| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: spectre-meltdown-checker | Distribution: openSUSE Tumbleweed |
| Version: 26.36.0602723 | Vendor: openSUSE |
| Release: 1.1 | Build date: Thu Jul 9 16:49:48 2026 |
| Group: Productivity/Security | Build host: reproducible |
| Size: 757315 | Source RPM: spectre-meltdown-checker-26.36.0602723-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/speed47/spectre-meltdown-checker | |
| Summary: Spectre & Meltdown Vulnerability Checker | |
A shell script to tell if your Linux installation is vulnerable against the three "speculative execution" CVEs that were made public in early 2018. Without options, the script inspects the currently running kernel. Alternatively, a kernel image can be specify on the command line to analyze a non-running kernel. The script tries to detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number.
GPL-3.0-only
* Thu Jul 09 2026 Marcus Meissner <meissner@suse.com>
- updated to v26.36.0602723
Release highlights:
This release brings some features to ARM64 hosts. They get
dedicated silicon-errata checks, a proper CPU details block, and
architecture-aware filtering so x86 hosts no longer show ARM64 noise
and vice-versa.
On the x86 side, MMIO Stale Data detection is now much more honest
about end-of-life Intel CPUs that Intel never officially assessed,
these are now reported as UNK (or VULN under --paranoid) instead of
a misleading "not affected".
The tool now better detects guest environments and warns you that the
microcode version reported by your hypervisor may be fake or stale, so
the "up-to-date microcode" check can't be trusted from inside the guest.
More detailed changelog:
- Add ARM64 silicon errata (issue #357)
Three speculation/security-relevant ARM64 errata families are now
detected. As these are tracked by vendor erratum IDs rather than CVEs, a
new CVE-0001-NNNN placeholder range has been reserved for vendor errata,
along with a new --errata <number> selector (alongside --variant/--cve):
- Speculative AT TLB corruption (1165522 / 1319367 / 1319537 / 1530923)
- Speculative unprivileged load (2966298 / 3117295)
- MSR SSBS not self-synchronizing (3194386 and siblings)
CPU affectedness is determined per-core from the (implementer,
part, variant, revision) tuple in /proc/cpuinfo, matching the
kernel code. Kernel mitigation detection relies on the per-erratum
CONFIG_ARM64_ERRATUM_NNNN symbols, kernel image descriptor strings,
and dmesg (no sysfs exists for these).
Architecture-aware CVE filtering
- CVE_REGISTRY gains an optional fifth field tagging checks as x86-only or arm-only; untagged entries apply everywhere.
- Default "all CVEs" runs now skip checks irrelevant to the inspected
architecture across text, JSON, NRPE and Prometheus outputs (no more
ARM64 errata on x86 hosts, or x86 CVEs on ARM hosts).
- Explicit --cve / --variant / --errata selection bypasses the check, so manual queries still run anywhere.
- In --no-hw mode, the host CPU is ignored, supporting cross-arch offline analysis driven by --kernel/--config/--map.
Fixes to existing CVEs
- MMIO Stale Data (CVE-2022-21123 / 21125 / 21166) (#437):
EOL Intel CPUs that Intel never officially assessed (Sandy/Ivy
Bridge, Haswell/Broadwell client, pre-Goldmont Atom, etc.) are now
reported as UNK (or VULN under --paranoid) instead of a misleading
"not affected". This corrects the picture on kernels where sysfs
wrongly says "Not affected" (pre-v6.0 and v6.16+) and aligns with the
kernel's X86_BUG_MMIO_UNKNOWN set. The BSD path was corrected too:
no BSD implements an MMIO mitigation, so affected CPUs now report VULN
(with an explain rationale) rather than "not yet implemented".
VM guest detection (issue #336)
- New is_running_as_guest() detects VM guests (KVM, VMware, ESXi, Hyper-V, VirtualBox…) via the hypervisor CPUID flag in /proc/cpuinfo.
