False positive for SRBDS? In any case, misleading message

[ricardobranco777]

Shows CPU as vulnerable even though sysfs reports it's mitigated in microcode:

$ cat /sys/devices/system/cpu/vulnerabilities/srbds 
Mitigation: Microcode

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
* Mitigated according to the /sys interface:  YES  (Mitigation: Microcode)
* SRBDS mitigation control is supported by the kernel:  YES  (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active:  YES  (Mitigation: Microcode)
> STATUS:  VULNERABLE  (Your microcode and kernel are both up to date for SRBDS mitigation control. Mitigation is disabled)

Also, the last 2 lines contradict each other. How is that "mitigation control is enabled and active" yet "mitigation is disabled"?

CPU: Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz
Microcode: 3.20230808.0ubuntu1
OS: Ubuntu 23.10 with 6.2.0-27-generic (6.2.15)

[speed47]

The scripts seems to gather contradictory information on your system, hence leading to an erroneous conclusion.
What does it say in the hardware section, for "* CPU supports Special Register Buffer Data Sampling (SRBDS)"?

[ricardobranco777]

The scripts seems to gather contradictory information on your system, hence leading to an erroneous conclusion. What does it say in the hardware section, for "* CPU supports Special Register Buffer Data Sampling (SRBDS)"?

* CPU supports Special Register Buffer Data Sampling (SRBDS): YES

[speed47]

Can you run the script in very verbose mode, i.e. with -v - v - v, and paste the complete output here? (or you can put it in a text file and attach it to this bug)

[ricardobranco777]

Output from sudo bash spectre-meltdown-checker.sh -v -v -v --no-color --cve CVE-2020-0543 >& srbds.txt

Spectre and Meltdown mitigation detection tool v0.46-13-g44223c5

(debug) attempted to load module cpuid, insmod_cpuid=1
(debug) cpuid: leaf1 subleaf0 on cpu0, eax-ebx-ecx-edx:      526060    1050624 2147154879 3219913727
(debug) cpuid: wanted register (1) has value 526060 aka 000806ec
(debug) cpuid: shifted value by 0 is 526060 aka 806ec
(debug) cpuid: after AND 0xFFFFFFFF, final value is 526060 aka 806ec
Checking for vulnerabilities on current system
Kernel is Linux 6.2.0-27-generic #28-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul 12 22:39:51 UTC 2023 x86_64
CPU is Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz
(debug) found opt_kernel=/vmlinuz-6.2.0-27-generic in /proc/cmdline
(debug) opt_kernel is now /boot//vmlinuz-6.2.0-27-generic
Will use kernel image /boot//vmlinuz-6.2.0-27-generic
Will use kconfig /boot/config-6.2.0-27-generic
Will use System.map file /proc/kallsyms
(debug) check_kernel: ret=0 size=13872968 sections=0 warnings=readelf: Error: Not an ELF file - it has the wrong magic bytes at the start/
(debug) check_kernel: ... file is invalid
(debug) extract_kernel: pass 1 normal mode
(debug) try_decompress: looking for gunzip magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: magic for gunzip found at offset 4195221:xy
(debug) try_decompress: decompression with gunzip failed (err=1)
(debug) try_decompress: magic for gunzip found at offset 11136219:xy
(debug) try_decompress: decompression with gunzip failed (err=1)
(debug) try_decompress: looking for lz4 magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: looking for unxz magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: looking for bunzip2 magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: magic for bunzip2 found at offset 3555795:xy
(debug) try_decompress: decompression with bunzip2 failed (err=2)
(debug) try_decompress: looking for unlzma magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: looking for lzop magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: looking for cat magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: magic for cat found at offset 13780007:xxy
(debug) check_kernel: ret=0 size=92962 sections=0 warnings=readelf: Warning: The e_shentsize field in the ELF header is larger than the size of an ELF section header/readelf: Error: Reading 1059349200 bytes extends past end of file for section headers/readelf: Error: Too many program headers - 0x2474 - the file is not that big/
(debug) check_kernel: ... file is invalid
(debug) try_decompress: decompression with cat worked but result is not a kernel
(debug) try_decompress: looking for unzstd magic in /boot//vmlinuz-6.2.0-27-generic
(debug) try_decompress: magic for unzstd found at offset 17833:xxy
(debug) check_kernel: ret=0 size=74949184 sections=12 warnings=
(debug) check_kernel: ... file is valid
(debug) try_decompress: decompressed with unzstd successfully!
Kernel image is Linux version 6.2.0-27-generic (buildd@lcy02-amd64-001) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.2.0-17ubuntu1) 12.2.0, GNU ld (GNU Binutils for Ubuntu) 2.40) #28-Ubuntu SMP PREEMPT_DYNAMIC  (Ubuntu 6.2.0-27.28-generic 6.2.15)

