peter/spectre-meltdown-checker
1
0
Fork 0
mirror of https://github.com/speed47/spectre-meltdown-checker.git synced 2026-09-05 18:33:56 +02:00
Code Issues Projects Releases Wiki Activity
614 Commits 9 Branches 50 Tags
835d02324560bd723a6998aeb2a7c1a0a4dc8de1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Stéphane Lesimple c277a7a443 Merge remote-tracking branch 'origin/master' into source-build 2026-06-02 19:30:19 +02:00
Stéphane Lesimpleandfoo 26cf31b282 Merge source-build for v26.36.0601873 (#575) 
* chore: add stalebot in dryrun

 built from commit afadf53f7f
 dated 2026-04-02 13:13:19 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge branch 'test' into source

 built from commit 952fe6a87f
 dated 2026-04-02 18:40:05 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge pull request #530 from speed47/test

 built from commit d3c0f1a24d
 dated 2026-04-02 16:49:41 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 chore: workflows revamp

* Merge pull request #532 from speed47/test

 built from commit 6fac2d8ff1
 dated 2026-04-02 21:32:39 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Retbleed / Downfall overhald / doc updates

* enh: add known fixed ucode versions for CVE-2023-23583 (Reptar) and CVE-2024-45332 (BPI)

 built from commit cccb3c0081
 dated 2026-04-04 17:50:04 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* fix: add rebleet to --variant

 built from commit 7a7408d124
 dated 2026-04-04 18:17:35 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge pull request #566 from speed47/test

 built from commit 3e2b6cc734
 dated 2026-04-20 11:02:38 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Prepare release v26.33.0420xxx

* Merge pull request #571 from speed47/test

 built from commit 0045d237fa
 dated 2026-06-01 20:44:44 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Prepare next release

* update: fwdb from v349+i20260227+615b to v349+i20260512+1cce, 19 microcode changes

 built from commit 645a79846b
 dated 2026-06-01 20:56:45 +0000
 by github-actions[bot] (41898282+github-actions[bot]@users.noreply.github.com)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-06-02 16:57:51 +00:00
Stéphane Lesimple 3f4801e6a7 autoupdate workflow: add missing pkg 2026-06-01 20:55:08 +00:00
Stéphane Lesimple 9a3688b6fd chore: use scripts in autoupdate workflow (#572) 2026-06-01 20:52:54 +00:00
Stéphane Lesimple 0c89d162a3 chore: fix autoupdate workflow 2026-05-31 14:50:31 +02:00
Stéphane Lesimple 1c067add59 release v26.33.0420460 (#567) 2026-04-20 15:18:11 +00:00
Stéphane Lesimple 00bb4a951c workflow: expose reconsider_age_days input + env var 2026-04-19 14:46:56 +02:00
Stéphane Lesimple 43d5b77885 chore: workflow: add manual model + window_hours inputs, add reconsider 2026-04-19 12:55:03 +02:00
Stéphane Lesimple 78a6e4a418 chore: move cron vuln-watch workflow script files to their own branch 2026-04-19 11:14:21 +02:00
Stéphane Lesimple 5af1a9fec9 chore: workflow: add scan id 2026-04-18 16:23:47 +02:00
Stéphane Lesimple b93027640f chore: vuln workflow: use opus, no persist creds, conditional upload 2026-04-18 16:19:10 +02:00
Stéphane Lesimple 5c27284119 chore: workflow: save logs 2026-04-18 16:05:15 +02:00
Stéphane Lesimple f2e5999fc0 chore: explicit prompt for workflow 2026-04-18 15:41:03 +02:00
Stéphane Lesimple 25f20b8860 chore: fix workflow perms (#558) 2026-04-18 15:29:54 +02:00
Stéphane Lesimple 77e3dbd6b2 add scheduled vuln research (#557) 2026-04-18 15:14:13 +02:00
Stéphane Lesimple 8a6f9d5d63 Implement ITS/VMScape/BTI and misc enhancements (#539) 
7a7408d fix: add rebleet to --variant
cccb3c0 enh: add known fixed ucode versions for CVE-2023-23583 (Reptar) and CVE-2024-45332 (BPI)
090f109 doc: add CVE-2023-31315 (SinkClose) to the unsupported list, add categories
5dc9c3c chore: reorder CVE list in README.md
a00fab1 feat: implement CVE-2025-40300 (VMScape) and CVE-2024-45332 (BTI)
e0b818f chore: stalebot: disable dryrun by default
4af1155 feat: implement CVE-2024-28956 (ITS, Indirect Target Selection) vulnerability and mitigation detection
dfed6f3 doc: add note about more unsupported CVEs
1652977 add a generated version of src/libs/003_intel_models.sh
a089ae8 fix: sys_interface_check() must set the caller's $msg var (closes #533)
cc6bbaa chore: don't include src/ generated files in build
2717b0a doc: CVE-2020-12965 unsupported (#478)
 2026-04-04 18:38:49 +02:00
Stéphane Lesimple 73b67b4a80 Merge branch 'master' into source-build 2026-04-04 16:25:35 +00:00
Stéphane Lesimple f2d871acff fix: spurious local keyword broke sysfs based detection (#533) (#534) 
The $msg var assigned in sys_interface_check() must not be
local to the func, but must capture and modify the callers'
own local $msg var
 2026-04-03 01:31:58 +02:00
Stéphane Lesimpleandfoo 83ebe2f75f chore: update workflows (#531) 
* chore: add stalebot in dryrun

