7b72c20f89
feat(l1tf): explode L1TF in its 3 distinct CVEs
2018-09-17 21:44:48 +02:00
b48b2177b7
feat: Add Clear Linux Distro ( #244 )
...
Add path of Clear Linux kernel binary and kernel config file.
2018-09-15 15:51:49 +02:00
8f31634df6
feat(batch): Add a batch short option for one line result ( #243 )
...
When using this script on a large amount a machine (via clustershell or
instance) it can be easier to have a very short result on one line
showing only the vulnerabilities
2018-09-15 15:45:10 +02:00
96798b1932
chore: add SPDX GPL-3.0 license identifier ( #245 )
...
The spectre-meltdown-checker.sh file is missing licensing information.
The SPDX identifier is a legally binding shorthand, which can be
used instead of the full boiler plate text.
2018-09-15 15:33:41 +02:00
687ce1a7fa
fix: load cpuid module if absent even when /dev/cpu/0/cpuid is there
2018-09-08 23:15:50 +02:00
80e0db7cc4
fix: don't show erroneous ucode version when latest version is unknown ( fixes #238 )
2018-08-28 20:51:46 +02:00
e8890ffac6
feat(config): support for genkernel kernel config file ( #239 )
...
Add support for distributions using genkernel.
2018-08-28 20:24:37 +02:00
afb36c519d
Fix typo: 'RBS filling' => 'RSB filling' ( #237 )
2018-08-18 12:05:17 +02:00
0009c0d473
fix: --batch now implies --no-color to avoid colored warnings
2018-08-18 12:04:18 +02:00
dd67fd94d7
feat: add FLUSH_CMD MSR availability detection (part of L1TF mitigation)
2018-08-16 19:05:09 +02:00
339ad31757
fix: add missing l1tf CPU vulnerability display in hw section
2018-08-16 15:19:29 +02:00
794c5be1d2
feat: add optional git describe support to display inter-release version numbers
2018-08-16 15:18:47 +02:00
a7afc585a9
fix several incorrect ucode version numbers
2018-08-16 10:51:55 +02:00
fc1dffd09a
feat: implement detection of latest known versions of intel microcodes
2018-08-15 12:53:49 +02:00
e942616189
feat: initial support for L1TF
2018-08-15 12:05:08 +02:00
360be7b35f
fix: hide arch_capabilities_msr_not_read warning under !intel
2018-08-13 15:42:56 +02:00
5f59257826
bump to v0.39
2018-08-13 15:33:03 +02:00
92d59cbdc1
chore: adjust some comments, add 2 missing inits
2018-08-11 10:31:10 +02:00
4747b932e7
feat: add detection of RSBA feature bit and adjust logic accordingly
2018-08-10 10:26:23 +02:00
860023a806
fix: ARCH MSR was not read correctly, preventing proper SSB_NO and RDCL_NO detection
2018-08-10 10:26:23 +02:00
ab67a9221d
feat: read/write msr now supports msr-tools or perl as dd fallback
2018-08-10 10:26:23 +02:00
f4592bf3a8
Add Arch armv5/armv7 kernel image location ( #227 )
2018-08-09 22:13:30 +02:00
be15e47671
chore: setting master to v0.38+
2018-08-09 14:25:22 +02:00
d3481d9524
Add support for the kernel being within a btrfs subvolume ( #226 )
...
- /boot may be within a named root subvolume (eg. "/@/boot")
- /boot may be in its own subvolume (eg. "/@boot")
2018-08-09 14:00:35 +02:00
21af561148
bump to v0.38
2018-08-07 10:55:50 +02:00
cb740397f3
feat(arm32): add spectrev1 mitigation detection
2018-08-07 10:42:03 +02:00
84195689af
change: default to --no-explain, use --explain to get detailed mitigation help
2018-08-04 16:31:41 +02:00
b637681fa8
fix: debug output: msg inaccuracy for ARM checks
2018-08-04 16:19:54 +02:00
9316c30577
fix: armv8: models < 0xd07 are not vulnerable
2018-08-04 16:19:54 +02:00
f9dd9d8cb9
add guess for archlinuxarm aarch64 kernel image on raspberry pi 3 ( #222 )
2018-08-01 00:15:52 +02:00
0f0d103a89
fix: correctly init capabilities_ssb_no var in all cases
2018-07-26 10:18:14 +02:00
b262c40541
fix: remove spurious character after an else statement
2018-07-25 21:55:50 +02:00
cc2910fbbc
fix: read_cpuid: don't use iflag=skip_bytes for compat with old dd versions
...
This closes #215 #199 #193
2018-07-23 09:12:30 +02:00
30c4a1f6d2
arm64: cavium: Add CPU Implementer Cavium ( #216 )
...
This patch adds 0x43 check for cavium implementor id in function
parse_cpu_details. Also adds that Cavium Soc is not vulnerable to variant 3/3a
Signed-off-by: Manish Jaggi <manish.jagg@cavium.com>
2018-07-22 19:06:19 +02:00
cf06636a3f
fix: prometheus output: use printf for proper \n interpretation ( #204 )
2018-06-21 23:35:51 +02:00
60077c8d12
fix(arm): rewrite vuln logic from latest arm statement for Cortex A8 to A76
2018-06-21 23:24:18 +02:00
c181978d7c
fix(arm): Updated arm cortex status ( #209 )
...
