Valid HTML 4.01 Transitional Valid CSS Valid SVG 1.0

Me, myself & IT

Meltdown, Spectre and Spectre-NG Update Check Utility

Purpose

The Windows® application BTI_RDCL.EXE displays the status of the mitigations for the vulnerabilities CVE-2017-5715 alias Branch Target Injection and CVE-2017-5754 alias Rogue Data Cache Load, better known by their nicknames Meltdown and Spectre, as well as the mitigation for the vulnerability CVE-2018-3639 alias Speculative Store Bypass, also known as Spectre-NG or Variant 4.
The mitigations are installed by one of the security updates 4056888, 4056890, 4056891, 4056892, 4056893, 4056894, 4056895, 4056896, 4056897, 4056898 and 4056899, the subsequent updates 4057142, 4057144, 4075199, 4075200, 4057400, 4057401, 4057402, 4073290, 4073291, 4073576 and 4073578, or their successors.

Note: the status of the mitigations for the vulnerabilities CVE-2017-5753 alias Bounds Check Bypass and CVE-2018-3693 alias Bounds Check Bypass Store can’t be shown: every sequence of machine code which is susceptible to these vulnerabilities needs to be fixed individually!

Background Information

The MSKB articles 4072698, 4072699, 4073065, 4073119, 4073225, 4073229, 4073237, 4073707, 4073757, 4078130 and 4078407 provide information about the updates.

The MSKB articles 4090007, 4091663, 4091664, 4091666 and 4093836 provide information about the microcode updates distributed through the Microsoft Update Catalog.

Operation

[Screenshot of BTI_RDCL.EXE without security update for 'Meltdown' (CVE-2017-5754), 'Spectre' (CVE-2017-5715, CVE-2017-5753) and 'Spectre-NG' (CVE-2018-3639, CVE-2018-3640)] Without security update installed, BTI_RDCL.EXE displays two message boxes like that shown on the right.

With security update installed, BTI_RDCL.EXE displays two message boxes like those shown below.

[Screenshot of BTI_RDCL.EXE with active mitigation for 'Meltdown' (CVE-2017-5754)] [Screenshot of BTI_RDCL.EXE with active mitigation for 'Spectre' (CVE-2017-5715)]

Implementation and Build Details

BTI_RDCL.EXE is a pure Win32 application, written in ANSI C, built with the Platform SDK for Windows Server 2003 R2 Microsoft Visual C++ Compiler 2010 SP1 from update 2519277, but without the MSVCRT libraries, for use on Windows 2000 XP and newer versions of Windows NT as well as Windows PE.

Authenticity and Integrity

BTI_RDCL.EXE is digitally signed using an X.509 certificate issued by WEB.DE TrustCenter E-Mail Certification Authority.
Serial number of the certificate
73780985
0x0465CEF9
Fingerprint of the certificate
MD5: 33 33 6e 1d 26 18 a7 c2 be 87 11 68 05 2c 70 09
SHA-1: 8c 5b 75 21 40 41 77 ac 54 13 13 02 06 6b b0 69 10 2e 83 0e
-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEA6ipnm9vAs63w+TM+9UcG1yQ8CRIxMz/tTXry9MCbeHpkiM/qdPaRWlwVTW2j
PhC81xwIPZXgE1FE4DgE1eImb33DG2YfEBY/ARpMaGUnme+85WmExWWc/YMUAaHOMYQ3TQDX
0V/7yuhfa9Uc29ljtQ2AB0MjhXTJvGguvZZTI5A3rcN4+AKwmETdYH+8OQKMU2s+2H9CVfaD
waX0aj9CeibGNooLTgDchzCBIC5J47qHned/3ZqnMDjYCv3Yc1HNgcbM+ZKzPoD8jShb/ptI
wWPo9s00KEs9ti68RsmejqKovAmdLSzFLGARbue2uiqs4piJkxI0LS5+NTTPyZjsSwIDAQAB
-----END RSA PUBLIC KEY-----
Download and install the CA and root X.509 certificates of WEB.DE to validate and verify the digital signature.

Note: due to its counter signature alias timestamp the digital signature remains valid past the X.509 certificates expiration date!

Makefile and Build Instructions

Optionally perform the following four simple steps to build BTI_RDCL.EXE from the source and sign it with your own X.509 certificate.
  1. Download the makefile BTI_RDCL.MAK and save it in an arbitrary, preferable empty directory.

  2. Download the Meltdown icon and save it as MELTDOWN.ICO in the directory used in step 1.

  3. Download the Spectre icon and save it as SPECTRE.ICO in the directory used in step 1.

  4. Run the following command line to build BTI_RDCL.EXE:

    NMAKE.EXE /R /F BTI_RDCL.MAK

Contact

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, errors, inaccuracies, omissions, vulnerabilities or weaknesses, …:
don’t hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Notes: I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname!
Emails in weird formats and without a proper sender name are likely to be discarded.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!

Data Protection Declaration

This web page records no data and sets no cookies.

The service provider for *.homepage.t-online.de, Deutsche Telekom AG,


Copyright © 1995–2018 • Stefan Kanthak • <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>