72 Commits
v0.21 ... v0.32

Author SHA1 Message Date
263ef65fec bump to v0.32 2018-01-20 12:49:12 +01:00
a1bd233c49 revert to a simpler check_vmlinux() 2018-01-20 12:26:26 +01:00
de6590cd09 cache is_cpu_vulnerable result for performance 2018-01-20 12:24:23 +01:00
56d4f82484 is_cpu_vulnerable: implement check for multi-arm systems 2018-01-20 12:24:23 +01:00
7fa2d6347b check_vmlinux: when readelf doesn't work, try harder with another way 2018-01-20 12:23:55 +01:00
3be5e90481 be smarter to find a usable echo command 2018-01-20 12:23:55 +01:00
995620a682 add pine64 vmlinuz location 2018-01-20 12:23:19 +01:00
193e0d8d08 arm: cosmetic fix for name and handle aarch64 2018-01-20 12:22:48 +01:00
72ef94ab3d ARM: display a friendly name instead of empty string 2018-01-20 12:22:48 +01:00
ccc0453df7 search in /lib/modules/$(uname -r) for vmlinuz, config, System.map
On Fedora machines /lib/modules/$(uname -r) has all the files.
2018-01-20 11:19:34 +01:00
14ca49a042 Atom N270: implement another variation 2018-01-19 18:47:38 +01:00
db357b8e25 CoreOS: remove ephemeral install of a non-used package 2018-01-18 10:17:25 +01:00
42a57dd980 add kern.log as another backend of dmesg output 2018-01-17 17:17:39 +01:00
5ab95f3656 fix(atom): don't use a pcre regex, only an extended one 2018-01-17 12:01:13 +01:00
5b6e39916d fix(atom): properly detect Nxxx Atom series 2018-01-17 11:07:47 +01:00
556951d5f0 Add Support for Slackware.
Signed-off-by: Willy Sudiarto Raharjo <willysr@gmail.com>
2018-01-16 11:55:03 +01:00
7a88aec95f Implement CoreOS compatibility mode (#84)
* Add special CoreOS compatibility mode
* CoreOS: refuse --coreos if we're not under CoreOS
* CoreOS: warn if launched without --coreos option
* is_coreos: make stderr silent
* CoreOS: tiny adjustments
2018-01-16 10:33:01 +01:00
bd18323d79 bump to v0.31 to reflect changes 2018-01-14 22:34:09 +01:00
b89d67dd15 meltdown: detecting Xen PV, reporting as not vulnerable 2018-01-14 22:31:21 +01:00
704e54019a is_cpu_vulnerable: add check for old Atoms 2018-01-14 21:32:56 +01:00
d96093171a verbose: add PCID check for performance impact of PTI 2018-01-14 17:18:34 +01:00
dcc4488340 Merge pull request #80 from speed47/cpuid_spec_ctrl
v0.30, cpuid spec ctrl and other enhancements
2018-01-14 16:48:02 +01:00
32e3fe6c07 bump to v0.30 to reflect changes 2018-01-14 16:45:59 +01:00
f488947d43 Merge pull request #79 from andir/add-nixos
add support for NixOS kernel
2018-01-14 16:40:10 +01:00
71213c11b3 ibrs: check for spec_ctrl_ibrs in cpuinfo 2018-01-14 16:36:51 +01:00
2964c4ab44 add support for NixOS kernel
this removes the need to specify the kernel version manually on NixOS
2018-01-14 16:18:29 +01:00
749f432d32 also check for spec_ctrl flag in cpuinfo 2018-01-14 15:47:51 +01:00
a422b53d7c also check for cpuinfo flag 2018-01-14 15:47:51 +01:00
c483a2cf60 check spec_ctrl support using cpuid 2018-01-14 15:47:51 +01:00
dead0054a4 fix: proper detail msg in vuln status 2018-01-14 15:47:22 +01:00
8ed7d465aa Merge pull request #77 from speed47/exitcode
proper return codes regardless of the batch mode
2018-01-14 14:25:12 +01:00
e5e4851d72 proper return codes regardless of the batch mode 2018-01-14 14:24:31 +01:00
7f92717a2c add info about accuracy when missing kernel files 2018-01-13 13:59:17 +01:00
b47d505689 AMD now vuln to variant2 (as per their stmt) 2018-01-13 13:35:31 +01:00
4a2d051285 minor is_cpu_vulnerable() changes (#71)
* correct is_cpu_vulnerable() comment

As far as I can tell, the function and usage are correct for the comment
to be inverted.

Add a clarifying note as to why the value choice makes sense.

* exit on invalid varient

If this happens, it's a bug in the script. None of the calling code
checks for status 255, so don't let a scripting bug cause a false
negative.