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available: (debug) read_msr: using rdmsr on 0x48
(debug) read_msr: MSR=0x48 value is 1
YES
    * CPU indicates IBRS capability: (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 26 is 47 aka 2f
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES (SPEC_CTRL feature bit)
  * Indirect Branch Prediction Barrier (IBPB)
    * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available: YES
    * CPU indicates STIBP capability: (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 27 is 23 aka 17
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES (Intel STIBP feature bit)
  * Speculative Store Bypass Disable (SSBD)
    * CPU indicates SSBD capability: (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 31 is 1 aka 1
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES (Intel SSBD)
  * L1 data cache invalidation
    * CPU indicates L1D flush capability: (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 28 is 11 aka b
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES (L1D flush feature bit)
  * Microarchitectural Data Sampling
    * VERW instruction is available: (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 10 is 3080193 aka 2f0001
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES (MD_CLEAR feature bit)
  * Indirect Branch Predictor Controls
    * Indirect Predictor Disable feature is available: (debug) cpuid: leaf7 subleaf2 on cpu0, eax-ebx-ecx-edx:           0          0          0          0
(debug) cpuid: wanted register (4) has value 0 aka 00000000
(debug) cpuid: shifted value by 1 is 0 aka 0
(debug) cpuid: after AND 1, final value is 0 aka 0
(debug) cpuid: wanted 1 and got 0
NO
    * Bottomless RSB Disable feature is available: (debug) cpuid: leaf7 subleaf2 on cpu0, eax-ebx-ecx-edx:           0          0          0          0
(debug) cpuid: wanted register (4) has value 0 aka 00000000
(debug) cpuid: shifted value by 2 is 0 aka 0
(debug) cpuid: after AND 1, final value is 0 aka 0
(debug) cpuid: wanted 1 and got 0
NO
    * BHB-Focused Indirect Predictor Disable feature is available: (debug) cpuid: leaf7 subleaf2 on cpu0, eax-ebx-ecx-edx:           0          0          0          0
(debug) cpuid: wanted register (4) has value 0 aka 00000000
(debug) cpuid: shifted value by 2 is 0 aka 0
(debug) cpuid: after AND 1, final value is 0 aka 0
(debug) cpuid: wanted 1 and got 0
NO
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability: (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 29 is 5 aka 5
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: (debug) read_msr: using rdmsr on 0x10a
(debug) read_msr: MSR=0x10a value is 34212907
(debug) capabilities MSR is 34212907 (decimal)
(debug) capabilities says rdcl_no=1 ibrs_all=1 rsba=0 l1dflush_no=1 ssb_no=0 mds_no=1 taa_no=0 pschange_msc_no=0
YES
  * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): YES
  * CPU explicitly indicates not being affected by Variant 4 (SSB_NO): NO
  * CPU/Hypervisor indicates L1D flushing is not necessary on this system: YES
  * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): NO
  * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): YES
  * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): NO
  * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): NO
  * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): NO
  * CPU explicitly indicates being affected by GDS and having mitigation control (GDS_CTRL): YES
(debug) read_msr: using rdmsr on 0x123
(debug) read_msr: MSR=0x123 value is 4
    * GDS microcode mitigation is disabled (GDS_MITG_DIS): NO
    * GDS microcode mitigation is locked in enabled state (GDS_MITG_LOCK): NO
  * CPU explicitly indicates not being affected by GDS (GDS_NO): NO
  * CPU supports Transactional Synchronization Extensions (TSX): (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (2) has value 43804591 aka 029c67af
(debug) cpuid: shifted value by 11 is 21388 aka 538c
