Stéphane Lesimple
c143bdb073
fix: read/write msr and lockdown: fix a variable error, properly report lockdown to users
2026-04-06 17:40:25 +02:00
Stéphane Lesimple
fc34cb729b
fix: better compatibility under busybox, silence buggy unzlma versions ( fix #432 )
2026-04-06 17:12:21 +02:00
Stéphane Lesimple
fe5bf7c003
fix: wrmsr: specify core number ( closes #294 )
2026-04-06 17:01:17 +02:00
Stéphane Lesimple
ac09be87b5
enh: clearer kernel info section at the top of the script
2026-04-06 15:00:00 +02:00
Stéphane Lesimple
46e662e9a3
enh: clearer CPU details section
2026-04-06 14:59:28 +02:00
Stéphane Lesimple
730dd50024
chore: add comment about is_intel/amd/hygon recursion
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
7f893e17d2
enh: update IntelDB affected CPU list to 2026-04 data, including Hybrid CPU detection
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
078759413b
doc: document Platypus (CVE-2020-8694 CVE-2020-8695) as out of scope ( #384 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
ab01b351af
doc: document CVE-2020-24511 and CVE-2020-24512 as being out of scope along with rationale ( #409 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
c1452a02c5
fix: CPUs affected by MSBDS but not MDS ( fix #351 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
f6e7071455
doc: add CVE-2019-11157 (Plundervolt) to unsupported CVE list
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
7ed95384b5
fix: better detect kernel lockdown & no longer require cap_flush_cmd to deem CVE-2018-3615 as mitigated ( fix #296 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
435f72de25
feat: implement check for MMIO Stale Data (CVE-2022-21123 CVE-2022-21125 CVE-2022-21166) ( #437 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
59a887dea0
doc: add Blindside to unsupported list ( #374 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
69428dbaf6
doc: add CVE-2020-0549 (L1D Eviction Sampling, CacheOut) as unsupported
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
e4da1b2439
fix: CVE-2019-11135 (TAA) detect new 0x10F MSR for TSX-disabled CPUs ( #414 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
fe9306fb8c
fix: CVE-2024-3635[0,7] don't print lines about TSA CPUID bits under non-AMD
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
c4bb8cc1f3
feat: add CVE-2023-20588 (AMD DIV0 bug) ( #473 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
9d32382aa6
doc: update dev guidelines
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
f38fc5f4db
doc: add CVE-2024-2201 (Native BHI) and TLBleed as unsupported
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
36263edc5a
fix: CVE-2020-0543 (SRBDS): microcode mitigation misdetected ( #492 )
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
0e440cbac6
enh: detect IPBP return predictor bypass in Inception/SRSO ("PB-Inception") ( #500 )
...
AMD Zen 1-3 CPUs don't flush return predictions on IBPB, allowing
cross-process Spectre attacks even with IBPB-on-entry active. The kernel
fix (v6.12+, backported) adds RSB fill after IBPB on affected CPUs.
Detect this gap by checking CPUID IBPB_RET bit and kernel ibpb_no_ret
bug flag, and flag systems relying on IBPB without the RSB fill fix.
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
bf6289adfb
fix: don't default to 0x0 ucode when unknown
2026-04-06 14:05:21 +02:00
Stéphane Lesimple
e2eba83ce8
fix: bsd: use proper MSR for AMD in ucode version read fallback
2026-04-06 02:43:34 +02:00
Stéphane Lesimple
96c696e313
enh: MDS FreeBSD: detect software mitigation as OK unless --paranoid ( #503 )
2026-04-06 02:43:34 +02:00
Stéphane Lesimple
485e2d275b
doc: add CVE-2021-26318 (ADM Prefetch) to unsupported list
2026-04-06 02:43:34 +02:00
Stéphane Lesimple
786bc86be8
feat: implement CVE-2023-28746 (RFDS, Register File Data Sampling)
2026-04-06 02:43:34 +02:00
Stéphane Lesimple
9288a8295d
feat: add SLS (Straight-Line Speculation) check with --extra option
2026-04-06 02:43:34 +02:00
Stéphane Lesimple
7a7408d124
fix: add rebleet to --variant
2026-04-04 16:22:05 +00:00
Stéphane Lesimple
cccb3c0081
enh: add known fixed ucode versions for CVE-2023-23583 (Reptar) and CVE-2024-45332 (BPI)
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
090f109c52
doc: add CVE-2023-31315 (SinkClose) to the unsupported list, add categories
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
5dc9c3c18d
chore: reorder CVE list in README.md
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
a00fab131f
feat: implement CVE-2025-40300 (VMScape) and CVE-2024-45332 (BTI)
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
e0b818f8fa
chore: stalebot: disable dryrun by default
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
4af11551ba
feat: implement CVE-2024-28956 (ITS, Indirect Target Selection) vulnerability and mitigation detection
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
dfed6f35c5
doc: add note about more unsupported CVEs
...
CVE-2020-12965 - Transient Execution of Non-Canonical Accesses (SLAM)
CVE-2024-7881 - ARM Prefetcher Privilege Escalation
CVE-2024-56161 - EntrySign (AMD Microcode Signature Bypass)
CVE-2025-20623 - Shared Microarchitectural Predictor State (10th Gen Intel)
CVE-2025-24495 - Lion Cove BPU Initialization
CVE-2025-29943 - StackWarp (AMD SEV-SNP)
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
1652977f47
add a generated version of src/libs/003_intel_models.sh
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
a089ae8cef
fix: sys_interface_check() must set the caller's $msg var ( closes #533 )
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
cc6bbaad19
chore: don't include src/ generated files in build
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
2717b0a4be
doc: CVE-2020-12965 unsupported ( #478 )
2026-04-04 16:07:12 +00:00
Stéphane Lesimple
6fac2d8ff1
Merge pull request #532 from speed47/test
...
Retbleed / Downfall overhald / doc updates
2026-04-02 21:32:39 +00:00
Stéphane Lesimple
ae5493257e
doc: CVE-2018-3693 CVE-2019-1125 CVE-2019-15902 unsupported or already included
2026-04-02 23:22:31 +02:00
Stéphane Lesimple
47e202100a
doc: CVE-2018-15572 is already implemented along Spectre V2
2026-04-02 23:12:29 +02:00
Stéphane Lesimple
0edb357894
doc: CVE-2018-9056 is out of scope ( closes #169 )
2026-04-02 22:58:45 +02:00
Stéphane Lesimple
ed6a0a2882
doc: unsupported CVE list
2026-04-02 22:51:55 +02:00
Stéphane Lesimple
86e0fae48a
enh: group results by 4 in the summary line at the end of the run
2026-04-02 22:45:08 +02:00
Stéphane Lesimple
cb3b9a37fa
enh: rework VERSION adjust when we're cloned
2026-04-02 22:33:48 +02:00
Stéphane Lesimple
b9f75346d4
enh: auto-generate intel model list
2026-04-02 22:33:48 +02:00
Stéphane Lesimple
4f6dbb36c8
feat: implement Retbleed (CVE-2022-29900 CVE-2022-29901) mitigation detection
2026-04-02 22:33:48 +02:00
Stéphane Lesimple
d644941a76
chore: update dev doc with check_CVE_* header exception
2026-04-02 22:09:09 +02:00
