Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-05-09 12:24:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #197 from raja-grewal/mitigations

Browse source 
Additional Explicit CPU Mitigations
This commit is contained in:
Patrick Schleizer 2024-02-03 12:50:28 -05:00 • committed by GitHub
commit ba13657d89
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
etc/default/grub.d/40_cpu_mitigations.cfg
View file

@ -4,8 +4,12 @@
## Enables all known mitigations for CPU vulnerabilities. ## Enables all known mitigations for CPU vulnerabilities.
## ##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html
## https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647 ## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647
## Enable known mitigations for CPU vulnerabilities and disable SMT.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"
## Enable mitigations for Spectre variant 2 (indirect branch speculation). ## Enable mitigations for Spectre variant 2 (indirect branch speculation).
## ##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/spectre.html
@ -59,3 +63,15 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1d_flush=on"
## ##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt" GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mmio_stale_data=full,nosmt"
## Enable mitigations for RETBleed (Arbitrary Speculative Code Execution with
## Return Instructions) vulnerability and disable SMT.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
## Control RAS overflow mitigation on AMD Zen CPUs.
## The current default kernel parameter is 'spec_rstack_overflow=safe-ret'
## This default will used until provided sufficient evidence to modify.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html