(debug) cpuid: after AND 1, final value is 0 aka 0
(debug) cpuid: wanted 1 and got 0
NO
  * CPU supports Software Guard Extensions (SGX): (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (2) has value 43804591 aka 029c67af
(debug) cpuid: shifted value by 2 is 10951147 aka a719eb
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES
  * CPU supports Special Register Buffer Data Sampling (SRBDS): (debug) cpuid: leaf7 subleaf0 on cpu0, eax-ebx-ecx-edx:           0   43804591          0 3154118144
(debug) cpuid: wanted register (4) has value 3154118144 aka bc000600
(debug) cpuid: shifted value by 9 is 6160387 aka 5e0003
(debug) cpuid: after AND 1, final value is 1 aka 1
(debug) cpuid: wanted 1 and got 1
YES
(debug) read_msr: using rdmsr on 0x123
(debug) read_msr: MSR=0x123 value is 4
  * CPU microcode is known to cause stability problems: (debug) is_ucode_blacklisted: no (142/12/248)
NO (family 0x6 model 0x8e stepping 0xc ucode 0xf8 cpuid 0x806ec)
  * CPU microcode is the latest known available version: (debug) is_latest_known_ucode: with cpuid 526060 has ucode 248, last known is 248 from 2023/02/26
YES (latest version is 0xf8 dated 2023/02/26 according to builtin firmwares DB v273+i20230808+b6bd)
* CPU vulnerability to the speculative execution attack variants
  * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): (debug) is_cpu_affected: inteldb for CVE-2017-5753 says 'S'
YES
  * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): (debug) is_cpu_affected: inteldb for CVE-2017-5715 says 'HS'
YES
  * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): (debug) is_cpu_affected: inteldb for CVE-2017-5754 says 'N'
NO
  * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): (debug) is_cpu_affected: inteldb for CVE-2018-3640 says 'N'
NO
  * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): (debug) is_cpu_affected: inteldb for CVE-2018-3639 says 'HS'
YES
  * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): (debug) is_cpu_affected: inteldb for CVE-2018-3615 says 'N'
NO
  * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): (debug) is_cpu_affected: inteldb for CVE-2018-3620 says 'N'
NO
  * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): (debug) is_cpu_affected: inteldb for CVE-2018-3646 says 'N'
NO
  * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): (debug) is_cpu_affected: inteldb for CVE-2018-12126 says 'N'
NO
  * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): (debug) is_cpu_affected: inteldb for CVE-2018-12130 says 'N'
NO
  * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): (debug) is_cpu_affected: inteldb for CVE-2018-12127 says 'N'
NO
  * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): (debug) is_cpu_affected: inteldb for CVE-2019-11091 says ''
(debug) is_cpu_affected: cpu not affected by Microarchitectural Data Sampling
(debug) is_cpu_affected: cpu not affected by TSX Asynhronous Abort
(debug) is_cpu_affected: cpu not affected by Special Register Buffer Data Sampling
(debug) is_cpu_affected: RDCL_NO is set so not vuln to meltdown nor l1tf
(debug) is_cpu_affected: intel family 6 is vuln to l1tf
(debug) is_cpu_affected: downfall: affected
(debug) is_cpu_affected: intel family 6 is vuln to itlbmh
(debug) is_cpu_affected: temp results are <> <> <immune> <> <> <vuln>
(debug) is_cpu_affected: final results are <0> <0> <1> <0> <0> <0> <0>
NO
  * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): (debug) is_cpu_affected: inteldb for CVE-2019-11135 says 'MS'
YES
  * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): (debug) is_cpu_affected: inteldb for CVE-2018-12207 says 'S'
YES
  * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): (debug) is_cpu_affected: inteldb for CVE-2020-0543 says 'MS'
YES
  * Affected by CVE-2023-20593 (Zenbleed, cross-process information leak): (debug) is_cpu_affected: inteldb for CVE-2023-20593 says ''
NO
  * Affected by CVE-2022-40982 (Downfall, gather data sampling (GDS)): (debug) is_cpu_affected: inteldb for CVE-2022-40982 says 'M'
YES

