Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-28 02:49:25 -05:00
Code Issues Packages Projects Releases Wiki Activity

spelling

Browse Source
This commit is contained in:
Patrick Schleizer 2024-07-17 11:44:17 -04:00
parent 9e976474d5
commit f4da582aa3
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/default/grub.d/40_cpu_mitigations.cfg
View File

@ -18,7 +18,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"
## Disable SMT as it has been the cause of and amplified numerous CPU exploits.
## The only full mitigation of cross-HT attacks is to disable SMT.
## Disabling will significantly decrease system performance on multi-threaded tasks.
## To enable SMT, remove this line all other occurrences of "nosmt" in this file.
## To enable SMT, remove this line and all other occurrences of "nosmt" in this file.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/core-scheduling.html
## https://forums.whonix.org/t/should-all-kernel-patches-for-cpu-bugs-be-unconditionally-enabled-vs-performance-vs-applicability/7647/17
@ -54,7 +54,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX l1tf=full,force"
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mds=full,nosmt"
## Patches the TAA vulnerability by disabling TSX and enable mitigations using
## Patches the TAA vulnerability by disabling TSX and enables mitigations using
## TSX Async Abort along with disabling SMT.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
@ -97,7 +97,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX retbleed=auto,nosmt"
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html
##
## The default kernel setting will be utilised until provided sufficient evidence to modify.
## The default kernel setting will be utilized until provided sufficient evidence to modify.
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX spec_rstack_overflow=safe-ret"