* Cortex A8 Vulnerable
Arm Cortex A8 is vulnerable to variants 1 & 2 (https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability )
Part number is 0xc08 (https://developer.arm.com/docs/ddi0344/b/system-control-coprocessor/system-control-coprocessorregisters/c0-main-id-register )
False negative reported by @V10lator in #206
* ARM Cortex A12 Vulnerable to 1&2
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
* A76 vulnerable to variant 4
All arch 8 cortex A57-A76 are vulnerable to variant 4.
https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
* Whitelist variant4 nonvuln Arms
* ARM Cortex Whitelist & Cumulative Blacklist
Applies all information about vulnerabilities of ARM Cortex processors (from https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability ).
Whitelist & blacklist approach, using both vulnerable and non vulnerable status for each identified CPU, with vulnerabilities tracked cumulatively for multi CPU systems.
2018-06-16 12:14:39 +02:00
5962d20ba7
fix(variant4): whitelist from common.c::cpu_no_spec_store_bypass ( #202 )
...
* variant4 from common.c::cpu_no_spec_store_bypass
Variant 4 - Add function to 'whitelist' the hand-full of CPUs unaffected by speculative store bypass.
This would allow improved determination of variant 4 status ( #189 ) of immune CPUs while waiting for the 4.17/stable patches to be backported to distro kernels.
Source of cpu list : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/common.c#n945 )
Modeled after is_cpu_specex_free()
* amd families fix
amd families are reported by parse_cpu_details() in decimal
* remove duplicates
Only list processors which speculate and are immune to variant 4.
Avoids duplication with non-speculating CPUs listed in is_cpu_specex_free()
2018-05-27 15:14:29 +02:00
17a3488505
fix(help): add missing references to variants 3a & 4 ( #201 )
2018-05-24 16:35:57 +02:00
e54e8b3e84
chore: remove warning in README, fix display indentation
2018-05-24 16:32:53 +02:00
39c778e3ac
fix(amd): AMD families 0x15-0x17 non-arch MSRs are a valid way to control SSB
2018-05-23 23:08:07 +02:00
2cde6e4649
feat(ssbd): add detection of proper CPUID bits on AMD
2018-05-23 22:50:52 +02:00
f4d51e7e53
fix(variant4): add another detection way for Red Hat kernel
2018-05-23 22:47:54 +02:00
85d46b2799
feat(variant4): add more detailed explanations
2018-05-23 21:08:58 +02:00
61e02abd0c
feat(variant3a): detect up to date microcode
2018-05-23 21:08:08 +02:00
114756fab7
fix(amd): not vulnerable to variant3a
2018-05-23 20:38:43 +02:00
ea75969eb7
fix(help): Update variant options in usage message ( #200 )
2018-05-22 15:54:25 +02:00
ca391cbfc9
fix(variant2): correctly detect IBRS/IBPB in SLES kernels
2018-05-22 12:06:46 +02:00
68af5c5f92
feat(variant4): detect SSBD-aware kernel
2018-05-22 12:05:46 +02:00
f75cc0bb6f
feat(variant4): add sysfs mitigation hint and some explanation about the vuln
2018-05-22 09:39:11 +02:00
f33d65ff71
feat(variant3a): add information about microcode-sufficient mitigation
2018-05-22 09:38:29 +02:00
725eaa8bf5
feat(arm): adjust vulnerable ARM CPUs for variant3a and variant4
2018-05-22 09:19:29 +02:00
c6ee0358d1
feat(variant4): report SSB_NO CPUs as not vulnerable
2018-05-22 09:18:30 +02:00
22d0b203da
fix(ssb_no): rename ssbd_no to ssb_no and fix shift
2018-05-22 00:38:31 +02:00
3062a8416a
fix(msg): add missing words
2018-05-22 00:10:08 +02:00
6a4318addf
feat(variant3a/4): initial support for 2 new CVEs
2018-05-22 00:06:56 +02:00
c19986188f
fix(variant2): adjust detection for SLES kernels
2018-05-19 09:53:12 +02:00
7e4899bcb8
ibrs can't be enabled on no ibrs cpu ( #195 )
...
* ibrs can't be enabled on no ibrs cpu
If the cpu is identified, and does not support SPEC_CTRL or IBRS, then ibrs can't be enabled, even if supported by the kernel.
Instead of reporting IBRS enabled and active UNKNOWN, report IBRS enabled and active NO.
2018-05-17 15:39:48 +02:00
5cc77741af
Update spectre-meltdown-checker.sh
2018-05-05 13:00:44 +02:00
1c0f6d9580
cpuid and msr module check
...
This adds a check before loading the cpuid and msr modules under linux, ensuring they are not unloaded in exit_cleanup() if they were initially present.
