Compare commits

..
Author SHA1 Message Date
github-actions[bot] 835d023245 doc: add CVE-2026-46174 (AMD Zen 2 Op Cache Improper Resource Isolation) to the unsupported list
built from commit 32fa538ceb
 dated 2026-06-06 15:07:18 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

 (cherry picked from commit d8abfbe20a)
2026-08-08 18:05:55 +00:00
github-actions[bot] ed7f348f83 doc: document path-scoped release flow and update branch model
built from commit 1161089b2e
 dated 2026-07-30 14:01:30 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

 Add RELEASE.md describing the manual sync -> draft -> publish release
procedure

Update DEVELOPMENT.md's Branch Model to reflect that source-build is copied
onto master by the manual `release` workflow instead of merged via PR.
2026-07-30 12:04:02 +00:00
github-actions[bot] 84894f96c6 fix: intel: add Cascade Lake (06-55-07) to the BPI fixed-ucode list
built from commit dc7b92bf42
 dated 2026-07-28 22:18:04 +0000
 by Jay Chung (jaehoc@amazon.com)

 Signed-off-by: Jay Chung <jaehoc@amazon.com>
2026-07-30 11:01:42 +00:00
github-actions[bot] 03cc4ffeb1 feat: arm: add Neoverse-V3 and Neoverse-V3AE
built from commit 1ffa598c80
 dated 2026-07-24 13:58:04 +0000
 by Jay Chung (jaehoc@amazon.com)

 Add Neoverse-V3 (0xd84) and Neoverse-V3AE (0xd83) to the Spectre
variant whitelist with the same profile as Neoverse-V1/V2 (affected by
Variant 1 only), per ARM's speculative processor vulnerability page.
Also add them to the SLS (CVE-2020-13844) speculative-core list,
consistent with V1/N2/V2.

Verified on AWS Graviton5 (Neoverse-V3, MIDR 0x410fd841): the kernel
reports all variants mitigated/not-affected, while the unpatched
checker false-flags Variant 3a (and Spectre v2 inside guests) because
0xd84 falls through to the unrecognized-CPU default.

Fixes #582

Signed-off-by: Jay Chung <jaehoc@amazon.com>
2026-07-25 07:50:12 +00:00
github-actions[bot] 1ce22924f3 update: fwdb from v350+i20260512+1cce to v351+i20260512+1cce, 9 microcode changes
built from commit 2bd3957480
 dated 2026-06-15 11:36:12 +0000
 by speed47 (218502+speed47@users.noreply.github.com)
2026-07-03 20:00:44 +00:00
github-actions[bot]andspeed47 1db12cd347 update: fwdb from v349+i20260512+1cce to v350+i20260512+1cce, 8 microcode changes (#578)
built from commit 44ba92635f
 dated 2026-06-03 14:07:02 +0200
 by github-actions[bot] (41898282+github-actions[bot]@users.noreply.github.com)

 Co-authored-by: speed47 <218502+speed47@users.noreply.github.com>
2026-06-03 12:08:36 +00:00
github-actions[bot] c107f2b2ea fix: arm64: collapse per-core CPU info lists to a single line (#576)
built from commit 7d9345a32f
 dated 2026-06-02 17:21:31 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Store the per-core implementer/part/arch/variant/revision lists
space-separated (no embedded newlines, which also cleans up JSON and
prometheus output) and dedup them for the human-readable display, so
homogeneous systems show e.g. "0x41" instead of repeating it per core.
2026-06-02 19:30:28 +02:00
Stéphane Lesimple c277a7a443 Merge remote-tracking branch 'origin/master' into source-build 2026-06-02 19:30:19 +02:00
Stéphane Lesimpleandfoo 26cf31b282 Merge source-build for v26.36.0601873 (#575)
* chore: add stalebot in dryrun

 built from commit afadf53f7f
 dated 2026-04-02 13:13:19 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge branch 'test' into source

 built from commit 952fe6a87f
 dated 2026-04-02 18:40:05 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge pull request #530 from speed47/test

 built from commit d3c0f1a24d
 dated 2026-04-02 16:49:41 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 chore: workflows revamp