- New "Running as VM guest: YES/NO" line in the CPU details block (x86 and ARM).
- A warning is now emitted after the microcode-is-latest check, advising you to verify microcode on the hypervisor host, since a guest can be shown a fake CPUID/microcode version.
- JSON output exposes this: system.guest_vm (bool), system.guest_vm_reason (string), and cpu_microcode.unreliable_in_vm (bool).
Output display
- ARM CPUs now get a proper CPU details block in check_cpu(): vendor, model name, implementer(s), part(s), architecture(s) and VM-guest status. Previously the x86-only early return left ARM hosts with no check_cpu() output at all.
Tooling
- New scripts/update_mcedb.sh (on test and source branches), so that the GitHub workflow can regenerate src/db/200_mcedb.sh daily.
Documentation
- Unsupported CVE list: added the Jump Conditional Code (JCC) Erratum
(issue #329), a microarchitectural correctness bug (Skylake to Cascade
Lake), not a speculative side channel, with no CVE, no sysfs/CPUID/MSR
indicator, hence out of scope.
- Updated to v26.33.0420460
With this release and the 7 new supported CVEs, we're up to date
with all published CVEs since 2018 that are in the scope of this tool
(33 so far).
The batch output formats also got a substantial overhaul: JSON, NRPE
and prometheus output formats now better respect each format community
guidelines, as well as carrying way more information if you want or
need to have a clear overview of your server fleet.
Operating modes have been clarified. You'll be able to chose between
4 modes, depending on whether you want to inspect the running kernel,
a kernel image, the CPU hardware, or a combination. See the "operating
modes" section of the README for more information.
A new --extra option has been added, which runs some additional
checks that are not CVE vulnerabilities per se, but may still be of
interest. SLS has been implemented and falls into this category.
Affected Intel CPU list up to date as of 2026-04.
Last but not least, a dozen fixes/enhancements/refinements of preexisting CVE checks have been done, along with some more general robustness / corner case fixes.
More detailed changelog
New CVE checks
- CVE-2025-54505 aka FPDSS (Floating-Point Divider Stale Data Leak)
- CVE-2023-28746 ana RFDS (Register File Data Sampling)
- CVE-2023-20588 aka AMD DIV0 (Division by Zero Speculative Data Leak)
- CVE-2022-21123 / 21125 / 21166 aka MMIO Stale Data
New extra checks
- SLS aka Straight-Line Speculation, supplementary
Fixes / enhancements to existing CVEs
- Spectre V2 (CVE-2017-5715): Red Hat RSB Filling detection (#235)
- Spectre 3a (CVE-2018-3640): improved ARM mitigation detection
- L1TF/Foreshadow (CVE-2018-3615): better lockdown detection, drop cap_flush_cmd requirement (#296)
- TAA (CVE-2019-11135): new 0x10F MSR for TSX-disabled CPUs (#414)
- SRBDS (CVE-2020-0543): fix microcode mitigation misdetection (#492)
- Inception/SRSO (CVE-2023-20569): detect IPBP "PB-Inception" (#500)
- TSA (CVE-2024-36350/36357): no TSA CPUID lines on non-AMD
- MDS: fix CPUs affected by MSBDS but not MDS (#351)
- MDS (FreeBSD): software mitigation = OK unless --paranoid (#503)
Batch output
- --batch json reworked completely, structured format (meta, system, cpu, vulnerabilities[]) + JSON Schema. Old format still available as --batch json-terse
- --batch prometheus reworked completely, new smc_* metric names
- --batch nrpe added more textual information
CLI / run modes
- New --no-runtime and --no-hw replace implicit offline mode
- --live deprecated (now the default)
- New --extra flag (gates SLS and future supplementary checks)
- --no-intel-db removed (Intel DB always used when available)
Intel Database
- Affected CPU list refreshed to 2026-04
- Hybrid CPU detection (H=1/H=0)
- New mitigation codes: MS, HS, HM
- Intel codename mapping for JSON/Prometheus output
Output display & robustness
- Clearer CPU details and kernel info sections
- x86 / ARM checks now guarded to the correct architecture
- CPUID fallback to /proc/cpuinfo when CPUID unavailable (VMs)
- MSR read/write: clearer errors, proper lockdown reporting
- wrmsr now specifies the core number (#294)
- Microcode version never defaults to 0x0 when unknown
- exit_cleanup preserves the passed exit code
- --allow-msr-write early-abort crash fixed
- Better Busybox / unlzma compatibility (#432)
- BSD ucode fallback uses proper AMD MSR
Unsupported-CVE docs (new entries)
- Plundervolt (CVE-2019-11157), CacheOut (CVE-2020-0549),
Platypus (CVE-2020-8694/8695), CVE-2020-24511/24512, AMD Prefetch
(CVE-2021-26318), Native BHI (CVE-2024-2201) + TLBleed, Blindside.