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
* Mitigated according to the /sys interface: YES (Mitigation: Microcode)
(debug) sys_interface_check: /sys/devices/system/cpu/vulnerabilities/srbds=Mitigation: Microcode (re=.*)
* SRBDS mitigation control is supported by the kernel: YES (found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation)
* SRBDS mitigation control is enabled and active: YES (Mitigation: Microcode)
(debug) is_cpu_affected: inteldb for CVE-2020-0543 says 'MS'
> STATUS: VULNERABLE (Your microcode and kernel are both up to date for SRBDS mitigation control. Mitigation is disabled)

> SUMMARY: CVE-2020-0543:KO

(debug) variables at end of script: ||||||||||||||||||||||{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |{ |}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|}|amd_legacy_erratum () |amd_model_range () |amd_ssb_no=0|available using the \`--explain\` switch.|bad_accuracy=0|builtin_dbversion=v273+i20230808+b6bd|but rather helps you verifying whether your system has the known correct mitigations in place.|capabilities=34212907|capabilities_gds_ctrl=1|capabilities_gds_no=0|capabilities_ibrs_all=1|capabilities_l1dflush_no=1|capabilities_mds_no=1|capabilities_pschange_msc_no=0|capabilities_rdcl_no=1|capabilities_rsba=0|capabilities_ssb_no=0|capabilities_taa_no=0|capabilities_tsx_ctrl_msr=0|check_cpu () |check_cpu_vulnerabilities () |check_CVE_2017_5715 () |check_CVE_2017_5715_bsd () |check_CVE_2017_5715_linux () |check_CVE_2017_5753 () |check_CVE_2017_5753_bsd () |check_CVE_2017_5753_linux () |check_CVE_2017_5754 () |check_CVE_2017_5754_bsd () |check_CVE_2017_5754_linux () |check_CVE_2018_12126 () |check_CVE_2018_12127 () |check_CVE_2018_12130 () |check_CVE_2018_12207 () |check_CVE_2018_12207_bsd () |check_CVE_2018_12207_linux () |check_CVE_2018_3615 () |check_CVE_2018_3620 () |check_CVE_2018_3620_bsd () |check_CVE_2018_3620_linux () |check_CVE_2018_3639 () |check_CVE_2018_3639_bsd () |check_CVE_2018_3639_linux () |check_CVE_2018_3640 () |check_CVE_2018_3646 () |check_CVE_2018_3646_bsd () |check_CVE_2018_3646_linux () |check_CVE_2019_11091 () |check_CVE_2019_11135 () |check_CVE_2019_11135_bsd () |check_CVE_2019_11135_linux () |check_CVE_2020_0543 () |check_CVE_2020_0543_bsd () |check_CVE_2020_0543_linux () |check_CVE_2022_40982 () |check_CVE_2022_40982_linux () |check_CVE_2023_20593 () |check_CVE_2023_20593_linux () |check_has_vmm () |check_kernel () |check_mds () |check_mds_bsd () |check_mds_linux () |check_redhat_canonical_spectre () |collectively named "transient execution" (aka "speculative execution") vulnerabilities that started to