From 642b4eeedc43e69bb82ea259b52c0946ce638983 Mon Sep 17 00:00:00 2001 From: raja-grewal Date: Thu, 19 Dec 2024 21:57:25 +1100 Subject: [PATCH 1/3] Add link to tabular comparison of CPU mitigations --- etc/default/grub.d/40_cpu_mitigations.cfg | 3 +++ 1 file changed, 3 insertions(+) diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg b/etc/default/grub.d/40_cpu_mitigations.cfg index fa750b76..d2232b3d 100644 --- a/etc/default/grub.d/40_cpu_mitigations.cfg +++ b/etc/default/grub.d/40_cpu_mitigations.cfg @@ -18,6 +18,9 @@ ## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/advisory-guidance.html ## https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/disclosure-documentation.html +## Tabular comparison between the utility and functionality of various mitigations. +## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587 + ## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT. ## ## KSPP=yes From 538b312349a97bcecb12e62519d77840afcd6ca3 Mon Sep 17 00:00:00 2001 From: raja-grewal Date: Thu, 9 Jan 2025 15:28:56 +1100 Subject: [PATCH 2/3] Add comment about microcode updates --- etc/default/grub.d/40_cpu_mitigations.cfg | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg b/etc/default/grub.d/40_cpu_mitigations.cfg index d2232b3d..795cc725 100644 --- a/etc/default/grub.d/40_cpu_mitigations.cfg +++ b/etc/default/grub.d/40_cpu_mitigations.cfg @@ -21,6 +21,11 @@ ## Tabular comparison between the utility and functionality of various mitigations. ## https://forums.whonix.org/t/kernel-hardening-security-misc/7296/587 +## For complete protection, users must install the latest relevant security microcode update. +## BIOS/UEFI updates should only be obtained directly from OEMs and/or motherboard manufacturers. +## Note that incorrectly performing system BIOS/UEFI updates can potentially lead to serious functionality issues. +## The parameters below only provide (partial) protection at both the kernel and user space level. + ## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT. ## ## KSPP=yes From cf435a8fa8e6f795a25ef004cf44a65d461dd32c Mon Sep 17 00:00:00 2001 From: raja-grewal Date: Fri, 10 Jan 2025 13:22:21 +1100 Subject: [PATCH 3/3] README.md: Note importance of microcode updates --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index df12ba2d..05685b4c 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,9 @@ Networking: Mitigations for known CPU vulnerabilities are enabled in their strictest form and simultaneous multithreading (SMT) is disabled. See the -`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. +`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file. Note, to achieve +complete protection for known CPU vulnerabilities, the latest security microcode +(BIOS/UEFI) updates must also be installed on the system. Boot parameters relating to kernel hardening, DMA mitigations, and entropy generation are outlined in the `/etc/default/grub.d/40_kernel_hardening.cfg`