meltdown-exploit
meltdown-exploit copied to clipboard
paboldin
Vulnerable CPU/kernels list
It will be hard to merge all the vulnerable CPUs into README.md. Please, report them here instead.
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 158
model name : Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz
stepping : 9
microcode : 0x5e
cpu MHz : 3685.083
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 94
model name : Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz
stepping : 3
microcode : 0x7c
cpu MHz : 3975.078
cache size : 8192 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 42
model name : Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
stepping : 7
microcode : 0x29
cpu MHz : 802.697
cache size : 3072 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 79
model name : Intel(R) Xeon(R) CPU E5-2650 v4 @ 2.20GHz
stepping : 1
microcode : 0x1
cpu MHz : 2199.998
cache size : 30720 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 69
model name : Intel(R) Core(TM) i3-4010U CPU @ 1.70GHz
stepping : 1
microcode : 0x16
cpu MHz : 800.062
cache size : 3072 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 58
model name : Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
stepping : 9
microcode : 0x1c
cpu MHz : 2593.898
cache size : 3072 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
stepping : 10
microcode : 0xa07
cpu MHz : 2933.000
cache size : 3072 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
stepping : 10
microcode : 0xa0c
cpu MHz : 2667.000
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Core(TM)2 Duo CPU E8600 @ 3.33GHz
stepping : 10
microcode : 0xa0b
cpu MHz : 2667.000
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 37
model name : Intel(R) Core(TM) i7 CPU M 620 @ 2.67GHz
stepping : 5
microcode : 0x4
cpu MHz : 2667.000
cache size : 4096 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 58
model name : Intel(R) Core(TM) i3-3110M CPU @ 2.40GHz
stepping : 9
microcode : 0x15
cpu MHz : 1200.000
cache size : 3072 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 58
model name : Intel(R) Core(TM) i7-3632QM CPU @ 2.20GHz
stepping : 9
microcode : 0x15
cpu MHz : 2700.183
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 94
model name : Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
stepping : 3
microcode : 0xba
cpu MHz : 3402.355
cache size : 8192 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Xeon(R) CPU X3323 @ 2.50GHz
stepping : 10
microcode : 0xa0b
cpu MHz : 2000.000
cache size : 3072 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Xeon(R) CPU X3363 @ 2.83GHz
stepping : 10
microcode : 0xa0c
cpu MHz : 2826.111
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 45
model name : Intel(R) Xeon(R) CPU E5-2660 v2 @ 2.20GHz
stepping : 2
microcode : 0x428
cpu MHz : 2200.000
cache size : 25600 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 63
model name : Intel(R) Xeon(R) CPU E5-2650 v3 @ 2.30GHz
stepping : 2
microcode : 0x31
cpu MHz : 2299.998
cache size : 25600 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 63
model name : Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz
stepping : 2
microcode : 0x39
cpu MHz : 2501.000
cache size : 30720 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 78
model name : Intel(R) Core(TM) i7-6500U CPU @ 2.50GHz
stepping : 3
microcode : 0x88
cpu MHz : 1699.902
cache size : 4096 KB
physical id : 0
processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 42 model name : Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz stepping : 7 cpu MHz : 2294.949 cache size : 3072 KB physical id : 0 siblings : 1
processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 22 model name : Intel(R) Celeron(R) CPU 220 @ 1.20GHz stepping : 1 microcode : 0x36 cpu MHz : 1200.046 cache size : 512 KB physical id : 0
As expected. Unpatched CentOS ran under Xen hypervisor.