* no need to set vulnerable CPUs

According to comment above this code:
'by default, everything is vulnerable, we work in a "whitelist" logic here.'
2018-01-13 13:16:37 +01:00
f3551b9734 Only show the name of the script, not the full path (#72) 2018-01-13 13:14:19 +01:00
45b98e125f fix some typos (#73) 2018-01-13 13:13:40 +01:00
dce917bfbb add --version, bump to v0.28 2018-01-12 19:10:44 +01:00
8f18f53aba add cpu model in output 2018-01-12 19:08:12 +01:00
d3f102b3b3 Typofix in readme (#61) 2018-01-12 13:58:04 +01:00
8bd093173d Fixed a few spelling errors (#60) 2018-01-12 11:46:36 +01:00
bfe5a3b840 add some debug 2018-01-12 10:53:19 +01:00
6a0242eea3 bump to v0.27 2018-01-11 15:36:41 +01:00
bc4e39038a fix(opcodes): fix regression introduced in previous commit
We were saying unknown instead of vulnerable when the count of lfence opcodes was low
This was not impacting batch mode or the final decision, just the human-readable output of the script.
2018-01-11 15:35:57 +01:00
62f8ed6f61 adding support for new /sys interface (#55)
* adding support for new /sys interface
* fix(objdump): prefer -d instead of -D, some kernels crash objdump otherwise
2018-01-11 12:23:16 +01:00
56b67f8082 Typo in README (#54) 2018-01-11 12:01:31 +01:00
52a8f78885 send warning to stderr. (#53)
With --batch json there must not be any other output on stdout, so redirect warnings to stderr will show the warning on the console and only the json output is on stdout.
2018-01-11 09:55:43 +01:00
a09a5ba38f bump to v0.25 to reflect changes 2018-01-11 09:08:29 +01:00
5a7d8d7edf Produce JSON output formatted for Puppet, Ansible, Chef... (#50)
Produce JSON output formatted for Puppet, Ansible, Chef...
2018-01-11 09:04:13 +01:00
49fdc6c449 Merge pull request #51 from cowanml/file_read_check_fixup
fixed file read test
2018-01-10 21:39:09 +01:00
af3de2a862 fixed file read test 2018-01-10 15:17:14 -05:00
c6e1b0ac8a feat(kernel): add support for LZ4 decompression 2018-01-10 20:10:57 +01:00
b913dacc1b Merge pull request #48 from speed47/opensuse
fix(opensuse): add specific location for ibrs_enabled file
2018-01-10 18:41:30 +01:00
eb0ebef5a8 fix(opensuse): add specific location for ibrs_enabled file 2018-01-10 17:40:33 +01:00
e0254025e8 Merge pull request #47 from speed47/readme
update readme
2018-01-10 17:12:54 +01:00
bd010340e6 update readme 2018-01-10 17:12:33 +01:00
a658de2f01 fix(kernel): fix detection for separate /boot partitions 2018-01-10 16:27:16 +01:00
4aed5589fe Merge pull request #44 from speed47/bootimage
feat(kernel): check the BOOT_IMAGE info from cmdline before trying th…
2018-01-10 16:13:00 +01:00
8ed1f5e3af feat(kernel): check the BOOT_IMAGE info from cmdline before trying the default names 2018-01-10 15:46:29 +01:00
ffc542eb82 bump to v0.23 to reflect changes 2018-01-10 15:25:55 +01:00
74bc7ba637 add --variant to specify what check we want to run 2018-01-10 15:22:30 +01:00
5389ac6844 Merge pull request #41 from bang-communications/master
NRPE mode
2018-01-10 15:11:45 +01:00
36fb83215a Merge pull request #42 from simon-vasseur/style
added some style (screenshot in readme)
2018-01-10 15:07:34 +01:00
59fe8c2ad8 Error on unknown batch format 2018-01-10 13:57:10 +00:00
b8d28e7f61 added some style 2018-01-10 14:55:58 +01:00
7c11d07865 Stray tab 2018-01-10 11:59:33 +00:00
7c5cfbb8c3 batch nrpe 2018-01-10 11:57:45 +00:00
381038eceb NRPE mode 2018-01-10 11:18:45 +00:00
d6e4aa43f0 Merge pull request #37 from deufrai/better-dmesg-support
Improve PTI detection
2018-01-09 19:52:45 +01:00
e5e09384f0 typofix 2018-01-09 18:54:35 +01:00
a7b14306d5 Improve PTI detection even more
when PTI detection relies on dmesg, dmesg output is checked first
then /var/log/dmesg if dmesg output lacks boot time messages
2018-01-09 18:26:32 +01:00
608952ff71 Improve PTI detection
In case of a busy or misconfigured server, kernel message buffer loop
can be filled with messages broadcasted later than boot time. So dmesg
command wont return boot time messages.