 built from commit afadf53f7f
 dated 2026-04-02 13:13:19 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge branch 'test' into source

 built from commit 952fe6a87f
 dated 2026-04-02 18:40:05 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge pull request #530 from speed47/test

 built from commit d3c0f1a24d
 dated 2026-04-02 16:49:41 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 chore: workflows revamp

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-04-02 18:53:44 +02:00
Stéphane Lesimple 75ad60f42a Merge branch 'master' into source-build 2026-04-02 16:53:03 +00:00
Stéphane Lesimple 3a822fdcf2 chore: master: remove obsolete workflow 2026-03-31 19:53:57 +02:00
Stéphane Lesimple a20641fbad fix: handle non-numeric ARM CPU architecture values 
Some old ARM processors (e.g., ARM926EJ-S) report CPU architecture
with suffix in /proc/cpuinfo (e.g., "5TEJ" for ARMv5TEJ).

This caused an "integer expression expected" error when comparing
against numeric values. Extract the numeric prefix before integer comparisons.

Fixes #505.
 2026-01-25 12:57:41 +01:00
Stéphane Lesimple d550ea8c85 fix: harmless 'dmesg: write error' that could happen on some systems 
Fixes #519.
 2026-01-25 11:53:13 +01:00
Stéphane Lesimple 8e33a1dbf2 fix: set cpu_* vars to a default value 
On ARM64 systems, /proc/cpuinfo uses different field names (CPU implementer,
CPU variant, CPU part, CPU revision) instead of x86-style fields (cpu family,
model, stepping). This left these variables empty, causing printf to fail
with 'invalid number' errors when formatting them as hex values.

Fixes #520.
 2026-01-25 11:38:50 +01:00
Stéphane Lesimple 72bce72fe8 chore: really fix autoupdate workflow to avoid useless PRs 2025-10-31 19:53:59 +01:00
Stéphane Lesimple 5f18e67f6f chore: fix autoupdate workflow 2025-10-30 23:57:05 +01:00
Stéphane Lesimple ee4cfd00b8 chore: add autoupdate workflow for fwdb 2025-10-25 20:48:38 +02:00
Stéphane Lesimple c2c60e0161 chore: fix recent shellcheck warnings 2025-10-25 20:48:38 +02:00
Stéphane Lesimple 34c6095912 fix: Linux 6.9+ changed some config options names (#490) 
Issue #490 is about retpoline but other options have also changed,
as reported by a comment on the issue, this commit fixes these
other options:

