As the number of supported modes in the Linux kernel to counter CPU vulnerabilities has reached 15, and listing all vulnerabilities in the kernel command line has become quite a complex task, a kernel developer from AMD suggested transitioning from configuring specific vulnerabilities to selecting attack vector blockades.
The proposed blocking methods are suggested to be activated depending on the type of isolation violation: between user and kernel (mitigate_user_kernel), between user and another user (mitigate_user_user), between guest system and host environment (mitigate_guest_host), between different guest systems (mitigate_guest_guest), and between different threads (mitigate_cross_thread).
The proposed approach will allow activating only the protection against those classes of vulnerabilities that genuinely concern the user. For instance, cloud environment owners can enable mode mitigate_guest_host and mitigate_guest_guest, after which protection methods against vulnerabilities BHI, GD, L1TF, MDS, MMIO, Retbleed, RFDS, Spectre_v2, SRBDS, SRSO, and TAA will be activated. =============== ============== ============ ============= ============== ============ Vulnerability User-to-Kernel User-to-User Guest-to-Host Guest-to-Guest Cross-Thread =============== ============== ============ ============= ============== ============ BHI X X GDS X X X X L1TF X X MDS X X X X X MMIO X X X X X Meltdown X Retbleed X X X RFDS X X X X Spectre_v1 X Spectre_v2 X X Spectre_v2_user X X SRBDS X X X X SRSO X X SSB TAA X X X X X
Source: opennet.ru
