 
Fixes #519.
 2026-01-25 11:53:13 +01:00
Stéphane Lesimple 8e33a1dbf2 fix: set cpu_* vars to a default value 
On ARM64 systems, /proc/cpuinfo uses different field names (CPU implementer,
CPU variant, CPU part, CPU revision) instead of x86-style fields (cpu family,
model, stepping). This left these variables empty, causing printf to fail
with 'invalid number' errors when formatting them as hex values.

Fixes #520.
 2026-01-25 11:38:50 +01:00
Stéphane Lesimple 72bce72fe8 chore: really fix autoupdate workflow to avoid useless PRs 2025-10-31 19:53:59 +01:00
Stéphane Lesimple 5f18e67f6f chore: fix autoupdate workflow 2025-10-30 23:57:05 +01:00
Stéphane Lesimple ee4cfd00b8 chore: add autoupdate workflow for fwdb 2025-10-25 20:48:38 +02:00
Stéphane Lesimple c2c60e0161 chore: fix recent shellcheck warnings 2025-10-25 20:48:38 +02:00
Stéphane Lesimple 34c6095912 fix: Linux 6.9+ changed some config options names (#490) 
Issue #490 is about retpoline but other options have also changed,
as reported by a comment on the issue, this commit fixes these
other options:

Breno Leitao (10):
      x86/bugs: Rename CONFIG_GDS_FORCE_MITIGATION => CONFIG_MITIGATION_GDS_FORCE
      x86/bugs: Rename CONFIG_CPU_IBPB_ENTRY       => CONFIG_MITIGATION_IBPB_ENTRY
      x86/bugs: Rename CONFIG_CALL_DEPTH_TRACKING  => CONFIG_MITIGATION_CALL_DEPTH_TRACKING
      x86/bugs: Rename CONFIG_PAGE_TABLE_ISOLATION => CONFIG_MITIGATION_PAGE_TABLE_ISOLATION
      x86/bugs: Rename CONFIG_RETPOLINE            => CONFIG_MITIGATION_RETPOLINE
      x86/bugs: Rename CONFIG_SLS                  => CONFIG_MITIGATION_SLS
      x86/bugs: Rename CONFIG_CPU_UNRET_ENTRY      => CONFIG_MITIGATION_UNRET_ENTRY
      x86/bugs: Rename CONFIG_CPU_IBRS_ENTRY       => CONFIG_MITIGATION_IBRS_ENTRY
      x86/bugs: Rename CONFIG_CPU_SRSO             => CONFIG_MITIGATION_SRSO
      x86/bugs: Rename CONFIG_RETHUNK              => CONFIG_MITIGATION_RETHUNK
 2024-08-04 15:15:45 +02:00
Stéphane Lesimple e806e4bc41 chore: docker compose v2 
The `docker-compose` command has been replaced by `docker compose`.
The "version" tag has also been deprecated in docker-compose.yml.
 2024-08-04 13:53:36 +02:00
Stéphane Lesimple bd0c7c94b5 fix: typo introduced by #483, fixes #486 2024-05-18 13:01:48 +02:00
Stéphane Lesimple d70e4c2974 fwdb: update to v296+i20240514+988c 2024-05-18 13:01:48 +02:00
Stéphane Lesimple 4e29fb5a21 fix: ucode_platformid_mask is hexa (fixes #485) 2024-02-15 17:27:12 +01:00
Stéphane Lesimple 97f4d5f2bc feat(reptar): add detection and mitigation of Reptar 2024-01-09 15:38:16 +01:00
Stéphane Lesimple 9b7b09ada3 fix(inception): continued mitigation detection 2023-08-25 18:50:53 +02:00
Stéphane Lesimple dc6921a1ac feat(inception): handle sysfs interface 2023-08-25 18:50:53 +02:00
Stéphane Lesimple 44223c5308 fix: bsd: kernel version detection 2023-08-11 18:41:35 +02:00
Stéphane Lesimple dbe208fc48 enh: downfall: detect kernel mitigation without sysfs 2023-08-11 18:10:27 +02:00
Stéphane Lesimple aca4e2a9b1 enh: move root warning to the bottom 2023-08-11 18:10:27 +02:00
Stéphane Lesimple ba0daa6769 feat: downfall: add kernel soft mitigation support check 2023-08-10 11:14:40 +02:00
Stéphane Lesimple 8ba3751cf7 fwdb: update to latest Intel ucode versions 2023-08-09 10:35:08 +02:00
Stéphane Lesimple d013c0a7d2 doc: add kernel src as additional ucode version source 2023-08-01 10:22:15 +02:00
Stéphane Lesimple cbe8ba10ce fix: inteldb: cpuid 0x00090660 and 0x000A0680 2023-07-30 13:21:38 +02:00
Stéphane Lesimple 9c2587bca5 enh: when CPUID can't be read, built it by ourselves 2023-07-30 12:21:12 +02:00
Stéphane Lesimple 2a5ddc87bf feat: add Intel known affected processors DB 2023-07-30 12:21:12 +02:00
Stéphane Lesimple 2ef6c1c80e enh: factorize file download func 2023-07-28 20:03:16 +02:00
Stéphane Lesimple 3c224018f4 chore: update disclaimer and FAQ 2023-07-28 20:03:16 +02:00
Stéphane Lesimple b8f8c81d51 release v0.46 2023-07-26 18:07:02 +02:00
Stéphane Lesimple f34dd5fa7b enh: assume CPU is immune to Zenbleed regardless of vendor except AMD 
This contradicts our usual "if we don't know, consider vulnerable" motto,
but as this vuln is extremely specific (which is not the case for the Spectre
range of vulnerabilities, for example), this is the correct approach here.