Breno Leitao (10):
      x86/bugs: Rename CONFIG_GDS_FORCE_MITIGATION => CONFIG_MITIGATION_GDS_FORCE
      x86/bugs: Rename CONFIG_CPU_IBPB_ENTRY       => CONFIG_MITIGATION_IBPB_ENTRY
      x86/bugs: Rename CONFIG_CALL_DEPTH_TRACKING  => CONFIG_MITIGATION_CALL_DEPTH_TRACKING
      x86/bugs: Rename CONFIG_PAGE_TABLE_ISOLATION => CONFIG_MITIGATION_PAGE_TABLE_ISOLATION
      x86/bugs: Rename CONFIG_RETPOLINE            => CONFIG_MITIGATION_RETPOLINE
      x86/bugs: Rename CONFIG_SLS                  => CONFIG_MITIGATION_SLS
      x86/bugs: Rename CONFIG_CPU_UNRET_ENTRY      => CONFIG_MITIGATION_UNRET_ENTRY
      x86/bugs: Rename CONFIG_CPU_IBRS_ENTRY       => CONFIG_MITIGATION_IBRS_ENTRY
      x86/bugs: Rename CONFIG_CPU_SRSO             => CONFIG_MITIGATION_SRSO
      x86/bugs: Rename CONFIG_RETHUNK              => CONFIG_MITIGATION_RETHUNK
 2024-08-04 15:15:45 +02:00
Stéphane Lesimple e806e4bc41 chore: docker compose v2 
The `docker-compose` command has been replaced by `docker compose`.
The "version" tag has also been deprecated in docker-compose.yml.
 2024-08-04 13:53:36 +02:00
Stéphane Lesimple bd0c7c94b5 fix: typo introduced by #483, fixes #486 2024-05-18 13:01:48 +02:00
Stéphane Lesimple d70e4c2974 fwdb: update to v296+i20240514+988c 2024-05-18 13:01:48 +02:00
Stéphane Lesimple 4e29fb5a21 fix: ucode_platformid_mask is hexa (fixes #485) 2024-02-15 17:27:12 +01:00
Stéphane Lesimple 97f4d5f2bc feat(reptar): add detection and mitigation of Reptar 2024-01-09 15:38:16 +01:00
Stéphane Lesimple 9b7b09ada3 fix(inception): continued mitigation detection 2023-08-25 18:50:53 +02:00
Stéphane Lesimple dc6921a1ac feat(inception): handle sysfs interface 2023-08-25 18:50:53 +02:00
Stéphane Lesimple 44223c5308 fix: bsd: kernel version detection 2023-08-11 18:41:35 +02:00
Stéphane Lesimple dbe208fc48 enh: downfall: detect kernel mitigation without sysfs 2023-08-11 18:10:27 +02:00
Stéphane Lesimple aca4e2a9b1 enh: move root warning to the bottom 2023-08-11 18:10:27 +02:00
Stéphane Lesimple ba0daa6769 feat: downfall: add kernel soft mitigation support check 2023-08-10 11:14:40 +02:00
Stéphane Lesimple 8ba3751cf7 fwdb: update to latest Intel ucode versions 2023-08-09 10:35:08 +02:00
Stéphane Lesimple d013c0a7d2 doc: add kernel src as additional ucode version source 2023-08-01 10:22:15 +02:00
Stéphane Lesimple cbe8ba10ce fix: inteldb: cpuid 0x00090660 and 0x000A0680 2023-07-30 13:21:38 +02:00
Stéphane Lesimple 9c2587bca5 enh: when CPUID can't be read, built it by ourselves 2023-07-30 12:21:12 +02:00
Stéphane Lesimple 2a5ddc87bf feat: add Intel known affected processors DB 2023-07-30 12:21:12 +02:00
Stéphane Lesimple 2ef6c1c80e enh: factorize file download func 2023-07-28 20:03:16 +02:00
Stéphane Lesimple 3c224018f4 chore: update disclaimer and FAQ 2023-07-28 20:03:16 +02:00
Stéphane Lesimple b8f8c81d51 release v0.46 2023-07-26 18:07:02 +02:00
Stéphane Lesimple f34dd5fa7b enh: assume CPU is immune to Zenbleed regardless of vendor except AMD 
This contradicts our usual "if we don't know, consider vulnerable" motto,
but as this vuln is extremely specific (which is not the case for the Spectre
range of vulnerabilities, for example), this is the correct approach here.
 2023-07-26 17:54:44 +02:00
Stéphane Lesimple c0869d7341 enh: zenbleed: give a manual mitigation in --explain 2023-07-26 16:38:02 +02:00
Stéphane Lesimple e99a548dcc fix: fms2cpuid was incorrect for families > 0xF 2023-07-26 14:33:11 +02:00
Stéphane Lesimple 3d475dfaec feat: fwdb: add linux-firmware as AMD source, update fwdb accordingly 2023-07-26 13:57:05 +02:00