- Updated to v26.26.0404682
Another big round of updates as I'm catching up with the recent CVEs.
New CVE/vulnerabilities detection
- CVE-2022-29900 (Retbleed AMD - Arbitrary Speculative Code Execution with Return Instructions)
- CVE-2022-29901 (Retbleed Intel / RSBA - RSB Alternate Behavior)
- CVE-2024-28956 (ITS - Indirect Target Selection)
- CVE-2025-40300 (VMScape)
- CVE-2024-45332 (BTI - Branch Target Injection)
Enhancements to existing CVE detections
- CVE-2023-23583 (Reptar): update known fixed microcode versions
- CVE-2024-45332 (BPI): add known fixed microcode versions
Bug fixes
- Fix sys_interface_check() not properly setting the caller's $msg variable in the latest release (#533)
New documented unsupported CVEs
Already covered by an existing CVE check:
- CVE-2025-20623 - Shared Microarchitectural Predictor State (10th Gen Intel), covered by CVE-2024-45332 (BPI)
- CVE-2025-24495 - Lion Cove BPU Initialization, covered by CVE-2024-28956 (ITS)
No kernel or microcode mitigations to check:
- CVE-2020-12965 - Transient Execution of Non-Canonical Accesses / SLAM (AMD)
- CVE-2024-7881 - ARM Prefetcher Privilege Escalation
Not a transient/speculative execution vulnerability:
- CVE-2023-31315 - SinkClose (AMD SMM Lock Bypass)
- CVE-2024-56161 - EntrySign (AMD Microcode Signature Bypass)
- CVE-2025-29943 - StackWarp (AMD SEV-SNP)
- Updated to v26.21.0401891
Okay, this one is a massive update. Or, is this an easter egg?
First and foremost, the least visible but probably the most important for the continued maintainability of this project: the script has been split into a structured source tree of smaller scripts snippets, that are then assembled to produce the final self-contained spectre-meltdown-checker.sh.
With all this, also comes a new version numbering scheme: vXX.YY.ZZZZZZZ, automatically updated by the CI. XX=year, YY=number_of_managed_CVEs, ZZZZZZZ=based_on_datetime_of_release.
Now, here is a clearly non-exhaustive list of changes (refer to the commit log for more):
- feat: added CVE-2024-36350/CVE-2024-36357 (Transient Scheduler Attack / TSA) (fixes #509)
- feat: added CVE-2023-23583 (Reptar)
- enh: CVE-2023-20593 (Zenbleed): Mitigation detection added for BSD
- enh: improvement under BSD for a few CVEs, identifying unaffected CPUs even if mitigation is not implemented in BSD
- enh: CVE-2017-5753 (Spectre Variant 1): massive update to the detection logic, as this was the first CVE ever implemented in this script, and a lot changed since then, both in the understanding of Spectre V1 and in the kernels.
