feat(inception): Zen1/2 IBPB and SMT checks

.github/workflows/check.yml

@@ -24,7 +24,7 @@ jobs:
         fi
     - name: check direct execution
       run: |
-        expected=17
+        expected=18
         nb=$(sudo ./spectre-meltdown-checker.sh --batch json | jq '.[]|.CVE' | wc -l)
         if [ "$nb" -ne "$expected" ]; then
           echo "Invalid number of CVEs reported: $nb instead of $expected"
@@ -34,7 +34,7 @@ jobs:
         fi
     - name: check docker-compose run execution
       run: |
-        expected=17
+        expected=18
         docker-compose build
         nb=$(docker-compose run --rm spectre-meltdown-checker --batch json | jq '.[]|.CVE' | wc -l)
         if [ "$nb" -ne "$expected" ]; then
@@ -45,7 +45,7 @@ jobs:
         fi
     - name: check docker run execution
       run: |
-        expected=17
+        expected=18
         docker build -t spectre-meltdown-checker .
         nb=$(docker run --rm --privileged -v /boot:/boot:ro -v /dev/cpu:/dev/cpu:ro -v /lib/modules:/lib/modules:ro spectre-meltdown-checker --batch json | jq '.[]|.CVE' | wc -l)
         if [ "$nb" -ne "$expected" ]; then

spectre-meltdown-checker.sh

@@ -177,7 +177,7 @@ global_critical=0
 global_unknown=0
 nrpe_vuln=''
 
-supported_cve_list='CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 CVE-2019-11135 CVE-2018-12207 CVE-2020-0543 CVE-2023-20593 CVE-2022-40982'
+supported_cve_list='CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 CVE-2019-11135 CVE-2018-12207 CVE-2020-0543 CVE-2023-20593 CVE-2022-40982 CVE-2023-20569'
 
 # find a sane command to print colored messages, we prefer `printf` over `echo`
 # because `printf` behavior is more standard across Linux/BSD
@@ -304,6 +304,7 @@ cve2name()
 		CVE-2020-0543) echo "Special Register Buffer Data Sampling (SRBDS)";;
 		CVE-2023-20593) echo "Zenbleed, cross-process information leak";;
 		CVE-2022-40982) echo "Downfall, gather data sampling (GDS)";;
+		CVE-2023-20569) echo "Inception, return address security (RAS)";;
 		*) echo "$0: error: invalid CVE '$1' passed to cve2name()" >&2; exit 255;;
 	esac
 }
@@ -330,6 +331,7 @@ _is_cpu_affected_cached()
 		CVE-2020-0543) return $variant_srbds;;
 		CVE-2023-20593) return $variant_zenbleed;;
 		CVE-2022-40982) return $variant_downfall;;
+		CVE-2023-20569) return $variant_inception;;
 		*) echo "$0: error: invalid variant '$1' passed to is_cpu_affected()" >&2; exit 255;;
 	esac
 }
@@ -397,8 +399,9 @@ is_cpu_affected()
 	variant_taa=''
 	variant_itlbmh=''
 	variant_srbds=''
-	# Zenbleed is AMD specific, look for "is_amd" below:
+	# Zenbleed and Inception are both AMD specific, look for "is_amd" below:
 	variant_zenbleed=immune
+	variant_inception=immune
 	# Downfall is Intel specific, look for "is_intel" below:
 	variant_downfall=immune
 
@@ -560,6 +563,12 @@ is_cpu_affected()
 		amd_legacy_erratum "$(amd_model_range 0x17 0x30 0x0 0x4f 0xf)" && variant_zenbleed=vuln
 		amd_legacy_erratum "$(amd_model_range 0x17 0x60 0x0 0x7f 0xf)" && variant_zenbleed=vuln
 		amd_legacy_erratum "$(amd_model_range 0x17 0xa0 0x0 0xaf 0xf)" && variant_zenbleed=vuln
+
+		# Inception (according to kernel, zen 1 to 4)
+		if [ "$cpu_family" = $(( 0x17 )) ] || [ "$cpu_family" = $(( 0x19 )) ]; then
+			variant_inception=vuln
+		fi
+
 	elif [ "$cpu_vendor" = CAVIUM ]; then
 		variant3=immune
 		variant3a=immune
@@ -702,21 +711,22 @@ is_cpu_affected()
 	fi
 