appear|cpu_brand_prefix=I|cpu_cpuid=526060|cpu_family=6|cpu_flush_cmd=1|cpu_friendly_name='Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz'|cpuid_arch_capabilities=1|cpuid_bhi=0|cpuid_hex=0x000806EC|cpuid_ibpb=SPEC_CTRL|cpuid_ibrs=SPEC_CTRL|cpuid_ipred=0|cpuid_l1df=1|cpuid_md_clear=1|cpuid_rrsba=0|cpuid_rtm=0|cpuid_sgx=1|cpuid_spec_ctrl=1|cpuid_srbds=1|cpuid_ssbd='Intel SSBD'|cpu_model=142|cpu_stepping=12|cpu_ucode=248|cpu_vendor=GenuineIntel|cve2name () |cve=CVE-2022-40982|describe=v0.46-13-g44223c5|dmesg_grep () |download_file () |echo_cmd=printf|echo_cmd_type=printf|especially for those who are exposed to the world, such as network daemons and browsers.|exit_cleanup () |explain () |extract_kernel () |falsely detect mitigations that in the end don't work as expected (for example, on backported or modified kernels).|file=/sys/devices/system/cpu/vulnerabilities/srbds|final_summary=' CVE-2020-0543:KO'|fms2cpuid () |fullmsg='Mitigation: Microcode'|get_cmdline () |global_critical=1|global_unknown=0|has_avx2=1|has_avx512=0|has_zenbleed_fixed_firmware () |hygon_ssb_no=0|in place. Verifying all the other software is out of the scope of this tool, as it can't be done in a simple way.|insmod_cpuid=1|intel_line=0x000806EC,2017-5715=HS,2017-5753=S,2017-5754=N,2018-12126=N,2018-12127=N,2018-12130=N,2018-12207=S,2018-3615=N,2018-3620=N,2018-3639=HS,2018-3640=N,2018-3646=N,2019-11135=MS,2020-0543=MS,2022-40982=M,|is_amd () |is_coreos () |is_cpu_affected () |is_cpu_affected_cached=1|is_cpu_mds_free () |is_cpu_smt_enabled () |is_cpu_specex_free () |is_cpu_srbds_free () |is_cpu_ssb_free () |is_cpu_taa_free () |is_hygon () |is_intel () |is_latest_known_ucode () |is_moksha_cpu () |is_skylake_cpu () |is_ucode_blacklisted () |is_vulnerable_to_empty_rsb () |is_xen () |is_xen_dom0 () |is_xen_domU () |is_zen_cpu () |kernel_cmdline='BOOT_IMAGE=/vmlinuz-6.2.0-27-generic root=/dev/mapper/system-root ro quiet splash acpi_os_name=Linux acpi_osi= acpi_backlight=vendor systemd.unified_cgroup_hierarchy=1 iommu=force intel_iommu=on vt.handoff=7'|kernel_err=|kernel_srbds='found SRBDS implementation evidence in kernel image. Your kernel is up to date for SRBDS mitigation'|kernel=/tmp/smc-kernel-mOclns|kerneltmp=/tmp/smc-kernel-mOclns|kernel_version='Linux version 6.2.0-27-generic (buildd@lcy02-amd64-001) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.2.0-17ubuntu1) 12.2.0, GNU ld (GNU Binutils for Ubuntu) 2.40) #28-Ubuntu SMP PREEMPT_DYNAMIC  (Ubuntu 6.2.0-27.28-generic 6.2.15)'|load_cpuid () |load_cpuid_once=1|load_msr () |max_core_id=7|mcedb_cache=/root/.mcedb|mcedb_info='builtin firmwares DB