* Merge pull request #532 from speed47/test

 built from commit 6fac2d8ff1
 dated 2026-04-02 21:32:39 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Retbleed / Downfall overhald / doc updates

* enh: add known fixed ucode versions for CVE-2023-23583 (Reptar) and CVE-2024-45332 (BPI)

 built from commit cccb3c0081
 dated 2026-04-04 17:50:04 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* fix: add rebleet to --variant

 built from commit 7a7408d124
 dated 2026-04-04 18:17:35 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge pull request #566 from speed47/test

 built from commit 3e2b6cc734
 dated 2026-04-20 11:02:38 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Prepare release v26.33.0420xxx

* Merge pull request #571 from speed47/test

 built from commit 0045d237fa
 dated 2026-06-01 20:44:44 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Prepare next release

* update: fwdb from v349+i20260227+615b to v349+i20260512+1cce, 19 microcode changes

 built from commit 645a79846b
 dated 2026-06-01 20:56:45 +0000
 by github-actions[bot] (41898282+github-actions[bot]@users.noreply.github.com)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-02 16:57:51 +00:00
github-actions[bot] 68116d87fd update: fwdb from v349+i20260227+615b to v349+i20260512+1cce, 19 microcode changes
built from commit 645a79846b
 dated 2026-06-01 20:56:45 +0000
 by github-actions[bot] (41898282+github-actions[bot]@users.noreply.github.com)
2026-06-01 20:58:15 +00:00
Stéphane Lesimple 3f4801e6a7 autoupdate workflow: add missing pkg 2026-06-01 20:55:08 +00:00
Stéphane Lesimple 9a3688b6fd chore: use scripts in autoupdate workflow (#572) 2026-06-01 20:52:54 +00:00
github-actions[bot] c060a2d2c9 Merge pull request #571 from speed47/test
built from commit 0045d237fa
 dated 2026-06-01 20:44:44 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Prepare next release
2026-06-01 20:46:12 +00:00
Stéphane Lesimple 0c89d162a3 chore: fix autoupdate workflow 2026-05-31 14:50:31 +02:00
林博仁 Buo-ren Lin 02fa416bab doc: readme: correct markdown indentation for unordered list items (#569)
Signed-off-by: 林博仁(Buo-ren Lin) <buo.ren.lin@gmail.com>
2026-04-20 16:02:47 +00:00
Stéphane Lesimple 1c067add59 release v26.33.0420460 (#567) 2026-04-20 15:18:11 +00:00
github-actions[bot] fe0d3f49f4 Merge pull request #566 from speed47/test
built from commit 3e2b6cc734
 dated 2026-04-20 11:02:38 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Prepare release v26.33.0420xxx
2026-04-20 11:04:05 +00:00
Stéphane Lesimple 00bb4a951c workflow: expose reconsider_age_days input + env var 2026-04-19 14:46:56 +02:00
Stéphane Lesimple 43d5b77885 chore: workflow: add manual model + window_hours inputs, add reconsider 2026-04-19 12:55:03 +02:00
