spectre-meltdown-checker icon indicating copy to clipboard operation
spectre-meltdown-checker copied to clipboard

Published 20 hours ago • verified publisher icon speed47

Will it handle also SPOILER ?

Open xcom169 opened this issue 5 years ago • 6 comments

Will it handle also SPOILER defect?

xcom169 avatar Mar 06 '19 07:03 xcom169

Paper: SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks (pdf)

knweiss avatar Mar 06 '19 08:03 knweiss

Microsoft has released Windows 10 Insider Preview 18860.1001 that includes 16 new microcodes for Intel CPUs in mcupdate_GenuineIntel.dll as well as SPOILER workarounds in the Windows Kernel.

The new microcodes can be found in https://github.com/platomav/CPUMicrocodes and included to Linux for loading. For my CPU the register changes were: old microcode: eax in: 0x00000007, ... edx = 2c000000 new microcode: eax in: 0x00000007, ... edx = 2c000400

old microcode: IA32_ARCH_CAPS=0x19 new microcode: IA32_ARCH_CAPS=0x79

So at the moment Intel is setting both undocumented EDX and IA32_ARCH_CAPS bits for SPOILER fix.

MarvinOl avatar Mar 27 '19 20:03 MarvinOl

Those flags are interesting indeed, even if we have no official information yet that they are SPOILER-related. I'll probably add checks for them at least in a dev branch for the time being, thanks @MarvinOl !

speed47 avatar Apr 21 '19 11:04 speed47

New details about the new exploits and fixes: https://access.redhat.com/security/vulnerabilities/mds https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/adv190013

MarvinOl avatar May 14 '19 18:05 MarvinOl

Yep. First detection version is already merged, I'm still currently refining it, master will be noisy tonight. Btw, it wasn't SPOILER after all.

speed47 avatar May 14 '19 18:05 speed47

AFAICT, there is no SPOILER mitigation on OS or firmware level, as it's just a way to enhance a Rowhammer attack. So, there's no existing mitigation for the script to detect. Leaving this open for information only.

speed47 avatar Nov 24 '19 19:11 speed47