This commit is contained in:
Patrick Schleizer 2020-02-13 13:38:21 -05:00
parent 76a51a3b45
commit d1fa191bc0
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48

View File

@ -48,12 +48,7 @@ on uncorrectable errors in ECC memory that could be exploited.
* Kernel Page Table Isolation is enabled to mitigate Meltdown and increase
KASLR effectiveness.
* SMT is disabled as it can be used to exploit the MDS and other
vulnerabilities.
* All mitigations for the MDS vulnerability are enabled.
* Enables mitigations for the L1TF (L1 Terminal Fault) vulnerability.
* Enables all mitigations for CPU vulnerabilities and disables SMT.
* A systemd service clears System.map on boot as these contain kernel symbols
that could be useful to an attacker.