{"push_id":2325328176,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"d59628f9b217d634c5e6f0017c3f9761ec2cbbf5","before":"0fc49a48fa85e3de5f3b1096c7457ff573070b96","commits":[{"sha":"d59628f9b217d634c5e6f0017c3f9761ec2cbbf5","author":{"name":"Andrei Lavreniyuk","email":"fff288f5361c1a851c06caebd42884e42ceb76b8@gmail.com"},"message":"4.15.3-wip-x13\n\nWIP Kernel (Patched Kernel Sources Linux 4.15.3)\n\n- Full kernel adaptation to version Ubuntu 18.04 LTS Bionic.\n- Full kernel adaptation to build GCC7/GCC8.\n\nFull support:\n- Indirect Branch Restricted Speculation (IBRS)\n- Indirect Branch Prediction Barrier (IBPB)\n\nAdd Linux Kernel Runtime Guard (LKRG):\n\n Linux Kernel Runtime Guard (LKRG) is a loadable kernel module that\nperforms runtime integrity checking of the Linux kernel and detection of\nsecurity vulnerability exploits against the kernel.\n\nCurrent status of this kernel for the Spectre and Meltdown\nvulnerabilities:\n\nHardware check\n* Hardware support (CPU microcode) for mitigation techniques\n  * Indirect Branch Restricted Speculation (IBRS)\n    * SPEC_CTRL MSR is available:  YES\n    * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)\n    * Kernel has set the spec_ctrl flag in cpuinfo:  NO\n  * Indirect Branch Prediction Barrier (IBPB)\n    * PRED_CMD MSR is available:  YES\n    * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)\n  * Single Thread Indirect Branch Predictors (STIBP)\n    * SPEC_CTRL MSR is available:  YES\n    * CPU indicates STIBP capability:  YES\n  * Enhanced IBRS (IBRS_ALL)\n    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO\n    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO\n  * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):\nNO\n  * CPU microcode is known to cause stability problems:\n  YES  (model 71 stepping 1 ucode 0x1b)\n\n* CPU vulnerability to the three speculative execution attacks variants\n  * Vulnerable to Variant 1:  YES (Enable Mitigation: __user pointer\nsanitization)\n  * Vulnerable to Variant 2:  YES (Enable Mitigation: PTI)\n  * Vulnerable to Variant 3:  YES (Enable Mitigation: Full generic\nretpoline, IBPB, IBRS_FW)\n\nCVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'\n* Mitigated according to the /sys interface:\n  YES  (kernel confirms that the mitigation is active)\n* Kernel has array_index_mask_nospec:\n  YES  (1 occurence(s) found of 64 bits array_index_mask_nospec())\n* Checking count of LFENCE instructions following a jump in kernel:\n  YES  (1839 jump-then-lfence instructions found, which is >= 30\n(heuristic))\n> STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)\n\nCVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'\n* Mitigated according to the /sys interface:\n  YES  (kernel confirms that the mitigation is active)\n* Mitigation 1\n  * Kernel is compiled with IBRS/IBPB support:  YES\n  * Currently enabled features\n    * IBRS enabled for Kernel space:  NO\n    * IBRS enabled for User space:  NO\n    * IBPB enabled:  YES\n* Mitigation 2\n  * Kernel compiled with retpoline option:  YES\n  * Kernel compiled with a retpoline-aware compiler:\n  YES  (kernel reports full retpoline compilation)\n  * Retpoline enabled:  YES\n> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline, IBPB,\nIBRS_FW)\n\nCVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'\n* Mitigated according to the /sys interface:\n  YES  (kernel confirms that the mitigation is active)\n* Kernel supports Page Table Isolation (PTI):  YES\n* PTI enabled and active:  YES\n* Performance impact if PTI is enabled\n  * CPU supports PCID:\n  YES  (performance degradation with PTI will be limited)\n  * CPU supports INVPCID:\n  YES  (performance degradation with PTI will be limited)\n* Running as a Xen PV DomU:  NO\n> STATUS:  NOT VULNERABLE  (Mitigation: PTI)","distinct":true,"url":"https://api.github.com/repos/AndyLavr/wip-kernel/commits/d59628f9b217d634c5e6f0017c3f9761ec2cbbf5"}]}
{"actor":{"display_login":"AndyLavr"}}