speed47 / spectre-meltdown-checker

Reptar, Downfall, Zenbleed, ZombieLoad, RIDL, Fallout, Foreshadow, Spectre, Meltdown vulnerability/mitigation checker for Linux & BSD
3.87k stars 476 forks source link

Bad execution on FreeBSD/powerpc64 #267

Open pkubaj opened 5 years ago

pkubaj commented 5 years ago

When running on FreeBSD on powerpc64 architecture (POWER9 CPU) I get:

root@talos:$~/spectre-meltdown-checker-master$ ./spectre-meltdown-checker.sh -v -v
Spectre and Meltdown mitigation detection tool v0.40

(debug) We're under BSD, check if we have procfs
(debug) we don't, try to mount it
(debug) attempted to load module cpuctl, kldload_cpuctl=
(debug) attempted to load module cpuctl, kldload_cpuctl=
printf: : expected numeric value
printf: : expected numeric value
printf: : expected numeric value
Checking for vulnerabilities on current system
Kernel is FreeBSD 12.0-RC3 FreeBSD 12.0-RC3 #0 r341271M: Fri Nov 30 01:57:28 CET 2018     toor@talos.anongoth.pl:/usr/obj/usr/src/powerpc.powerpc64/sys/GENERIC64  powerpc
CPU is IBM POWER9
Will use no kernel image (accuracy might be reduced)
(debug) no opt_kernel defined

Hardware check
* CPU vulnerability to the speculative execution attack variants
  * Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): (debug) is_cpu_vulnerable: temp results are <> <> <> <> <> <>
(debug) is_cpu_vulnerable: final results are <0> <0> <0> <0> <0> <0> <0>
 YES
  * Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES
  * Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  YES
  * Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read):  YES
  * Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass):  YES
  * Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  YES
  * Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  YES
  * Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  YES

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
> STATUS:  VULNERABLE  (no mitigation for BSD yet)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigation 1
  * Kernel supports IBRS:  NO
  * IBRS enabled and active:  NO
* Mitigation 2
  * Kernel compiled with RETPOLINE:  UNKNOWN  (couldn't check (couldn't find your kernel image in /boot, if you used netboot, this is normal))
> STATUS:  VULNERABLE  (IBRS is needed to mitigate the vulnerability but your kernel is missing support)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Kernel supports Page Table Isolation (PTI):  NO
  * PTI enabled and active:  NO
  * Reduced performance impact of PTI: (debug) attempted to load module cpuctl, kldload_cpuctl=
(debug) attempted to load module cpuctl, kldload_cpuctl=
 NO  (PCID/INVPCID not supported, performance impact of PTI will be significant)
> STATUS:  VULNERABLE  (PTI is needed to mitigate the vulnerability)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability:  NO
> STATUS:  VULNERABLE  (an up-to-date CPU microcode is needed to mitigate this vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Kernel supports speculation store bypass:  NO
* Speculation store bypass is administratively enabled: (debug) hw.spec_store_bypass_disable=
 NO  (unavailable)
* Speculation store bypass is currently active: (debug) hw.spec_store_bypass_disable_active=
 NO
> STATUS:  VULNERABLE  (Neither your CPU nor your kernel support SSBD)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability:  N/A
> STATUS:  VULNERABLE  (your CPU supports SGX and the microcode is not up to date)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Kernel reserved the memory page at physical address 0x0:  NO
> STATUS:  VULNERABLE  (your kernel needs to be updated)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Kernel supports L1D flushing:  NO
* L1D flushing is enabled:  NO
> STATUS:  VULNERABLE  (your kernel needs to be updated)

> SUMMARY: CVE-2017-5753:KO CVE-2017-5715:KO CVE-2017-5754:KO CVE-2018-3640:KO CVE-2018-3639:KO CVE-2018-3615:KO CVE-2018-3620:KO CVE-2018-3646:KO

We're missing some kernel info (see -v), accuracy might be reduced
(debug) variables at end of script: '|bad_accuracy=1|bsd_zero_reserved=0|clear_linux_kernel=/lib/kernel/org.clearlinux.0-RC3.12|cpu_cpuid=0|cpu_friendly_name='IBM POWER9'|cpu_ucode=0|cve=CVE-2018-3646|echo_cmd=/usr/bin/printf|echo_cmd_type=printf|final_summary=' CVE-2017-5753:KO CVE-2017-5715:KO CVE-2017-5754:KO CVE-2018-3640:KO CVE-2018-3639:KO CVE-2018-3615:KO CVE-2018-3620:KO CVE-2018-3646:KO'|global_critical=1|global_unknown=0|ibrs_active=''|ibrs_disabled=''|is_cpu_vulnerable_cached=1|kernel=''|kernel_err=$'couldn't find your kernel image in /boot, if you used netboot, this is normal'|kernel_l1d_enabled=''|kernel_l1d_supported=0|kernel_ssb=0|kpti_enabled=''|mcedb_cache=/root/.mcedb|mcedb_info='builtin MCExtractor DB v84 - 2018/09/27'|mcedb_source=./spectre-meltdown-checker.sh|msg=''|nrpe_vuln=''|opt=''|opt_arch_prefix=''|opt_batch=0|opt_batch_format=text|opt_config=''|opt_coreos=0|opt_cve_all=1|opt_cve_list=''|opt_explain=0|opt_hw_only=0|opt_kernel=''|opt_live=1|opt_live_explicit=0|opt_map=''|opt_no_color=0|opt_no_hw=0|opt_no_sysfs=0|opt_paranoid=0|opt_sysfs_only=0|opt_verbose=3|opt_vmm=-1|os=FreeBSD|parse_cpu_details_done=1|procfs=''|pvulnstatus_last_cve=CVE-2018-3646|read_cpuid_value=''|ret=2|ssb_active=''|ssb_enabled=''|status=UNK|str_uname=12.0-RC3|supported_cve_list='CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646'|sys_interface_available=0|ucode_found='model 0x0 family 0x0 stepping 0x0 ucode 0x0 cpuid 0x0'|variant1=0|variant2=0|variant3=0|variant3a=0|variant4=0|variantl1tf=0|variantl1tf_sgx=0|vulnstatus=VULN|
Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer

This output is completely wrong. POWER CPUs are vulnerable to variant , but variants 2, 3 and 4 were fixed in firmware (so no need for either Retpoline nor PTI). Variant 3a is only relevant for Intel CPUs, as are LT1F variants.

lilyanatia commented 5 years ago

the script currently doesn't recognize Power CPUs, and any unrecognized CPU is assumed to be vulnerable to all variants.

https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/ mentions patches (both firmware and OS) to mitigate L1TF on Power 9.

variant 3a is not only relevant for Intel CPUs. ARM's Cortex A15, A57, and A72 are affected by it, so assuming a CPU isn't vulnerable to 3a only because it's not Intel is not valid, especially when the CPU is known to be vulnerable to 1, 2, 3, 4, and L1TF.

regarding firmware mitigating the vulnerabilities, the readme does say:

other architectures will work, but mitigations (if they exist) might not always be detected