44 Commits
v0.36 ... v0.37

Author SHA1 Message Date
edebe4dcd4 bump to v0.37 2018-04-18 23:51:45 +02:00
83ea78f523 fix: arm: also detect variant 1 mitigation when using native objdump 2018-04-17 18:50:32 +02:00
602b68d493 fix(spectrev2): explain that retpoline is possible for Skylake+ if there is RSB filling, even if IBRS is still better 2018-04-16 09:27:28 +02:00
97bccaa0d7 feat: rephrase IBPB warning when only retpoline is enabled in non-paranoid mode 2018-04-16 09:13:25 +02:00
68e619b0d3 feat: show RSB filling capability for non-Skylake in verbose mode 2018-04-16 09:08:25 +02:00
a6f4475cee feat: make IBRS_FW blue instead of green 2018-04-16 09:07:54 +02:00
223f5028df feat: add --paranoid to choose whether we require IBPB 2018-04-15 23:05:30 +02:00
c0108b9690 fix(spectre2): don't explain how to fix when NOT VULNERABLE 2018-04-15 20:55:55 +02:00
a3016134bd feat: make RSB filling support mandatory for Skylake+ CPUs 2018-04-15 20:55:31 +02:00
59d85b39c9 feat: detect RSB filling capability in the kernel 2018-04-15 20:55:01 +02:00
baaefb0c31 fix: remove shellcheck warnings 2018-04-11 22:24:03 +02:00
d452aca03a fix: invalid bash syntax when ibpb_enabled or ibrs_enabled are empty 2018-04-11 10:29:42 +02:00
10b8d94724 feat: detect latest Red Hat kernels' RO ibpb_enabled knob 2018-04-10 22:51:45 +02:00
8606e60ef7 refactor: no longer display the retoline-aware compiler test when we can't tell for sure 2018-04-10 22:51:45 +02:00
6a48251647 fix: regression in 51aeae25, when retpoline & ibpb are enabled 2018-04-10 22:51:45 +02:00
f4bf5e95ec fix: typos 2018-04-10 22:51:45 +02:00
60eac1ad43 feat: also do PTI performance check with (inv)pcid for BSD 2018-04-10 22:51:45 +02:00
b3cc06a6ad fix regression introduced by 82c25dc 2018-04-10 22:51:45 +02:00
5553576e31 feat(amd/zen): re-introduce IBRS for AMD except ZEN family 2018-04-10 22:51:45 +02:00
e16ad802da feat(ibpb=2): add detection of SMT before concluding the system is not vulnerable 2018-04-10 22:51:45 +02:00
29c294edff feat(bsd): explain how to mitigate variant2 2018-04-10 22:51:45 +02:00
59714011db refactor: IBRS_ALL & RDCL_NO are Intel-only 2018-04-10 22:51:45 +02:00
51e8261a32 refactor: separate hw checks for Intel & AMD 2018-04-10 22:49:28 +02:00
2a4bfad835 refactor: add is_amd and is_intel funcs 2018-04-10 22:49:28 +02:00
7e52cea66e feat(spectre2): refined how status of this vuln is decided and more precise explanations on how to fix 2018-04-10 22:49:28 +02:00
417d7aab91 Fix trailing whitespace and mixed indent styles; 2018-04-10 22:42:47 +02:00
67bf761029 Fix some user facing typos with codespell -w -q3 . 2018-04-08 18:44:13 +02:00
0eabd266ad refactor: decrease default verbosity for some tests 2018-04-05 22:20:16 +02:00
b77fb0f226 fix: don't override ibrs/ibpb results with later tests 2018-04-05 22:04:20 +02:00
89c2e0fb21 fix(amd): show cpuinfo and ucode details 2018-04-05 21:39:27 +02:00
b88f32ed95 feat: print raw cpuid, and fetch ucode version under BSD 2018-04-05 00:07:12 +02:00
7a4ebe8009 refactor: rewrite read_cpuid to get more common code parts between BSD and Linux 2018-04-05 00:06:24 +02:00
0919f5c236 feat: add explanations of what to do when a vulnerability is not mitigated 2018-04-05 00:03:04 +02:00
de02dad909 feat: rework Spectre V2 mitigations detection w/ latest vanilla & Red Hat 7 kernels 2018-04-05 00:01:54 +02:00
07484d0ea7 add dump of variables at end of script in debug mode 2018-04-04 23:58:15 +02:00
a8b557b9e2 fix(cpu): skip CPU checks if asked to (--no-hw) or if inspecting a kernel of another architecture 2018-04-03 19:36:28 +02:00
619b2749d8 fix(sysfs): only check for sysfs for spectre2 when in live mode 2018-04-03 19:32:36 +02:00
94857c983d update readme 2018-04-03 16:00:36 +02:00
056ed00baa feat(arm): detect spectre variant 1 mitigation 2018-04-03 15:52:25 +02:00
aef99d20f3 fix(pti): when PTI activation is unknown, don't say we're vulnerable 2018-04-03 12:45:17 +02:00
e2d7ed2243 feat(arm): support for variant2 and meltdown mitigation detection 2018-04-01 17:50:18 +02:00
eeaeff8ec3 set version to v0.36+ for master branch between releases 2018-04-01 17:45:01 +02:00
f5269a362a feat(bsd): add retpoline detection for BSD 2018-04-01 17:42:29 +02:00
f3883a37a0 fix(xen): adjust message for DomUs w/ sysfs 2018-03-31 13:44:04 +02:00
2 changed files with 913 additions and 437 deletions

View File

@ -3,11 +3,15 @@ Spectre & Meltdown Checker
A shell script to tell if your system is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Supported systems:
- Linux (all versions and flavors)
- FreeBSD
- NetBSD
- DragonFlyBSD
Supported operating systems:
- Linux (all versions, flavors and distros)
- BSD (FreeBSD, NetBSD, DragonFlyBSD)
Supported architectures:
- x86 (32 bits)
- amd64/x86_64 (64 bits)
- ARM and ARM64
- other architectures will work, but mitigations (if they exist) might not always be detected
For Linux systems, the script will detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number and the distribution (such as Debian, Ubuntu, CentOS, RHEL, Fedora, openSUSE, Arch, ...), it also works if you've compiled your own kernel.
@ -79,6 +83,6 @@ Your system exposure also depends on your CPU. As of now, AMD and ARM processors
The nature of the discovered vulnerabilities being quite new, the landscape of vulnerable processors can be expected to change over time, which is why this script makes the assumption that all CPUs are vulnerable, except if the manufacturer explicitly stated otherwise in a verifiable public announcement.
Please also note that for Spectre vulnerabilities, all software can possibly be exploited, this tool only verifies that the kernel (which is the core of the system) you're using has the proper protections in place. Verifying all the other software is out of the scope of this tool. As a general measure, ensure you always have the most up to date stable versions of all the softwares you use, especially for those who are exposed to the world, such as network daemons and browsers.
Please also note that for Spectre vulnerabilities, all software can possibly be exploited, this tool only verifies that the kernel (which is the core of the system) you're using has the proper protections in place. Verifying all the other software is out of the scope of this tool. As a general measure, ensure you always have the most up to date stable versions of all the software you use, especially for those who are exposed to the world, such as network daemons and browsers.
This tool has been released in the hope that it'll be useful, but don't use it to jump to conclusions about your security.

File diff suppressed because it is too large Load Diff