v273+i20230808+b6bd'|mcedb_source=spectre-meltdown-checker.sh|mcu_opt_ctrl=4|mcu_opt_ctrl_gds_mitg_dis=0|mcu_opt_ctrl_gds_mitg_lock=0|mitigations in place depend on your CPU (model and microcode), your kernel version, and both the runtime configuration|mocked=0|mode=|model=45|mount_debugfs () |msg='Mitigation: Microcode'|nrpe_vuln=|number_of_cores=8|objdump_options=-d|of your CPU (through bits set through the MSRs) and your kernel. The script attempts to explain everything for each|opt=|opt_allow_msr_write=0|opt_arch_prefix=|opt_batch=0|opt_batch_format=text|opt_config=/boot/config-6.2.0-27-generic|opt_coreos=0|opt_cpu=0|opt_cve_all=0|opt_cve_list=' CVE-2020-0543'|opt_explain=0|opt_hw_only=0|opt_intel_db=1|opt_kernel=/boot//vmlinuz-6.2.0-27-generic|opt_live=1|opt_map=/proc/kallsyms|opt_mock=1|opt_no_color=1|opt_no_hw=0|opt_no_sysfs=0|opt_paranoid=0|opt_sysfs_only=0|opt_verbose=4|opt_vmm=-1|os=Linux|parse_cpu_details () |parse_cpu_details_done=1|parse_opt_file () |pass=1|pos=17833|procfs=/proc|pstatus () |pti_performance_check () |pvulnstatus () |pvulnstatus_last_cve=CVE-2020-0543|read_cpuid () |read_cpuid_msg='unknown error'|read_cpuid_one_core () |read_cpuid_value=1|read_inteldb () |read_mcedb () |read_msr () |read_msr_msg='unknown error'|read_msr_one_core () |read_msr_value=4|regex='.*'|ret=0|ret24=0|ret25=0|selected_cve=CVE-2020-0543|show_disclaimer () |show_header () |show_usage () |since early 2018 with the infamous Spectre & Meltdown.|spec_ctrl_msr=1|specex_knob_dir=/dev/no_valid_path|srbds_on=0|status=OK|stepping=7|supported_cve_list='CVE-2017-5753 CVE-2017-5715 CVE-2017-5754 CVE-2018-3640 CVE-2018-3639 CVE-2018-3615 CVE-2018-3620 CVE-2018-3646 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 CVE-2019-11135 CVE-2018-12207 CVE-2020-0543 CVE-2023-20593 CVE-2022-40982'|sys_interface_available=1|sys_interface_check () |this tool only verifies that the kernel (which is the core of the system) you're using has the proper protections|try_decompress () |tuple=I,0x000806EC,0x000000F8,20230226|ucode=248|ucode_date=2023/02/26|ucode_found='family 0x6 model 0x8e stepping 0xc ucode 0xf8 cpuid 0x806ec'|ucode_latest='latest version is 0xf8 dated 2023/02/26 according to builtin firmwares DB v273+i20230808+b6bd'|update_fwdb () |variant1=0|variant2=0|variant3=1|variant3a=0|variant4=0|variant_downfall=0|variant_itlbmh=0|variantl1tf=0|variantl1tf_sgx=0|variant_mdsum=1|variant_mfbds=1|variant_mlpds=1|variant_msbds=1|variant_srbds=1|variant_taa=1|variant_zenbleed=1|vulnerability, so you know where your system stands. For a given vulnerability, detailed information is sometimes|vulnstatus=VULN|write_msr () |write_msr_one_core () |

