Hacker News Reader

Comment by tgragnato | Hacker News Reader

> What do I have to add to my kernel command line?

Paranoid users of Ubuntu and Debian can install this package: https://packages.debian.org/bullseye/hardening-runtime . Then reboot.

It disables SMT, so independently of mitigations you won’t be vulnerable, but of course Hyper-Threading will be gone.

View on HN

While I'm sure there are folks that would appreciate the mitigation provided by that package, I'm not sure it provides any mitigation to this _specific_ exploit.

The in-kernel Spectre-v1 mitigations, like:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

are cheap and ubiquitous. You don't have to turn them on, and they're so cheap you can't even turn them off if you wanted.

Disclaimer: I work on Linux at Intel.

I have a much more up-to-date and comprehensive GPL-3.0 package called 'brace' available here: https://github.com/divestedcg/brace

Supports Fedora, Arch, Debian, and openSUSE.

Has GNOME, Firefox, kernel cmdline, sysctl, firewalld, NetworkManager, and systemd unit hardening among other things.

Goes well with firejail (am a developer of): https://github.com/netblue30/firejail

That is besides processor's microcode mitigations right? Which can be applied using respective ucode packages and grub on Linux.

You can do it while using microcode patches and software mitigations or not: it’s a hardening measure because SMT usually shares TLBs and L1s between threads.

No SMT, no sharing of TLBs and L1s (I know that writing it this way is a gross oversimplification).

Thanks!

I'd favor the kernel command line path over using a package, any ideas on which are needed to fix this particular exploit kit at hand?

hardening-runtime modifies the Linux kernel command line (as well as the sysctl config), hence the need to reboot.

Reply on news.ycombinator.com