 	_debug "is_cpu_affected: temp results are <$variant1> <$variant2> <$variant3> <$variant3a> <$variant4> <$variantl1tf>"
-	[ "$variant1"         = "immune" ] && variant1=1       || variant1=0
-	[ "$variant2"         = "immune" ] && variant2=1       || variant2=0
-	[ "$variant3"         = "immune" ] && variant3=1       || variant3=0
-	[ "$variant3a"        = "immune" ] && variant3a=1      || variant3a=0
-	[ "$variant4"         = "immune" ] && variant4=1       || variant4=0
-	[ "$variantl1tf"      = "immune" ] && variantl1tf=1    || variantl1tf=0
-	[ "$variant_msbds"    = "immune" ] && variant_msbds=1  || variant_msbds=0
-	[ "$variant_mfbds"    = "immune" ] && variant_mfbds=1  || variant_mfbds=0
-	[ "$variant_mlpds"    = "immune" ] && variant_mlpds=1  || variant_mlpds=0
-	[ "$variant_mdsum"    = "immune" ] && variant_mdsum=1  || variant_mdsum=0
-	[ "$variant_taa"      = "immune" ] && variant_taa=1    || variant_taa=0
-	[ "$variant_itlbmh"   = "immune" ] && variant_itlbmh=1 || variant_itlbmh=0
-	[ "$variant_srbds"    = "immune" ] && variant_srbds=1 || variant_srbds=0
-	[ "$variant_zenbleed" = "immune" ] && variant_zenbleed=1 || variant_zenbleed=0
-	[ "$variant_downfall" = "immune" ] && variant_downfall=1 || variant_downfall=0
+	[ "$variant1"          = "immune" ] && variant1=1       || variant1=0
+	[ "$variant2"          = "immune" ] && variant2=1       || variant2=0
+	[ "$variant3"          = "immune" ] && variant3=1       || variant3=0
+	[ "$variant3a"         = "immune" ] && variant3a=1      || variant3a=0
+	[ "$variant4"          = "immune" ] && variant4=1       || variant4=0
+	[ "$variantl1tf"       = "immune" ] && variantl1tf=1    || variantl1tf=0
+	[ "$variant_msbds"     = "immune" ] && variant_msbds=1  || variant_msbds=0
+	[ "$variant_mfbds"     = "immune" ] && variant_mfbds=1  || variant_mfbds=0
+	[ "$variant_mlpds"     = "immune" ] && variant_mlpds=1  || variant_mlpds=0
+	[ "$variant_mdsum"     = "immune" ] && variant_mdsum=1  || variant_mdsum=0
+	[ "$variant_taa"       = "immune" ] && variant_taa=1    || variant_taa=0
+	[ "$variant_itlbmh"    = "immune" ] && variant_itlbmh=1 || variant_itlbmh=0
+	[ "$variant_srbds"     = "immune" ] && variant_srbds=1  || variant_srbds=0
+	[ "$variant_zenbleed"  = "immune" ] && variant_zenbleed=1  || variant_zenbleed=0
+	[ "$variant_downfall"  = "immune" ] && variant_downfall=1  || variant_downfall=0
+	[ "$variant_inception" = "immune" ] && variant_inception=1 || variant_inception=0
 	variantl1tf_sgx="$variantl1tf"
 	# even if we are affected to L1TF, if there's no SGX, we're not affected to the original foreshadow
 	[ "$cpuid_sgx" = 0 ] && variantl1tf_sgx=1
@@ -1291,7 +1301,7 @@ while [ -n "${1:-}" ]; do
 		fi
 		case "$2" in
 			help)	echo "The following parameters are supported for --variant (can be used multiple times):";
-					echo "1, 2, 3, 3a, 4, msbds, mfbds, mlpds, mdsum, l1tf, taa, mcepsc, srbds, zenbleed, downfall";
+					echo "1, 2, 3, 3a, 4, msbds, mfbds, mlpds, mdsum, l1tf, taa, mcepsc, srbds, zenbleed, downfall, inception";
 					exit 0;;
 			1)			opt_cve_list="$opt_cve_list CVE-2017-5753"; opt_cve_all=0;;
 			2)			opt_cve_list="$opt_cve_list CVE-2017-5715"; opt_cve_all=0;;
@@ -1308,6 +1318,7 @@ while [ -n "${1:-}" ]; do
 			srbds)		opt_cve_list="$opt_cve_list CVE-2020-0543"; opt_cve_all=0;;
 			zenbleed)	opt_cve_list="$opt_cve_list CVE-2023-20593"; opt_cve_all=0;;
 			downfall)   opt_cve_list="$opt_cve_list CVE-2022-40982"; opt_cve_all=0;;
+			inception)  opt_cve_list="$opt_cve_list CVE-2023-20569"; opt_cve_all=0;;
 			*)
 				echo "$0: error: invalid parameter '$2' for --variant, see --variant help for a list" >&2;
 				exit 255
@@ -1402,6 +1413,7 @@ pvulnstatus()
 			CVE-2020-0543) aka="SRBDS";;
 			CVE-2023-20593) aka="ZENBLEED";;
 			CVE-2022-40982) aka="DOWNFALL";;
+			CVE-2023-20569) aka="INCEPTION";;
 			*) echo "$0: error: invalid CVE '$1' passed to pvulnstatus()" >&2; exit 255;;
 		esac
 