To mock this CPU, set those vars:  SMC_MOCK_CMDLINE='BOOT_IMAGE=/vmlinuz-6.2.0-27-generic root=/dev/mapper/system-root ro quiet splash acpi_os_name=Linux acpi_osi= acpi_backlight=vendor systemd.unified_cgroup_hierarchy=1 iommu=force intel_iommu=on vt.handoff=7' SMC_MOCK_CPU_FAMILY='6' SMC_MOCK_CPU_FRIENDLY_NAME='Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz' SMC_MOCK_CPUID_1_0=' 526060 1050624 2147154879 3219913727' SMC_MOCK_CPUID_7_0=' 0 43804591 0 3154118144' SMC_MOCK_CPUID_7_2=' 0 0 0 0' SMC_MOCK_CPUINFO='H4sIAAAAAAAAA+2YTY/bNhCGz9GvmGMCtIYly7K9p6I5JEURoCiaM0GRI5kFvyLSspxf36G0XqQw9rQIYBg8SOLncPjOzHOQH5zAENzw7gnWxYhWuoEpSb1PaE/K4h82oi6EP0HHjdIXmmkK4yTqd9Qs62rpgOUGaWBe/v7vD/DRDfj+ny8fQO1+Ldfbcv0VPv71FX6DcrVff/r8vQgRvVe2T1bIiBLkCVlKfkzdfj7xy+fv6ZDNvtmtDk1ZCC6OCEF9T6v25aGCP38v/PESlOAaZq/XRVCtJrMhLSkEeZEm5plkMg2kqbrgXonrjLIqKjLxPJaGOn9KcxcMqclwEuijcvZ5jGwpCRpH0uEJqqo4+5flmtPp1KF9MBoEieADQgwCTBjAcwQjEMS0nw+EgB5MHGimTzMchHEjLYtp26YBoTt9CkeQMQAXXoExE3QTmQpklp6KXnCMEA34lkYugfSgkEzgpceyb2GgvcKDNiSADZHbyJI7fIj0iCPzOHTGWfDYBmjpnAE9652TYJ3XMEXnnXb9hbq03fl596IBn/emF3irwAttTvqb/EbuYmhqILMqugFkYIJMjeQ7huRr8pruB0G2PXSGrj2VDR3lSQgp6CoUinS7mpXLp4KpmgUjeeia3nlhY5KVSeSSgo4sKoMDcAwwBT4i8JGUKhtBAgzcUsD4sWOkAm8NbKR1Zz9gh1Ecl8uwjp90BPQtKDsmB1igXNJJ5VaCaodAL5oNkT5zn6E9citQAjnOwpFLd4bRGgWdxskPyg0qXshkhNHThajBuIQu9KHlS1ZQ/98TSRL6CVqjyuQ1iWMoLahbAQ4mXP0B4ye6TEA6kMuJVnF/TRBHZ6hUf4wa8/3dtSFg6jG2Y7l0AwXnSGapNDglQMo0TcGnuB/PPj3Muqi6y9zkIrKzsuleqUtVC0YyoZEPMJ/LdCmXNBLc81ZpKiaqgxTppRaeFkFIazRzET3Hie70osnEnNWXqzzpk/L2fxomqVzXBSQpU5aY2ME4J8SLuidL5R0HJSJK1p9SonmKnjd6NplQxZLskgoaRdGelkoNHkUckJE+L81qbjLKduq1F8+pxsKZ+55iEXXLKMujOioK29DKQDWpHC3mGpnkkVMBxVanKOGcJZ5ebdG63hnlZwBtD4fVYVNci/uZak29UI5xrXpr0MZlkEtJNwvzsrR9c4BWUbyu9PsF6v0yMqohnrguvDuTxIZb3mOy81QU/gfYl3cL+221Oqy3b4N9+Srsq1vYVxn2GfYZ9hn2Dwv76l5hvzuUq6au3wb76lXY17ewrzPsM+wz7DPsHxb2m3uF/X5Trw717m2w37wK++YW9k2GfYZ9hn2G/cPCvr5b2O8J9ofqZ/2zL29hX2bYZ9hn2GfYPyzst3cL+8N6td29Efav/7Pf3MJ+k2GfYZ9hn2H/sLBv7hb2e9Kl2vysf/bbW9hvM+wz7DPsM+wfFva7u4V9c1g1zf5n/bPf3cJ+l2GfYZ9hn2H/ULD/D6xmM5BoLwAA' SMC_MOCK_CPU_MODEL='142' SMC_MOCK_CPU_STEPPING='12' SMC_MOCK_CPU_UCODE='0xf8' SMC_MOCK_CPU_VENDOR='GenuineIntel' SMC_MOCK_RDMSR_0x10a='34212907' SMC_MOCK_RDMSR_0x123='4' SMC_MOCK_RDMSR_0x48='1' SMC_MOCK_SYSFS_srbds='Mitigation: Microcode'
Need more detailed information about mitigation options? Use --explain
A false sense of security is worse than no security at all, see --disclaimer