NoPaste

spectre-meltdown-checker.sh

von willy4711

Dein Code:
  1. root@debianxfce:/home/willy/Downloads/spectre-meltdown-checker-master# ./spectre-meltdown-checker.sh
  2. Spectre and Meltdown mitigation detection tool v0.40
  3.  
  4. Checking for vulnerabilities on current system
  5. Kernel is Linux 4.18.0-2-amd64 #1 SMP Debian 4.18.10-2 (2018-11-02) x86_64
  6. CPU is AMD FX(tm)-6300 Six-Core Processor
  7.  
  8. Hardware check
  9. * Hardware support (CPU microcode) for mitigation techniques
  10.   * Indirect Branch Restricted Speculation (IBRS)
  11.     * SPEC_CTRL MSR is available:  NO
  12.     * CPU indicates IBRS capability:  NO
  13.     * CPU indicates preferring IBRS always-on:  NO
  14.     * CPU indicates preferring IBRS over retpoline:  NO
  15.   * Indirect Branch Prediction Barrier (IBPB)
  16.     * PRED_CMD MSR is available:  YES
  17.     * CPU indicates IBPB capability:  YES  (IBPB_SUPPORT feature bit)
  18.   * Single Thread Indirect Branch Predictors (STIBP)
  19.     * SPEC_CTRL MSR is available:  NO
  20.     * CPU indicates STIBP capability:  NO
  21.     * CPU indicates preferring STIBP always-on:  NO
  22.   * Speculative Store Bypass Disable (SSBD)
  23.     * CPU indicates SSBD capability:  YES  (AMD non-architectural MSR)
  24.   * L1 data cache invalidation
  25.     * FLUSH_CMD MSR is available:  NO
  26.     * CPU indicates L1D flush capability:  NO
  27.   * CPU supports Software Guard Extensions (SGX):  NO
  28.   * CPU microcode is known to cause stability problems:  NO  (model 0x2 family 0x15 stepping 0x0 ucode 0x6000852 cpuid 0x600f20)
  29.   * CPU microcode is the latest known available version:  YES  (latest version is 0x6000852 dated 2018/02/06 according to builtin MCExtractor DB v84 - 2018/09/27)
  30. * CPU vulnerability to the speculative execution attack variants
  31.   * Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass):  YES
  32.   * Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES
  33.   * Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  NO
  34.   * Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read):  NO
  35.   * Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass):  YES
  36.   * Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  NO
  37.   * Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  NO
  38.   * Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  NO
  39.  
  40. CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
  41. * Mitigated according to the /sys interface:  YES  (Mitigation: __user pointer sanitization)
  42. * Kernel has array_index_mask_nospec:  YES  (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
  43. * Kernel has the Red Hat/Ubuntu patch:  NO
  44. * Kernel has mask_nospec64 (arm64):  NO
  45. > STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)
  46.  
  47. CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
  48. * Mitigated according to the /sys interface:  YES  (Mitigation: Full AMD retpoline, IBPB)
  49. * Mitigation 1
  50.   * Kernel is compiled with IBRS support:  YES
  51.     * IBRS enabled and active:  NO
  52.   * Kernel is compiled with IBPB support:  YES
  53.     * IBPB enabled and active:  YES
  54. * Mitigation 2
  55.   * Kernel has branch predictor hardening (arm):  NO
  56.   * Kernel compiled with retpoline option:  YES
  57.     * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
  58. > STATUS:  NOT VULNERABLE  (Full retpoline + IBPB are mitigating the vulnerability)
  59.  
  60. CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
  61. * Mitigated according to the /sys interface:  YES  (Not affected)
  62. * Kernel supports Page Table Isolation (PTI):  YES
  63.   * PTI enabled and active:  NO
  64.   * Reduced performance impact of PTI:  NO  (PCID/INVPCID not supported, performance impact of PTI will be significant)
  65. * Running as a Xen PV DomU:  NO
  66. > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not vulnerable)
  67.  
  68. CVE-2018-3640 aka 'Variant 3a, rogue system register read'
  69. * CPU microcode mitigates the vulnerability:  YES
  70. > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not vulnerable)
  71.  
  72. CVE-2018-3639 aka 'Variant 4, speculative store bypass'
  73. * Mitigated according to the /sys interface:  YES  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
  74. * Kernel supports speculation store bypass:  YES  (found in /proc/self/status)
  75. > STATUS:  NOT VULNERABLE  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
  76.  
  77. CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
  78. * CPU microcode mitigates the vulnerability:  N/A
  79. > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not vulnerable)
  80.  
  81. CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
  82. * Mitigated according to the /sys interface:  YES  (Not affected)
  83. * Kernel supports PTE inversion:  YES  (found in kernel image)
  84. * PTE inversion enabled and active:  NO
  85. > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not vulnerable)
  86.  
  87. CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
  88. * Information from the /sys interface:
  89. * This system is a host running an hypervisor:  YES
  90. * Mitigation 1 (KVM)
  91.   * EPT is disabled:  N/A  (the kvm_intel module is not loaded)
  92. * Mitigation 2
  93.   * L1D flush is supported by kernel:  YES  (found flush_l1d in kernel image)
  94.   * L1D flush enabled:  UNKNOWN  (unrecognized mode)
  95.   * Hardware-backed L1D flush supported:  NO  (flush will be done in software, this is slower)
  96.   * Hyper-Threading (SMT) is enabled:  YES
  97. > STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not vulnerable)
  98.  
  99. > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK
  100.  
  101. Need more detailed information about mitigation options? Use --explain
  102. A false sense of security is worse than no security at all, see --disclaimer
  103. root@debianxfce:/home/willy/Downloads/spectre-meltdown-checker-master#

Quellcode

Hier kannst du den Code kopieren und ihn in deinen bevorzugten Editor einfügen. Alternativ kannst du den gesamten Eintrag auch als Datei herunterladen.