Grepping /var/log/dmesg fixes it and this log file location semms pretty
standard across many common distros
2018-01-09 18:17:39 +01:00
2 changed files with 891 additions and 412 deletions

View File

@ -1,13 +1,17 @@
Spectre & Meltdown Checker Spectre & Meltdown Checker
========================== ==========================
A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs. A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Without options, it'll inspect you currently running kernel. Without options, it'll inspect your currently running kernel.
You can also specify a kernel image on the command line, if you'd like to inspect a kernel you're not running. You can also specify a kernel image on the command line, if you'd like to inspect a kernel you're not running.
The script will do its best to detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number. The script will do its best to detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number.
## Example of script output
![checker](https://framapic.org/6O4v4AAwMenv/M6J4CFWwsB3z.png)
## Quick summary of the CVEs ## Quick summary of the CVEs
**CVE-2017-5753** bounds check bypass (Spectre Variant 1) **CVE-2017-5753** bounds check bypass (Spectre Variant 1)
@ -29,68 +33,13 @@ The script will do its best to detect mitigations, including backported non-vani
- Mitigation: updated kernel (with PTI/KPTI patches), updating the kernel is enough - Mitigation: updated kernel (with PTI/KPTI patches), updating the kernel is enough
- Performance impact of the mitigation: low to medium - Performance impact of the mitigation: low to medium
## Example of script output ## Disclaimer
### Ubuntu LTS (before official patches) This tool does its best to determine whether your system is immune (or has proper mitigations in place) for the collectively named "speculative execution" vulnerabilities. It doesn't attempt to run any kind of exploit, and can't guarantee that your system is secure, but rather helps you verifying whether your system has the known correct mitigations in place.
However, some mitigations could also exist in your kernel that this script doesn't know (yet) how to detect, or it might falsely detect mitigations that in the end don't work as expected (for example, on backported or modified kernels).
``` Your system exposure also depends on your CPU. As of now, AMD and ARM processors are marked as immune to some or all of these vulnerabilities (except some specific ARM models). All Intel processors manufactured since circa 1995 are thought to be vulnerable. Whatever processor one uses, one might seek more information from the manufacturer of that processor and/or of the device in which it runs.
$ sudo ./spectre-and-meltdown.sh
Spectre and Meltdown mitigation detection tool v0.16
Checking for vulnerabilities against live running kernel Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 The nature of the discovered vulnerabilities being quite new, the landscape of vulnerable processors can be expected to change over time, which is why this script makes the assumption that all CPUs are vulnerable, except if the manufacturer explicitly stated otherwise in a verifiable public announcement.
Will use vmlinux image /boot/vmlinuz-4.4.0-104-generic
Will use kconfig /boot/config-4.4.0-104-generic
Will use System.map file /boot/System.map-4.4.0-104-generic
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' This tool has been released in the hope that it'll be useful, but don't use it to jump to conclusions about your security.
* Kernel compiled with LFENCE opcode inserted at the proper places: NO (only 38 opcodes found, should be >= 70)
> STATUS: VULNERABLE
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
* Hardware (CPU microcode) support for mitigation: NO
* Kernel support for IBRS: NO
* IBRS enabled for Kernel space: NO
* IBRS enabled for User space: NO
* Mitigation 2
* Kernel compiled with retpoline option: NO
* Kernel compiled with a retpoline-aware compiler: NO
> STATUS: VULNERABLE (IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI): NO
* PTI enabled and active: NO
> STATUS: VULNERABLE (PTI is needed to mitigate the vulnerability)
```
### First patched kernel of RHEL6
```
$ sudo ./spectre-meltdown-checker.sh --kernel /tmp/vmlinuz-2.6.32-696.18.7.el6.x86_64 --config /tmp/config-2.6.32-696.18.7.el6.x86_64 --map /tmp/System.map-2.6.32-696.18.7.el6.x86_64
Spectre and Meltdown mitigation detection tool v0.16
Checking for vulnerabilities against specified kernel
Will use vmlinux image /tmp/vmlinuz-2.6.32-696.18.7.el6.x86_64
Will use kconfig /tmp/config-2.6.32-696.18.7.el6.x86_64
Will use System.map file /tmp/System.map-2.6.32-696.18.7.el6.x86_64
CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Kernel compiled with LFENCE opcode inserted at the proper places: YES (84 opcodes found, which is >= 70)
> STATUS: NOT VULNERABLE
CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigation 1
* Hardware (CPU microcode) support for mitigation: NO
* Kernel support for IBRS: YES
* IBRS enabled for Kernel space: N/A (not testable in offline mode)
* IBRS enabled for User space: N/A (not testable in offline mode)
* Mitigation 2
* Kernel compiled with retpoline option: NO
* Kernel compiled with a retpoline-aware compiler: NO
> STATUS: NOT VULNERABLE (offline mode: IBRS will mitigate the vulnerability if enabled at runtime)
CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: N/A (can't verify if PTI is enabled in offline mode)
> STATUS: NOT VULNERABLE (offline mode: PTI will mitigate the vulnerability if enabled at runtime)
```

File diff suppressed because it is too large Load Diff