3.10.0-693.11.1.el7.x86_64 #1 SMP Mon Dec 4 23:52:40 UTC 2017 x86_64
processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 44 model name : Intel(R) Xeon(R) CPU X5650 @ 2.67GHz stepping : 2 microcode : 0x1a cpu MHz : 2659.858 cache size : 12288 KB physical id : 0
4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u5 (2017-09-19) unknown
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 69
model name : Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
stepping : 1
microcode : 0x20
cpu MHz : 2300.140
cache size : 3072 KB
physical id : 0
4.13.0-21-generic #24-Ubuntu SMP Mon Dec 18 17:29:16 UTC 2017 x86_64 processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 58 model name : Intel(R) Celeron(R) CPU G1620 @ 2.70GHz stepping : 9 microcode : 0x15 cpu MHz : 2694.052 cache size : 2048 KB physical id : 0
4.14.8-1-ARCH #1 SMP PREEMPT Wed Dec 20 21:27:44 UTC 2017 unknown
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 142
model name : Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz
stepping : 10
microcode : 0x70
cpu MHz : 2000.000
cache size : 8192 KB
physical id : 0
VULNERABLE VULNERABLE ON 3.13.0-108-generic #155-Ubuntu SMP Wed Jan 11 16:58:52 UTC 2017 x86_64 processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 58 model name : Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz stepping : 9 microcode : 0x19 cpu MHz : 2594.228 cache size : 3072 KB physical id : 0
VULNERABLE VULNERABLE ON 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 142 model name : Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz stepping : 9 microcode : 0x5e cpu MHz : 2569.007 cache size : 3072 KB physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 60
model name : Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz
stepping : 3
microcode : 0x22
cpu MHz : 3764.687
cache size : 8192 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 79
model name : Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz
stepping : 1
microcode : 0xb000021
cpu MHz : 1251.468
cache size : 20480 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 79
model name : Intel(R) Xeon(R) CPU E5-2683 v4 @ 2.10GHz
stepping : 1
microcode : 0xb00001f
cpu MHz : 1200.035
cache size : 40960 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 87
model name : Intel(R) Xeon Phi(TM) CPU 7250 @ 1.40GHz
stepping : 1
microcode : 0x1a3
cpu MHz : 1500.296
cache size : 1024 KB
physical id : 0
4.9.73-vega #1 SMP Mon Jan 1 21:55:06 CET 2018 unknown
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 94
model name : Intel(R) Xeon(R) CPU E3-1230 v5 @ 3.40GHz
stepping : 3
microcode : 0xba
cpu MHz : 3791.796
cache size : 8192 KB
physical id : 0
3.16.0-4-amd64 #1 SMP Debian 3.16.51-2 (2017-12-03) unknown
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 26
model name : Intel(R) Xeon(R) CPU W3530 @ 2.80GHz
stepping : 5
microcode : 0x11
cpu MHz : 1600.000
cache size : 8192 KB
physical id : 0
4.14.10-1-ARCH #1 SMP PREEMPT Fri Dec 29 20:17:35 UTC 2017 unknown
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 61
model name : Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
stepping : 4
microcode : 0x25
cpu MHz : 2194.893
cache size : 3072 KB
physical id : 0
looking for linux_proc_banner in /proc/kallsyms
awk: line 7: function strtonum never defined
protected. requires root
+ find_linux_proc_banner /proc/kallsyms sudo
+ sudo awk
/linux_proc_banner/ {
if (strtonum("0x"$1))
print $1;
exit 0;
} /proc/kallsyms
awk: line 7: function strtonum never defined
+ linux_proc_banner=
+ set +x
not found. reading /boot/System.map-3.13.0-43-generic
+ uname -r
+ find_linux_proc_banner /boot/System.map-3.13.0-43-generic sudo
+ sudo awk
/linux_proc_banner/ {
if (strtonum("0x"$1))
print $1;
exit 0;
} /boot/System.map-3.13.0-43-generic
awk: line 7: function strtonum never defined
+ linux_proc_banner=
+ set +x
./meltdown: [hexaddr] [size]
VULNERABLE ON
3.13.0-43-generic #72-Ubuntu SMP Mon Dec 8 19:35:06 UTC 2014 x86_64
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 60
model name : Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
stepping : 3
cpu MHz : 2394.420
cache size : 6144 KB
physical id : 0
siblings : 3
(inside VM)
Problem with strtonum() awk func
@mtfelian it probably has mawk installed, while run.sh needs GNU awk (gawk). Also can just ./meltdown <addr> 10 with <addr> from grep linux_proc_banner /proc/kallsyms.