2018-05-05 13:00:44 +02:00
4acd0f647a
Suggestion to change VM to a CPU with IBRS capability
2018-04-20 20:35:12 +02:00
fb52dbe7bf
set master branch to v0.37+
2018-04-20 20:34:42 +02:00
edebe4dcd4
bump to v0.37
2018-04-18 23:51:45 +02:00
83ea78f523
fix: arm: also detect variant 1 mitigation when using native objdump
2018-04-17 18:50:32 +02:00
602b68d493
fix(spectrev2): explain that retpoline is possible for Skylake+ if there is RSB filling, even if IBRS is still better
2018-04-16 09:27:28 +02:00
97bccaa0d7
feat: rephrase IBPB warning when only retpoline is enabled in non-paranoid mode
2018-04-16 09:13:25 +02:00
68e619b0d3
feat: show RSB filling capability for non-Skylake in verbose mode
2018-04-16 09:08:25 +02:00
a6f4475cee
feat: make IBRS_FW blue instead of green
2018-04-16 09:07:54 +02:00
223f5028df
feat: add --paranoid to choose whether we require IBPB
2018-04-15 23:05:30 +02:00
c0108b9690
fix(spectre2): don't explain how to fix when NOT VULNERABLE
2018-04-15 20:55:55 +02:00
a3016134bd
feat: make RSB filling support mandatory for Skylake+ CPUs
2018-04-15 20:55:31 +02:00
59d85b39c9
feat: detect RSB filling capability in the kernel
2018-04-15 20:55:01 +02:00
baaefb0c31
fix: remove shellcheck warnings
2018-04-11 22:24:03 +02:00
d452aca03a
fix: invalid bash syntax when ibpb_enabled or ibrs_enabled are empty
2018-04-11 10:29:42 +02:00
10b8d94724
feat: detect latest Red Hat kernels' RO ibpb_enabled knob
2018-04-10 22:51:45 +02:00
8606e60ef7
refactor: no longer display the retoline-aware compiler test when we can't tell for sure
2018-04-10 22:51:45 +02:00
6a48251647
fix: regression in 51aeae25, when retpoline & ibpb are enabled
2018-04-10 22:51:45 +02:00
f4bf5e95ec
fix: typos
2018-04-10 22:51:45 +02:00
60eac1ad43
feat: also do PTI performance check with (inv)pcid for BSD
2018-04-10 22:51:45 +02:00
b3cc06a6ad
fix regression introduced by 82c25dc
2018-04-10 22:51:45 +02:00
5553576e31
feat(amd/zen): re-introduce IBRS for AMD except ZEN family
2018-04-10 22:51:45 +02:00
e16ad802da
feat(ibpb=2): add detection of SMT before concluding the system is not vulnerable
2018-04-10 22:51:45 +02:00
29c294edff
feat(bsd): explain how to mitigate variant2
2018-04-10 22:51:45 +02:00
59714011db
refactor: IBRS_ALL & RDCL_NO are Intel-only
2018-04-10 22:51:45 +02:00
51e8261a32
refactor: separate hw checks for Intel & AMD
2018-04-10 22:49:28 +02:00
2a4bfad835
refactor: add is_amd and is_intel funcs
2018-04-10 22:49:28 +02:00
7e52cea66e
feat(spectre2): refined how status of this vuln is decided and more precise explanations on how to fix
2018-04-10 22:49:28 +02:00
417d7aab91
Fix trailing whitespace and mixed indent styles;
2018-04-10 22:42:47 +02:00
67bf761029
Fix some user facing typos with codespell -w -q3 .
2018-04-08 18:44:13 +02:00
0eabd266ad
refactor: decrease default verbosity for some tests
2018-04-05 22:20:16 +02:00
b77fb0f226
fix: don't override ibrs/ibpb results with later tests
2018-04-05 22:04:20 +02:00
89c2e0fb21
fix(amd): show cpuinfo and ucode details
2018-04-05 21:39:27 +02:00
b88f32ed95
feat: print raw cpuid, and fetch ucode version under BSD
2018-04-05 00:07:12 +02:00
7a4ebe8009
refactor: rewrite read_cpuid to get more common code parts between BSD and Linux
2018-04-05 00:06:24 +02:00
0919f5c236
feat: add explanations of what to do when a vulnerability is not mitigated
2018-04-05 00:03:04 +02:00
de02dad909
feat: rework Spectre V2 mitigations detection w/ latest vanilla & Red Hat 7 kernels
2018-04-05 00:01:54 +02:00
07484d0ea7
add dump of variables at end of script in debug mode
2018-04-04 23:58:15 +02:00
a8b557b9e2
fix(cpu): skip CPU checks if asked to (--no-hw) or if inspecting a kernel of another architecture
2018-04-03 19:36:28 +02:00
619b2749d8
fix(sysfs): only check for sysfs for spectre2 when in live mode
2018-04-03 19:32:36 +02:00
056ed00baa
feat(arm): detect spectre variant 1 mitigation
2018-04-03 15:52:25 +02:00
Stéphane Lesimple
Luis Ponce
Pierre Gaxatte
David Guglielmi
Karsten Weiss
0x9fff00
Nathan Parsons
Lily Wilson
manish jaggi
Rob Gill
rrobgill
Onno Zweers
Igor Lubashev
Benjamin Bouvier
Sylvestre Ledru