Utility for mitigations CVE-2017-5715 and CVE-2017-5754 status check

Any changes of this update will be a part of the next cumulative update in any case.

 

Oh I went ahead and installed it from the Microsoft Update Catalog. No sense in waiting. On the downside, no microcode updates for my Kaby Lake included.

 

I wonder whether to update this utility to modern state of PowerShell script or just leave gurus with InSpectre...

 

I personally would prefer an update by you, I just prefer having the utilities on my PC created by the same author/collaborators. Less chance of utilities conflicting, authors I trust, same sites for keeping updated etc. Plus you've shown yourself to be more knowledgeable than 99.9% of other authors. Ultimately it's up to you and regardless of whether you update it or not I thought I should stop lurking and just thank you. Thanks for all the thankless work, saved me many a time with your posts.

 

@thiccsucc
http://www.mediafire.com/file/2321zihyiaefbzj/MitigationStatus.zip/file

Change log:

The code of utility was updated to match the PowerShell module SpeculationControl v.1.0.14

Buttons for enabling and disabling of mitigations were re-designed according to this guidance
https://support.microsoft.com/en-us...ive-execution-side-channel-vulnerabilities-in

Manifest of utility was changed to "require administrator" level.

 

@thiccsucc
http://www.mediafire.com/file/2321zihyiaefbzj/MitigationStatus.zip/file

Change log:

Changed the title of the app window to reflect the version of PowerShell module.

Added the button to remove mitigation values from the registry.

 

great tool

 

Literally helped me fix a windows insider bug that's been plaguing me for months, no matter how many clean installs I did the system always registered me as having all of the mitigations enabled + the microcode updates applied so I've been unable to update some rather important microcode versions for my chip for entirely too long. It actually stressed me out to the point I was about to just purchase and build a whole new machine. Ran your utility and it verified to windows what I've been struggling with for months and windows finally recognized that I had the mitigations disabled and that there was no microcode updates on my system. Enabled and downloaded, you literally saved me from spending at least a grand and half that I don't have.

Sorry it took so long to get back to you, you're literally my hero at this point. Is there anywhere I can donate or do something more substantial to thank you beyond just blathering and praising you.

 

stupid question: if I remove those values, what will be loaded at startup?

 

Some default state.
Remove values, reboot and launch utility again - you will see.

 

worked out fine.
thx for your tool

 

@mbk1969 can you add a way to disable Import Optimizations, i forget the exact hex to do this and i need to test without it off to check for an issue im experiencing with an alcohol virtual drive.

nvm, reran the alcohol installer and it "unblocked" the driver, ie, turned off kernel import optimizations.

 

I can add an edit control with the button so the user can enter needed value and click the button to save that value into registry.

 

I did add inspectre to my control panel but consider this vastly superior so will replace with this.

The problem with inspectre was that the guy made it to get his name out there, then didnt bother to update as newer cpus came out as well as newer mitigations so is effectively now out of date. As an example the fact I have the 9900k refresh which has meltdown mitigation built in confuses inspectre completely, as at the time it was made no intel cpus did that.

You have made some great tools, thanks.

 

should kernal support for retpoline be enabled? mine says false, I thought Window 10 had update while back that enabled it

 

It did, but I am unable to get it enabled on my laptop. Not sure why on that, but what I do know is it wont work on the very latest intel cpu's, they dont support retpoline on windows.

 

NVM I reading Skylake dont support it? and that is what I using I what I am using. prior gen cpu can use it either

@mbk1969 and chance your tool and show same info the speculationcontrol power shell tool will show? your is alot more friendly then that powershell tool but tool show other thing

your tool

Code:

Speculation control settings for CVE-2017-5715 [branch target injection aka Spectre V2]

Hardware support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is enabled: True
Windows OS support for kernel retpoline is enabled: False
Windows OS support for kernel import optimization is enabled: True



Speculation control settings for CVE-2018-3639 [speculative store bypass]

Windows OS support for speculative store bypass disable is present: True
Hardware is vulnerable to speculative store bypass: True
Hardware support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is enabled system-wide: False



Speculation control settings for MDS [microarchitectural data sampling]

Windows OS support for MDS mitigation is present: True
Hardware is vulnerable to MDS: True
Windows OS support for MDS mitigation is enabled: True



Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True
Windows OS support for kernel VA shadow is present: True
Windows OS support for kernel VA shadow is enabled: True
Windows OS support for PCID performance optimization is enabled: True [not required for security]



Speculation control settings for CVE-2018-3620 [L1 terminal fault]

Hardware is vulnerable to L1 terminal fault: True
Windows OS support for L1 terminal fault mitigation is present: True
Windows OS support for L1 terminal fault mitigation is enabled: True



Additional CPU information

Name: Intel(R) Core(TM) i7-6700K CPU @ 4.00GHz
Description: Intel64 Family 6 Model 94 Stepping 3
CPUID: 000506E3



Additional OS information

Name: Microsoft Windows 10 Pro
Architecture: 64-bit
Build: 19042
SKU: 48
Service Pack: 0.0

speculationcontrol powershell

Code:

Speculation control settings for CVE-2017-5715 [branch target injection]

Hardware support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is enabled: True

Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True
Windows OS support for kernel VA shadow is present: True
Windows OS support for kernel VA shadow is enabled: True
Windows OS support for PCID performance optimization is enabled: True [not required for security]

Speculation control settings for CVE-2018-3639 [speculative store bypass]

Hardware is vulnerable to speculative store bypass: True
Hardware support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is enabled system-wide: False

Speculation control settings for CVE-2018-3620 [L1 terminal fault]

Hardware is vulnerable to L1 terminal fault: True
Windows OS support for L1 terminal fault mitigation is present: True
Windows OS support for L1 terminal fault mitigation is enabled: True

Speculation control settings for MDS [microarchitectural data sampling]

Windows OS support for MDS mitigation is present: True
Hardware is vulnerable to MDS: True
Windows OS support for MDS mitigation is enabled: True


BTIHardwarePresent                  : True
BTIWindowsSupportPresent            : True
BTIWindowsSupportEnabled            : True
BTIDisabledBySystemPolicy           : False
BTIDisabledByNoHardwareSupport      : False
BTIKernelRetpolineEnabled           : False
BTIKernelImportOptimizationEnabled  : True
KVAShadowRequired                   : True
KVAShadowWindowsSupportPresent      : True
KVAShadowWindowsSupportEnabled      : True
KVAShadowPcidEnabled                : True
SSBDWindowsSupportPresent           : True
SSBDHardwareVulnerable              : True
SSBDHardwarePresent                 : True
SSBDWindowsSupportEnabledSystemWide : False
L1TFHardwareVulnerable              : True
L1TFWindowsSupportPresent           : True
L1TFWindowsSupportEnabled           : True
L1TFInvalidPteBit                   : 45
L1DFlushSupported                   : True
MDSWindowsSupportPresent            : True
MDSHardwareVulnerable               : True
MDSWindowsSupportEnabled            : True

your tool much more easier to use

 

Here is mine on a 3570k latest OS (stock settings).
Speculation control settings for CVE-2017-5715 [branch target injection aka Spectre V2]

Hardware support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is present: True
Windows OS support for branch target injection mitigation is enabled: True
Windows OS support for kernel retpoline is enabled: True
Windows OS support for kernel import optimization is enabled: True



Speculation control settings for CVE-2018-3639 [speculative store bypass]

Windows OS support for speculative store bypass disable is present: True
Hardware is vulnerable to speculative store bypass: True
Hardware support for speculative store bypass disable is present: True
Windows OS support for speculative store bypass disable is enabled system-wide: False



Speculation control settings for MDS [microarchitectural data sampling]

Windows OS support for MDS mitigation is present: True
Hardware is vulnerable to MDS: True
Windows OS support for MDS mitigation is enabled: True



Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True
Windows OS support for kernel VA shadow is present: True
Windows OS support for kernel VA shadow is enabled: True
Windows OS support for PCID performance optimization is enabled: False [not required for security]



Speculation control settings for CVE-2018-3620 [L1 terminal fault]

Hardware is vulnerable to L1 terminal fault: True
Windows OS support for L1 terminal fault mitigation is present: True
Windows OS support for L1 terminal fault mitigation is enabled: True

 

odd you have older CPU then mine but it support Repoline? or did you manual enable it? Can one have OS support true and still have CPU that dont support it?

Or did I read it wrong CPU skylake and Newer dont support it