- enh: CVE-2017-5715 (Spectre Variant 2): massive update here too, including adding detection for BHI
- enh: enhanced VMM autodetection with more supported hypervisor binaries
- fix: cap_rdcl_no, cap_gds_no, cap_tsa_*_no were not marking the current CPU as immune for their respective vulnerabilities
- fix: CVE-2018-3620: false VULN status on kernels reporting CPU as unaffected when RDCL_NO couldn't be parsed
- fix: CVE-2023-20569: logic errors from kernel_sro type change, old kernels incorrectly reporting mitigated via sysfs are now detected
- fix: --sysfs-only path fixed for a handful of CVEs, started to document complete sysfs strings history from the kernel source code for reference
- fix: read_msr: fixed handling of values > INT32_MAX (fixes #507)
- fix: several tool uses replaced (sort -V, sed -r, cut -w, stat -c, date -d @) to ensure compatibility with BSD (fixes #525)
- doc: a (hopefully) nicer README, I'll have to update the screenshots though
* Wed Aug 30 2023 Marcus Meissner <meissner@suse.com>
- updated to 0.46
This release mainly focuses on the detection of the new Zenbleed
(CVE-2023-20593) vulnerability, among few other changes that were in
line waiting for a release:
- feat: detect the vulnerability and mitigation of Zenbleed (CVE-2023-20593)
- feat: add the linux-firmware repository as another source for CPU microcode versions
- feat: arm: add Neoverse-N2, Neoverse-V1 and Neoverse-V2
- fix: docker: adding missing utils (#433)
- feat: add support for Guix System kernel
- fix: rewrite SQL to be sqlite3 >= 3.41 compatible (#443)
- fix: a /devnull file was mistakenly created on the filesystem
- fix: fwdb: ignore MCEdb versions where an official Intel version exists (fixes #430)
* Fri Apr 01 2022 Marcus Meissner <meissner@suse.com>
- updated to 0.45
- arm64: phytium: Add CPU Implementer Phytium
- arm64: variant 4: detect ssbd mitigation from kernel img, system.map or kconfig
- chore: ensure vars are set before being dereferenced (set -u compat)
- chore: fix indentation
- chore: fwdb: update to v220+i20220208
- chore: only attempt to load msr and cpuid module once
- chore: read_cpuid: use named constants
- chore: readme: framapic is gone, host the screenshots on GitHub
- chore: replace 'Vulnerable to' by 'Affected by' in the hw section
- chore: speculative execution -> transient execution
- chore: update fwdb to v222+i20220208
- chore: update Intel Family 6 models
- chore: wording: model not vulnerable -> model not affected
- doc: add an FAQ entry about CVE support
- doc: add an FAQ.md and update the README.md accordingly
- doc: more FAQ and README
- doc: readme: make the FAQ entry more visible
- feat: add --allow-msr-write, no longer write by default (#385), detect when writing is denied
- feat: add --cpu, apply changes to (read|write)_msr, update fwdb to v221+i20220208
- feat: add subleaf != 0 support for read_cpuid
- feat: arm: add Cortex A77 and Neoverse-N1 (fixes #371)
- feat: bsd: for unimplemented CVEs, at least report when CPU is not affected
- feat: hw check: add IPRED, RRSBA, BHI features check
- feat: implement detection for MCEPSC under BSD
- feat: set default TMPDIR for Android (#415)
- fix: extract_kernel: don't overwrite kernel_err if already set
- fix: has_vmm false positive with pcp
- fix: is_ucode_blacklisted: fix some model names
- fix: mcedb: v191 changed the MCE table format
- fix: refuse to run under MacOS and ESXi
- fix: retpoline: detection on 5.15.28+ (#420)
- fix: variant4: added case where prctl ssbd status is tagged as 'unknown'
* Fri May 07 2021 Marcus Meissner <meissner@suse.com>
- updated to 0.44 (bsc#1189477)
- feat: add support for SRBDS related vulnerabilities
- feat: add zstd kernel decompression (#370)
- enh: arm: add experimental support for binary arm images
- enh: rsb filling: no longer need the 'strings' tool to check for kernel support in live mode
- fix: fwdb: remove Intel extract tempdir on exit
- fix: has_vmm: ignore kernel threads when looking for a hypervisor (fixes #278)
- fix: fwdb: use the commit date as the intel fwdb version
- fix: fwdb: update Intel's repository URL
- fix: arm64: cve-2017-5753: kernels 4.19+ use a different nospec macro
- fix: on CPU parse info under FreeBSD
- chore: github: add check run on pull requests
- chore: fwdb: update to v165.20201021+i20200616
* Fri Jan 24 2020 Dominique Leuenberger <dimstar@opensuse.org>
- Fix typo (s/Require:/Requires:/).
