Kernel Hardening - security-misc

Development
523

This was merged.

524

How about Speculative Return Stack Overflow (SRSO) — The Linux Kernel documentation?

Quote https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt

	spec_rstack_overflow=
			[X86] Control RAS overflow mitigation on AMD Zen CPUs

			off		- Disable mitigation
			microcode	- Enable microcode mitigation only
			safe-ret	- Enable sw-only safe RET mitigation (default)
			ibpb		- Enable mitigation by issuing IBPB on
					  kernel entry
			ibpb-vmexit	- Issue IBPB only on VMEXIT
					  (cloud-specific mitigation)

See also:

cat /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow
525
526
527