mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-22 22:03:49 +07:00
Code Issues Packages Projects Releases Wiki Activity

Minor additions

Browse Source
This commit is contained in:
raja-grewal 2024-12-18 03:32:35 +00:00 committed by GitHub
parent 3e96fdd9cc
commit 0dff2cd28f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
etc/default/grub.d/40_cpu_mitigations.cfg
View File

@ -8,6 +8,7 @@
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## Enable known mitigations for CPU vulnerabilities.
## Note, the mitigations for SSB and Retbleed are not currently mentioned in the first link.
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
@ -40,6 +41,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"
## - Remove "nosmt=force".
## - Remove all occurrences of ",nosmt" in this file (note the comma ",").
## - Downgrade "l1tf=full,force" protection to "l1tf=flush".
## - Regenerate the dracut initramfs and then reboot system.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX nosmt=force"
@ -66,7 +68,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX ssbd=force-on"
## L1 Terminal Fault (L1TF):
## Mitigate the vulnerability by disabling L1D flush runtime control and SMT.
## If conditional L1D flushing, mitigate the vulnerability for certain KVM hypervisor configurations.
## If L1D flushing is conditional, mitigate the vulnerability for certain KVM hypervisor configurations.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html
@ -75,7 +77,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm-intel.vmentry_l1d_flush=always"
## Microarchitectural Data Sampling (MDS):
## Mitigate the vulnerability by clearing the buffer cache and disabling SMT.
## Mitigate the vulnerability by clearing the CPU buffer cache and disabling SMT.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html
@ -101,7 +103,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx_async_abort=full,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force"
## Special Register Buffer Data Sampling (SRBDS):
## Mitigation of the vulnerability is only possible via microcode updates from Intel.
## Mitigation of the vulnerability is only possible via microcode update from Intel.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/special-register-buffer-data-sampling.html
@ -115,8 +117,8 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force"
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"
## MMIO Stale Data:
## Mitigate the vulnerability by appropriately clearing the CPU buffer and disabling SMT.
## Processor MMIO Stale Data:
## Mitigate the vulnerabilities by appropriately clearing the CPU buffer and disabling SMT.
## Currently affects Intel CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
@ -143,7 +145,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.mitigate_smt_rsb=1"
## Speculative Return Stack Overflow (SRSO):
## Mitigate the vulnerability by ensureing all RET instructions speculate to a controlled location.
## Mitigate the vulnerability by ensuring all RET instructions speculate to a controlled location.
## Currently affects AMD Zen 1-4 CPUs.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html