Stéphane Lesimple 78a6e4a418 chore: move cron vuln-watch workflow script files to their own branch 2026-04-19 11:14:21 +02:00
Stéphane Lesimple 5af1a9fec9 chore: workflow: add scan id 2026-04-18 16:23:47 +02:00
Stéphane Lesimple b93027640f chore: vuln workflow: use opus, no persist creds, conditional upload 2026-04-18 16:19:10 +02:00
Stéphane Lesimple 5c27284119 chore: workflow: save logs 2026-04-18 16:05:15 +02:00
Stéphane Lesimple f2e5999fc0 chore: explicit prompt for workflow 2026-04-18 15:41:03 +02:00
Stéphane Lesimple 25f20b8860 chore: fix workflow perms (#558) 2026-04-18 15:29:54 +02:00
Stéphane Lesimple 77e3dbd6b2 add scheduled vuln research (#557) 2026-04-18 15:14:13 +02:00
Stéphane Lesimple 8a6f9d5d63 Implement ITS/VMScape/BTI and misc enhancements (#539)
7a7408d fix: add rebleet to --variant
cccb3c0 enh: add known fixed ucode versions for CVE-2023-23583 (Reptar) and CVE-2024-45332 (BPI)
090f109 doc: add CVE-2023-31315 (SinkClose) to the unsupported list, add categories
5dc9c3c chore: reorder CVE list in README.md
a00fab1 feat: implement CVE-2025-40300 (VMScape) and CVE-2024-45332 (BTI)
e0b818f chore: stalebot: disable dryrun by default
4af1155 feat: implement CVE-2024-28956 (ITS, Indirect Target Selection) vulnerability and mitigation detection
dfed6f3 doc: add note about more unsupported CVEs
1652977 add a generated version of src/libs/003_intel_models.sh
a089ae8 fix: sys_interface_check() must set the caller's $msg var (closes #533)
cc6bbaa chore: don't include src/ generated files in build
2717b0a doc: CVE-2020-12965 unsupported (#478)
2026-04-04 18:38:49 +02:00
Stéphane Lesimple 73b67b4a80 Merge branch 'master' into source-build 2026-04-04 16:25:35 +00:00
github-actions[bot] ea6b8efd18 fix: add rebleet to --variant
built from commit 7a7408d124
 dated 2026-04-04 18:17:35 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-04 16:23:18 +00:00
github-actions[bot] 24d92540a7 enh: add known fixed ucode versions for CVE-2023-23583 (Reptar) and CVE-2024-45332 (BPI)
built from commit cccb3c0081
 dated 2026-04-04 17:50:04 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-04 16:08:25 +00:00
Stéphane Lesimple f2d871acff fix: spurious local keyword broke sysfs based detection (#533) (#534)
The $msg var assigned in sys_interface_check() must not be
local to the func, but must capture and modify the callers'
own local $msg var
2026-04-03 01:31:58 +02:00
github-actions[bot] 553a9ec60f Merge pull request #532 from speed47/test
built from commit 6fac2d8ff1
 dated 2026-04-02 21:32:39 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 Retbleed / Downfall overhald / doc updates
2026-04-02 21:33:46 +00:00
Stéphane Lesimpleandfoo 83ebe2f75f chore: update workflows (#531)
* chore: add stalebot in dryrun

