Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-13 07:41:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #292 from raja-grewal/cpu_table

Browse Source 
Add link to tabular comparison of CPU mitigations
This commit is contained in:
Patrick Schleizer 2025-01-10 10:30:34 -05:00 committed by GitHub
commit e9ef3602dd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -136,7 +136,9 @@ Networking:
Mitigations for known CPU vulnerabilities are enabled in their strictest form Mitigations for known CPU vulnerabilities are enabled in their strictest form
and simultaneous multithreading (SMT) is disabled. See the and simultaneous multithreading (SMT) is disabled. See the
`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. `/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. Note, to achieve
complete protection for known CPU vulnerabilities, the latest security microcode
(BIOS/UEFI) updates must also be installed on the system.
Boot parameters relating to kernel hardening, DMA mitigations, and entropy Boot parameters relating to kernel hardening, DMA mitigations, and entropy
generation are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg` generation are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg`

8
etc/default/grub.d/40_cpu_mitigations.cfg
View File

@ -18,6 +18,14 @@
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html ## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html
## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html ## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html
## Tabular comparison between the utility and functionality of various mitigations.
## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587
## For complete protection, users must install the latest relevant security microcode update.
## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers.
## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues.
## The parameters below only provide (partial) protection at both the kernel and user space level.
## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT. ## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT.
## ##
## KSPP=yes ## KSPP=yes