Checking for vulnerabilities on current system
Kernel is FreeBSD 12.2-RELEASE-p14 FreeBSD 12.2-RELEASE-p14 325282c09a5(HEAD) TRUENAS  amd64
CPU is Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz

Hardware check
* Hardware support (CPU microcode) for mitigation techniques
  * Indirect Branch Restricted Speculation (IBRS)
    * SPEC_CTRL MSR is available:  YES
    * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)
  * Indirect Branch Prediction Barrier (IBPB)
    * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)
  * Single Thread Indirect Branch Predictors (STIBP)
    * SPEC_CTRL MSR is available:  YES
    * CPU indicates STIBP capability:  YES  (Intel STIBP feature bit)
  * Speculative Store Bypass Disable (SSBD)
    * CPU indicates SSBD capability:  YES  (Intel SSBD)
  * L1 data cache invalidation
    * CPU indicates L1D flush capability:  YES  (L1D flush feature bit)
  * Microarchitectural Data Sampling
    * VERW instruction is available:  YES  (MD_CLEAR feature bit)
  * Indirect Branch Predictor Controls
    * Indirect Predictor Disable feature is available:  NO
    * Bottomless RSB Disable feature is available:  NO
    * BHB-Focused Indirect Predictor Disable feature is available:  NO
  * Enhanced IBRS (IBRS_ALL)
    * CPU indicates ARCH_CAPABILITIES MSR availability:  NO
    * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO
  * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO):  NO
  * CPU explicitly indicates not being affected by Variant 4 (SSB_NO):  NO
  * CPU/Hypervisor indicates L1D flushing is not necessary on this system:  NO
  * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA):  NO
  * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO):  NO
  * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO):  NO
  * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO):  NO
  * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR):  NO
  * CPU supports Transactional Synchronization Extensions (TSX):  NO
  * CPU supports Software Guard Extensions (SGX):  NO
  * CPU supports Special Register Buffer Data Sampling (SRBDS):  NO
  * CPU microcode is known to cause stability problems:  NO  (family 0x6 model 0x3a stepping 0x9 ucode 0x21 cpuid 0x306a9)
  * CPU microcode is the latest known available version:  YES  (latest version is 0x21 dated 2019/02/13 according to builtin firmwares DB v222+i20220208)
* CPU vulnerability to the speculative execution attack variants
  * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass):  YES
  * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES
  * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  YES
  * Affected by CVE-2018-3640 (Variant 3a, rogue system register read):  YES
  * Affected by CVE-2018-3639 (Variant 4, speculative store bypass):  YES
  * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  NO
  * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  YES
  * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  YES
  * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)):  YES
  * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)):  YES
  * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)):  YES
  * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)):  YES
  * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)):  NO
  * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)):  YES
  * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)):  YES

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
> STATUS:  VULNERABLE  (no mitigation for BSD yet)

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigation 1
  * Kernel supports IBRS:  YES
  * IBRS enabled and active:  NO
* Mitigation 2
  * Kernel compiled with RETPOLINE:  NO
> STATUS:  VULNERABLE  (IBRS is supported but administratively disabled on your system)

CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Kernel supports Page Table Isolation (PTI):  YES
  * PTI enabled and active:  YES
  * Reduced performance impact of PTI:  YES  (CPU supports PCID, performance impact of PTI will be reduced)
> STATUS:  NOT VULNERABLE  (PTI mitigates the vulnerability)

CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability:  YES
> STATUS:  NOT VULNERABLE  (your CPU microcode mitigates the vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Kernel supports speculation store bypass:  YES
* Speculation store bypass is administratively enabled:  NO  (disabled)
* Speculation store bypass is currently active:  NO
> STATUS:  VULNERABLE  (you need to enable SSBD through sysctl to mitigate the vulnerability)

CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability:  N/A
> STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected)

CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Kernel reserved the memory page at physical address 0x0:  YES
> STATUS:  NOT VULNERABLE  (kernel mitigates the vulnerability)

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Kernel supports L1D flushing:  YES
* L1D flushing is enabled:  YES
> STATUS:  NOT VULNERABLE  (L1D flushing mitigates the vulnerability)

CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* Kernel supports using MD_CLEAR mitigation:  YES
* CPU Hyper-Threading (SMT) is disabled:  NO
* Kernel mitigation is enabled:  NO
* Kernel mitigation is active:  NO
> STATUS:  VULNERABLE  (Your microcode and kernel are both up to date for this mitigation, but the mitigation is not active)

CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* Kernel supports using MD_CLEAR mitigation:  YES
* CPU Hyper-Threading (SMT) is disabled:  NO
* Kernel mitigation is enabled:  NO
* Kernel mitigation is active:  NO
> STATUS:  VULNERABLE  (Your microcode and kernel are both up to date for this mitigation, but the mitigation is not active)

CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* Kernel supports using MD_CLEAR mitigation:  YES
* CPU Hyper-Threading (SMT) is disabled:  NO
* Kernel mitigation is enabled:  NO
* Kernel mitigation is active:  NO
> STATUS:  VULNERABLE  (Your microcode and kernel are both up to date for this mitigation, but the mitigation is not active)

CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* Kernel supports using MD_CLEAR mitigation:  YES
* CPU Hyper-Threading (SMT) is disabled:  NO
* Kernel mitigation is enabled:  NO
* Kernel mitigation is active:  NO
> STATUS:  VULNERABLE  (Your microcode and kernel are both up to date for this mitigation, but the mitigation is not active)

CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)'
> STATUS:  NOT VULNERABLE  (your CPU vendor reported your CPU model as not affected)

CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)'
* Kernel supports disabling superpages for executable mappings under EPT:  YES
* Superpages are disabled for executable mappings under EPT:  NO
> STATUS:  VULNERABLE  (Your kernel supports mitigating this CVE, but the mitigation is disabled)

CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)'
> STATUS:  UNKNOWN  (your CPU is affected, but mitigation detection has not yet been implemented for BSD in this script)

> SUMMARY: CVE-2017-5753:KO CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:KO CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO CVE-2019-11135:OK CVE-2018-12207:KO CVE-2020-0543:??