Stéphane Lesimple cba5010c2a chore: fix typo 2023-07-26 13:57:05 +02:00
Stéphane Lesimple c5661f098f enh: add --explain text for Zenbleed 2023-07-26 10:56:45 +02:00
Stéphane Lesimple 6844c01242 enh: add zenbleed support to the --variant option 2023-07-26 10:46:38 +02:00
Stéphane Lesimple 9bb79a18eb feat: add Zenbleed (CVE-2023-20593) and update fwdb to v270+i20230614 2023-07-25 17:54:59 +02:00
Stéphane Lesimple 6a61df200e update: fwdb to v266+i20230512 2023-05-13 10:27:03 +02:00
Stéphane Lesimple a2843575be fix: docker: adding missing utils (fixes #433) 2023-02-24 21:35:55 +01:00
Stéphane Lesimple 48abeb5950 fix: bad exitcode with --update-fwdb due to trap exit 2023-02-24 20:57:43 +01:00
Stéphane Lesimple 3c988cc73a fix: rewrite SQL to be sqlite3 >= 3.41 compatible 
closes #443
 2023-02-24 20:54:40 +01:00
Stéphane Lesimple b68ebe67f2 fix: fwdb: ignore MCEdb versions where an official Intel version exists (fixes #430) 2022-03-30 09:10:55 +02:00
Stéphane Lesimple a6c943d38f release v0.45 2022-03-27 12:41:17 +02:00
Stéphane Lesimple dd162301ff chore: update fwdb to v222+i20220208 2022-03-27 12:38:44 +02:00
Stéphane Lesimple 5f6471d9a4 feat: set default TMPDIR for Android (#415) 2022-03-27 12:31:05 +02:00
Stéphane Lesimple 2a5b965b98 feat: add --allow-msr-write, no longer write by default (#385), detect when writing is denied 2022-03-24 12:37:19 +01:00
Stéphane Lesimple ee266d43b7 chore: fix indentation 2022-03-21 22:22:33 +01:00
Stéphane Lesimple b61baa90df feat: bsd: for unimplemented CVEs, at least report when CPU is not affected 2022-03-21 22:22:33 +01:00
Stéphane Lesimple a98d92f8bc chore: wording: model not vulnerable -> model not affected 2022-03-21 22:22:33 +01:00
Stéphane Lesimple b7c8c4115a feat: implement detection for MCEPSC under BSD 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 4e7c52767d chore: update Intel Family 6 models 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 8473d9ba6b chore: ensure vars are set before being dereferenced (set -u compat) 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 0af4830224 fix: is_ucode_blacklisted: fix some model names 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 81a4329d71 feat: add --cpu, apply changes to (read|write)_msr, update fwdb to v221+i20220208 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 3679776f3c chore: only attempt to load msr and cpuid module once 2022-03-21 22:22:33 +01:00
Stéphane Lesimple ba131fcd2f chore: read_cpuid: use named constants 2022-03-21 22:22:33 +01:00
Stéphane Lesimple ae6bc31c2c feat: hw check: add IPRED, RRSBA, BHI features check 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 6d7a6b3666 feat: add subleaf != 0 support for read_cpuid 2022-03-21 22:22:33 +01:00
Stéphane Lesimple 16f2160be5 chore: fwdb: update to v220+i20220208 2022-03-17 19:39:39 +01:00
Stéphane Lesimple 580549812a fix: retpoline: detection on 5.15.28+ (#420) 2022-03-17 19:25:24 +01:00
Stéphane Lesimple a485c7882a doc: readme: make the FAQ entry more visible 2021-05-25 13:22:54 +02:00
Stéphane Lesimple 7d13f7a0ef doc: add an FAQ entry about CVE support 2021-05-25 13:17:03 +02:00
Stéphane Lesimple 226b2375ab chore: speculative execution -> transient execution 2021-05-25 12:39:51 +02:00
Stéphane Lesimple 052a3e66d1 doc: more FAQ and README 2021-05-25 12:31:30 +02:00
Stéphane Lesimple 05d862709d fix: has_vmm false positive with pcp 
Fix by matching the full procname with pgrep (-x),
so that the 'pmdakvm' process doesn't match.