* Thu Jan 16 2020 Marcus Meissner <meissner@suse.com>
- added requires binutils, as the script calls "readelf"
* Wed Dec 11 2019 Marcus Meissner <meissner@suse.com>
- version 0.43
- feat: implement TAA detection (CVE-2019-11135 bsc#1139073)
- feat: implement MCEPSC / iTLB Multihit detection (CVE-2018-12207 bsc#1117665)
- feat: taa: add TSX_CTRL MSR detection in hardware info
- feat: fwdb: use both Intel GitHub repo and MCEdb to build our firmware version database
- feat: use --live with --kernel/--config/--map to override file detection in live mode
- enh: rework the vuln logic of MDS with --paranoid (fixes #307)
- enh: explain that Enhanced IBRS is better for performance than classic IBRS
- enh: kernel: autodetect customized arch kernels from cmdline
- enh: kernel decompression: better tolerance against missing tools
- enh: mock: implement reading from /proc/cmdline
- fix: variant3a: Silvermont CPUs are not vulnerable to variant 3a
- fix: lockdown: detect Red Hat locked down kernels (impacts MSR writes)
- fix: lockdown: detect locked down mode in vanilla 5.4+ kernels
- fix: sgx: on locked down kernels, fallback to CPUID bit for detection
- fix: fwdb: builtin version takes precedence if the local cached version is older
- fix: pteinv: don't check kernel image if not available
- fix: silence useless error from grep (fixes #322)
- fix: msr: fix msr module detection under Ubuntu 19.10 (fixes #316)
- fix: mocking value for read_msr
- chore: rename mcedb cmdline parameters to fwdb, and change db version scheme
- chore: fwdb: update to v130.20191104+i20191027
- chore: add GitHub check workflow
- upstream tarball no longer includes license, use the gpl 3 standalone html for it
* Wed Jun 26 2019 Pavol Cupka <palica@liguros.net>
- version 0.42
* add FreeBSD MDS mitigation detection
* add mocking functionality to help debugging, dump data to mock the behavior of your CPU with --dump-mock-data
* AMD, ARM and CAVIUM are not vulnerable to MDS
* RDCL_NO bit wasn't taking precedence for L1TF check on some newer Intel CPUs
* The MDS_NO bit on newer Intel CPUs is now recognized and used
* remove libvirtd from hypervisor detection to avoid false positives (#278)
* under BSD, the data returned when reading MSR was incorrectly formatted
* update builtin MCEdb from v110 to v111
* Fri May 24 2019 Marcus Meissner <meissner@suse.com>
- noarch does not work on older distros, removed
* Thu May 16 2019 Pavol Cupka <palica@liguros.net>
- version 0.41
* add support for the 4 MDS CVEs
* add Spectre and Meltdown mitigation detection for Hygon CPU
* for SSBD, report whether the mitigation is active
* and other fixes and enhancements
/usr/bin/spectre-meltdown-checker.sh /usr/share/doc/packages/spectre-meltdown-checker /usr/share/doc/packages/spectre-meltdown-checker/README.md /usr/share/licenses/spectre-meltdown-checker /usr/share/licenses/spectre-meltdown-checker/gpl-3.0-standalone.html
Generated by rpm2html 1.8.1
Fabrice Bellet, Tue Aug 11 22:41:05 2026