 built from commit afadf53f7f
 dated 2026-04-02 13:13:19 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge branch 'test' into source

 built from commit 952fe6a87f
 dated 2026-04-02 18:40:05 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

* Merge pull request #530 from speed47/test

 built from commit d3c0f1a24d
 dated 2026-04-02 16:49:41 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 chore: workflows revamp

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-02 18:53:44 +02:00
Stéphane Lesimple 75ad60f42a Merge branch 'master' into source-build 2026-04-02 16:53:03 +00:00
github-actions[bot] 931c955765 Merge pull request #530 from speed47/test
built from commit d3c0f1a24d
 dated 2026-04-02 16:49:41 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)

 chore: workflows revamp
2026-04-02 16:50:52 +00:00
github-actions[bot] c5ef0c488a Merge branch 'test' into source
built from commit 952fe6a87f
 dated 2026-04-02 18:40:05 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-02 16:41:33 +00:00
github-actions[bot] a05f8aab34 chore: add stalebot in dryrun
built from commit afadf53f7f
 dated 2026-04-02 13:13:19 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-02 11:34:30 +00:00
github-actions[bot] 99301d1cbb chore: add stalebot in dryrun
built from commit afadf53f7f
 dated 2026-04-02 13:13:19 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-02 13:33:36 +02:00
github-actions[bot] f9c3d19f72 enh: CVE-2017-5715; check for unprivileged eBPF for paranoid mode
built from commit e5c6d2d905
 dated 2026-04-01 20:37:54 +0000
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-01 21:30:51 +00:00
github-actions[bot] 8389d9593c chore: prepare for dev-build renaming to test-build
built from commit 9497abbee2723cedc561b6b785fe01fbe965ec1c
 dated 2026-03-31 19:34:52 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)
2026-04-01 21:30:51 +00:00
Stéphane Lesimple 3a822fdcf2 chore: master: remove obsolete workflow 2026-03-31 19:53:57 +02:00
+9 -8
View File
@@ -13,7 +13,7 @@
#
# Stephane Lesimple
#
VERSION='26.36.0730588'
VERSION='26.36.0808753'
# --- Common paths and basedirs ---
readonly VULN_SYSFS_BASE="/sys/devices/system/cpu/vulnerabilities"
@@ -1219,6 +1219,7 @@ is_cpu_affected() {
06-c5-02/82,0000011b
06-c6-02/82,0000011b
06-bd-01/80,00000125
06-55-07/bf,05003901
06-55-0b/bf,07002b01
06-8f-07/87,2b000661
06-8f-08/87,2b000661
@@ -1381,9 +1382,9 @@ is_cpu_affected() {
if [ -n "$cpupart" ] && [ -n "$cpuarch" ]; then
# Cortex-R7 and Cortex-R8 are real-time and only used in medical devices or such
# I can't find their CPU part number, but it's probably not that useful anyway
# model R7 R8 A8 A9 A12 A15 A17 A57 A72 A73 A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2
# part ? ? c08 c09 c0d c0f c0e d07 d08 d09 d0a d0b d0d d0c d40 d49 d4f
# arch 7? 7? 7 7 7 7 7 8 8 8 8 8 8 8 8 8 8
# model R7 R8 A8 A9 A12 A15 A17 A57 A72 A73 A75 A76 A77 Neoverse-N1 Neoverse-V1 Neoverse-N1 Neoverse-V2 Neoverse-V3 Neoverse-V3AE
# part ? ? c08 c09 c0d c0f c0e d07 d08 d09 d0a d0b d0d d0c d40 d49 d4f d84 d83
# arch 7? 7? 7 7 7 7 7 8 8 8 8 8 8 8 8 8 8 8 8
#
# Whitelist identified non-affected processors, use vulnerability information from
# https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
@@ -1434,13 +1435,13 @@ is_cpu_affected() {
_infer_immune variant3a
_set_vuln variant4
pr_debug "checking cpu$i: armv8 A76/A77/NeoverseN1 non affected to variant 2, 3 & 3a"
elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f; then
elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -q -w -e 0xd40 -e 0xd49 -e 0xd4f -e 0xd84 -e 0xd83; then
_set_vuln variant1
_infer_immune variant2
_infer_immune variant3
_infer_immune variant3a
_infer_immune variant4
pr_debug "checking cpu$i: armv8 NeoverseN2/V1/V2 non affected to variant 2, 3, 3a & 4"
pr_debug "checking cpu$i: armv8 NeoverseN2/V1/V2/V3/V3AE non affected to variant 2, 3, 3a & 4"
elif [ "$cpuarch" -le 7 ] || { [ "$cpuarch" = 8 ] && [ $((cpupart)) -lt $((0xd07)) ]; }; then
_infer_immune variant1
_infer_immune variant2
@@ -1501,14 +1502,14 @@ is_cpu_affected() {
# - arm64 (CVE-2020-13844): Cortex-A32/A34/A35/A53/A57/A72/A73 confirmed affected,
# and broadly all speculative Armv8-A cores. No kernel mitigation merged.
# Part numbers: A32=0xd01 A34=0xd02 A53=0xd03 A35=0xd04 A57=0xd07 A72=0xd08 A73=0xd09
# Plus later speculative cores: A75=0xd0a A76=0xd0b A77=0xd0d N1=0xd0c V1=0xd40 N2=0xd49 V2=0xd4f
# Plus later speculative cores: A75=0xd0a A76=0xd0b A77=0xd0d N1=0xd0c V1=0xd40 N2=0xd49 V2=0xd4f V3=0xd84 V3AE=0xd83
if is_intel || is_amd; then
_infer_vuln sls
elif [ "$cpu_vendor" = ARM ]; then
for cpupart in $cpu_part_list; do
if echo "$cpupart" | grep -q -w -e 0xd01 -e 0xd02 -e 0xd03 -e 0xd04 \
-e 0xd07 -e 0xd08 -e 0xd09 -e 0xd0a -e 0xd0b -e 0xd0c -e 0xd0d \
-e 0xd40 -e 0xd49 -e 0xd4f; then
-e 0xd40 -e 0xd49 -e 0xd4f -e 0xd84 -e 0xd83; then
_set_vuln sls
fi
done