Interesting development on the future of implementing CPU mitigations.
If this is merged, all we will have to set is the boot parameters:
mitigation_user_kernel=on
mitigate_user_user=on
mitigate_guest_host=on
mitigate_guest_guest=on
mitigate_cross_thread=on
This will be a greatly reduce the maintenance burden as we will (ideally) no longer have to manually apply newer mitigations. This is of course assuming that they are all applied in their strictest forms.
Note:
In the kernel patch, see the table under the heading
+Summary of attack-vector mitigations
+------------------------------------
for details on what mitigations each proposed boot parameter enables. I can’t seem to copy that table here while preserving the formatting.
2 Likes
VirtualBox ICH AC97 audio device broken due to kernel module blacklisting:
1 Like
1 Like
1 Like
1 Like
1 Like
1 Like
1 Like
1 Like
1 Like
related:
1 Like