@@ -6283,6 +6295,90 @@ check_CVE_2022_40982_linux() {
 	fi
 }
 
+#######################
+# Inception section
+
+check_CVE_2023_20569() {
+	cve='CVE-2023-20569'
+	_info "\033[1;34m$cve aka '$(cve2name "$cve")'\033[0m"
+	if [ "$os" = Linux ]
+	then
+		check_CVE_2023_20569_linux
+	else
+		_warn "Unsupported OS ($os)."
+	fi
+}
+
+check_CVE_2023_20569_linux() {
+	status=UNK
+	sys_interface_available=0
+	msg=''
+
+	if sys_interface_check "/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow"; then
+		# this kernel has the /sys interface, trust it over everything
+		sys_interface_available=1
+	fi
+
+	if [ "$opt_sysfs_only" != 1 ]; then
+		_info_nol "* Kernel supports mitigation: "
+		if [ -n "$kernel_err" ]; then
+			kernel_sro_err="$kernel_err"
+		elif grep -q 'spec_rstack_overflow' "$kernel"; then
+			kernel_sro="found spec_rstack_overflow in kernel image"
+		fi
+		if [ -n "$kernel_sro" ]; then
+			pstatus green YES "$kernel_sro"
+		elif [ -n "$kernel_sro_err" ]; then
+			pstatus yellow UNKNOWN "$kernel_sro_err"
+		else
+			pstatus yellow NO
+		fi
+
+		if [ -n "$kernel_sro" ]; then	
+
+			# TODO check mitigation
+			:
+		fi
+
+		# Zen & Zen2 : if the right IBPB microcode applied + SMT off --> not vuln
+		if [ "$cpu_family" = $(( 0x17 )) ]; then
+			_info_nol "* IBPB support: "
+			if [ -n "$cpuid_ibpb" ]; then
+				pstatus green YES "$cpuid_ibpb"
+			else
+				pstatus red NO
+			fi
+
+			_info_nol "* SMT is enabled: "
+			is_cpu_smt_enabled; smt_enabled=$?
+			if [ "$smt_enabled" = 0 ]; then
+				pstatus red YES
+			else
+				pstatus green NO
+			fi		
+		fi
+
+	elif [ "$sys_interface_available" = 0 ]; then
+		# we have no sysfs but were asked to use it only!
+		msg="/sys vulnerability interface use forced, but it's not available!"
+		status=UNK
+	fi
+
+	if ! is_cpu_affected "$cve" ; then
+		# override status & msg in case CPU is not vulnerable after all
+		pvulnstatus "$cve" OK "your CPU vendor reported your CPU model as not affected"
+	elif [ "$cpu_family" = $(( 0x17 )) ] && [ "$smt_enabled" = 1 ] && [ -n "$cpuid_ibpb" ]; then
+		pvulnstatus "$cve" OK "IBPB supported and SMT is off"
+		explain "Zen1/2 with SMT off aren't vulnerable after the right IBPB microcode has been applied. (https://github.com/torvalds/linux/commit/138bcddb86d8a4f842e4ed6f0585abc9b1a764ff#diff-17bd24a7a7850613cced545790ac30646097e8d6207348c2bd1845f397acb390R2272)"
+	elif [ -z "$msg" ]; then
+		# if msg is empty, sysfs check didn't fill it, rely on our own test
+		# TODO
+		pvulnstatus "$cve" UNK "further checks are required (WIP)"
+	else
+		pvulnstatus $cve "$status" "$msg"
+	fi
+}
+
 #######################
 # END OF VULNS SECTIONS