 2023-07-26 17:54:44 +02:00
Stéphane Lesimple c0869d7341 enh: zenbleed: give a manual mitigation in --explain 2023-07-26 16:38:02 +02:00
Stéphane Lesimple e99a548dcc fix: fms2cpuid was incorrect for families > 0xF 2023-07-26 14:33:11 +02:00
Stéphane Lesimple 3d475dfaec feat: fwdb: add linux-firmware as AMD source, update fwdb accordingly 2023-07-26 13:57:05 +02:00
Stéphane Lesimple cba5010c2a chore: fix typo 2023-07-26 13:57:05 +02:00
Stéphane Lesimple c5661f098f enh: add --explain text for Zenbleed 2023-07-26 10:56:45 +02:00
Stéphane Lesimple 6844c01242 enh: add zenbleed support to the --variant option 2023-07-26 10:46:38 +02:00
Stéphane Lesimple 9bb79a18eb feat: add Zenbleed (CVE-2023-20593) and update fwdb to v270+i20230614 2023-07-25 17:54:59 +02:00
Stéphane Lesimple 6a61df200e update: fwdb to v266+i20230512 2023-05-13 10:27:03 +02:00
Stéphane Lesimple a2843575be fix: docker: adding missing utils (fixes #433) 2023-02-24 21:35:55 +01:00
Stéphane Lesimple 48abeb5950 fix: bad exitcode with --update-fwdb due to trap exit 2023-02-24 20:57:43 +01:00
Stéphane Lesimple 3c988cc73a fix: rewrite SQL to be sqlite3 >= 3.41 compatible 
closes #443
 2023-02-24 20:54:40 +01:00
Stéphane Lesimple b68ebe67f2 fix: fwdb: ignore MCEdb versions where an official Intel version exists (fixes #430) 2022-03-30 09:10:55 +02:00
Stéphane Lesimple a6c943d38f release v0.45 2022-03-27 12:41:17 +02:00
Stéphane Lesimple dd162301ff chore: update fwdb to v222+i20220208 2022-03-27 12:38:44 +02:00
Stéphane Lesimple 5f6471d9a4 feat: set default TMPDIR for Android (#415) 2022-03-27 12:31:05 +02:00
Stéphane Lesimple 2a5b965b98 feat: add --allow-msr-write, no longer write by default (#385), detect when writing is denied 2022-03-24 12:37:19 +01:00
Stéphane Lesimple ee266d43b7 chore: fix indentation 2022-03-21 22:22:33 +01:00
Stéphane Lesimple b61baa90df feat: bsd: for unimplemented CVEs, at least report when CPU is not affected 2022-03-21 22:22:33 +01:00
Stéphane Lesimple a98d92f8bc chore: wording: model not vulnerable -> model not affected 2022-03-21 22:22:33 +01:00
Stéphane Lesimple b7c8c4115a feat: implement detection for MCEPSC under BSD 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 4e7c52767d chore: update Intel Family 6 models 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 8473d9ba6b chore: ensure vars are set before being dereferenced (set -u compat) 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 0af4830224 fix: is_ucode_blacklisted: fix some model names 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 81a4329d71 feat: add --cpu, apply changes to (read|write)_msr, update fwdb to v221+i20220208 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 3679776f3c chore: only attempt to load msr and cpuid module once 2022-03-21 22:22:33 +01:00
Stéphane Lesimple ba131fcd2f chore: read_cpuid: use named constants 2022-03-21 22:22:33 +01:00
Stéphane Lesimple ae6bc31c2c feat: hw check: add IPRED, RRSBA, BHI features check 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 6d7a6b3666 feat: add subleaf != 0 support for read_cpuid 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 16f2160be5 chore: fwdb: update to v220+i20220208 2022-03-17 19:39:39 +01:00
Stéphane Lesimple 580549812a fix: retpoline: detection on 5.15.28+ (#420) 2022-03-17 19:25:24 +01:00
Stéphane Lesimple a485c7882a doc: readme: make the FAQ entry more visible 2021-05-25 13:22:54 +02:00
Stéphane Lesimple 7d13f7a0ef doc: add an FAQ entry about CVE support 2021-05-25 13:17:03 +02:00
Stéphane Lesimple 226b2375ab chore: speculative execution -> transient execution 2021-05-25 12:39:51 +02:00
Stéphane Lesimple 052a3e66d1 doc: more FAQ and README 2021-05-25 12:31:30 +02:00