Closes #394
 2021-05-25 12:31:07 +02:00
Stéphane Lesimple 3846913899 fix: refuse to run under MacOS and ESXi 2021-05-24 22:42:23 +02:00
Stéphane Lesimple a87ace1f98 doc: add an FAQ.md and update the README.md accordingly 2021-05-24 22:27:46 +02:00
Stéphane Lesimple 0ba71a443e fix: mcedb: v191 changed the MCE table format 
Also update the builtin db to v191+i20210217

Closes #400
 2021-05-24 12:55:44 +02:00
Stéphane Lesimple 3a486e9985 arm64: variant 4: detect ssbd mitigation from kernel img, system.map or kconfig 2021-04-02 15:38:31 +02:00
Stéphane Lesimple 23564cda5d fix: variant4: added case where prctl ssbd status is tagged as 'unknown' 2021-04-02 15:38:31 +02:00
Stéphane Lesimple 0ea21d09bd fix: extract_kernel: don't overwrite kernel_err if already set 
Fixes #395
 2021-04-02 15:33:02 +02:00
Stéphane Lesimple 08e30e156d chore: readme: framapic is gone, host the screenshots on GitHub 2021-02-22 21:22:11 +01:00
Stéphane Lesimple 4ec3154be0 chore: replace 'Vulnerable to' by 'Affected by' in the hw section 
This seems to be less confusing, suggested by #356
 2020-11-10 18:56:25 +01:00
Stéphane Lesimple 843f26630d feat: arm: add Cortex A77 and Neoverse-N1 (fixes #371) 2020-11-10 18:36:42 +01:00
Stéphane Lesimple 7fc2ec65b9 bump to v0.44 2020-11-09 18:41:43 +01:00
Stéphane Lesimple c8cdfd54da chore: fwdb: update to v165.20201021+i20200616 2020-11-08 21:25:18 +01:00
Stéphane Lesimple f0c33c7a32 fix: fwdb: use the commit date as the intel fwdb version 
fixes #379
 2020-11-08 21:25:18 +01:00
Stéphane Lesimple 9e874397da chore: fwdb: update to v163.20200930+i20200904 2020-10-05 20:06:49 +02:00
Stéphane Lesimple 76cb73f3cb fix: fwdb: update Intel's repository URL 2020-10-05 20:06:49 +02:00
Stéphane Lesimple 90f23d286e chore: update fwdb to v160.20200912+i20200722 2020-09-14 21:45:09 +02:00
Stéphane Lesimple e41e311a7f feat: add zstd kernel decompression (#370) 2020-09-14 21:42:55 +02:00