4.13.0-21-generic #24-Ubuntu SMP Mon Dec 18 17:29:16 UTC 2017 x86_64
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 94
model name : Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
stepping : 3
microcode : 0xffffffff
cpu MHz : 2591.998
cache size : 6144 KB
physical id : 0
vendor_id : GenuineIntel
cpu family : 6
model : 63
model name : Intel(R) Xeon(R) CPU E5-2630 v3 @ 2.40GHz
stepping : 2
microcode : 0x36
cpu MHz : 2400.011
cache size : 20480 KB
physical id : 0
vendor_id : GenuineIntel
cpu family : 6
model : 30
model name : Intel(R) Core(TM) i7 CPU 870 @ 2.93GHz
stepping : 5
microcode : 0x7
cpu MHz : 2976.634
cache size : 8192 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 60
model name : Intel(R) Core(TM) i7-4710HQ CPU @ 2.50GHz
stepping : 3
microcode : 0x1c
cpu MHz : 2494.043
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz
stepping : 6
microcode : 0x60c
cpu MHz : 1600.000
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 61
model name : Intel(R) Core(TM) i7-5600U CPU @ 2.60GHz
stepping : 4
microcode : 0x23
cpu MHz : 3100.195
cache size : 4096 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 30
model name : Intel(R) Core(TM) i5 CPU 760 @ 2.80GHz
stepping : 5
microcode : 0x4
cpu MHz : 1197.000
cache size : 8192 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 42
model name : Intel(R) Core(TM) i5-2520M CPU @ 2.50GHz
stepping : 7
microcode : 0x18
cpu MHz : 2859.344
cache size : 3072 KB
physical id : 0
@alexat i think that's a bug of the code, 'cause he could not open the files and yet returns true
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 23
model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz
stepping : 10
microcode : 0xa07
cpu MHz : 1995.190
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 60
model name : Intel(R) Core(TM) i5-4440 CPU @ 3.10GHz
stepping : 3
microcode : 0x19
cpu MHz : 3093.135
cache size : 6144 KB
physical id : 0
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 142
model name : Intel(R) Core(TM) i3-7100U CPU @ 2.40GHz
stepping : 9
microcode : 0x62
cpu MHz : 2400.000
cache size : 3072 KB
physical id : 0
looking for linux_proc_banner in /proc/kallsyms
cached = 82, uncached = 474, threshold 197
read ffffffff81800080 = 25 %
read ffffffff81800081 = 73 s
read ffffffff81800082 = 20
read ffffffff81800083 = 76 v
read ffffffff81800084 = 65 e
read ffffffff81800085 = 72 r
read ffffffff81800086 = 73 s
read ffffffff81800087 = 69 i
read ffffffff81800088 = 6f o
read ffffffff81800089 = 6e n
read ffffffff8180008a = 20
read ffffffff8180008b = 25 %
read ffffffff8180008c = 73 s
read ffffffff8180008d = 20
read ffffffff8180008e = 28 (
read ffffffff8180008f = 69 i
VULNERABLE
VULNERABLE ON
4.4.105-server-1.mga5 #1 SMP Sat Dec 9 20:32:21 UTC 2017 x86_64
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 60
model name : Intel(R) Xeon(R) CPU E3-1220 v3 @ 3.10GHz
stepping : 3
microcode : 0x17
cpu MHz : 3092.579
cache size : 8192 KB
physical id : 0
cassiano@cassiano:~/Temp/meltdown-exploit$ ./run.sh
looking for linux_proc_banner in /proc/kallsyms
cached = 46, uncached = 199, threshold 95
read ffffffffaca00060 = 25 %
read ffffffffaca00061 = 73 s
read ffffffffaca00062 = 20
read ffffffffaca00063 = 76 v
read ffffffffaca00064 = 65 e
read ffffffffaca00065 = 72 r
read ffffffffaca00066 = 73 s
read ffffffffaca00067 = 69 i
read ffffffffaca00068 = 6f o
read ffffffffaca00069 = 6e n
read ffffffffaca0006a = 20
read ffffffffaca0006b = 25 %
read ffffffffaca0006c = 73 s
read ffffffffaca0006d = 20
read ffffffffaca0006e = 28 (
read ffffffffaca0006f = 64 d
VULNERABLE
VULNERABLE ON
4.9.0-4-amd64 #1 SMP Debian 4.9.65-3+deb9u1 (2017-12-23) unknown
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 42
model name : Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz
stepping : 7
microcode : 0x28
cpu MHz : 2900.085
cache size : 3072 KB
physical id : 0
