search

speed47 / spectre-meltdown-checker

Reptar, Downfall, Zenbleed, ZombieLoad, RIDL, Fallout, Foreshadow, Spectre, Meltdown vulnerability/mitigation checker for Linux & BSD
3.88k stars 476 forks source link

Will it handle also SPOILER ? #273

Open xcom169 opened 5 years ago

xcom169 commented 5 years ago

Will it handle also SPOILER defect?

knweiss commented 5 years ago

Paper: SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks (pdf)

MarvinOl commented 5 years ago

Microsoft has released Windows 10 Insider Preview 18860.1001 that includes 16 new microcodes for Intel CPUs in mcupdate_GenuineIntel.dll as well as SPOILER workarounds in the Windows Kernel.

The new microcodes can be found in https://github.com/platomav/CPUMicrocodes and included to Linux for loading. For my CPU the register changes were: old microcode: eax in: 0x00000007, ... edx = 2c000000 new microcode: eax in: 0x00000007, ... edx = 2c000400

old microcode: IA32_ARCH_CAPS=0x19 new microcode: IA32_ARCH_CAPS=0x79

So at the moment Intel is setting both undocumented EDX and IA32_ARCH_CAPS bits for SPOILER fix.

speed47 commented 5 years ago

Those flags are interesting indeed, even if we have no official information yet that they are SPOILER-related. I'll probably add checks for them at least in a dev branch for the time being, thanks @MarvinOl !

MarvinOl commented 5 years ago

New details about the new exploits and fixes: https://access.redhat.com/security/vulnerabilities/mds https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv190013

speed47 commented 5 years ago

Yep. First detection version is already merged, I'm still currently refining it, master will be noisy tonight. Btw, it wasn't SPOILER after all.

speed47 commented 5 years ago

AFAICT, there is no SPOILER mitigation on OS or firmware level, as it's just a way to enhance a Rowhammer attack. So, there's no existing mitigation for the script to detect. Leaving this open for information only.