Skip to content

Flawed use of mitigations=auto,nosmt #320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adrelanos merged 5 commits into from
Dec 19, 2025
Merged

Flawed use of mitigations=auto,nosmt #320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b9deefe
Incompleteness of `mitigations=auto,nosmt`
raja-grewal Sep 25, 2025
78492e0
README: Do not rely on `mitigations=auto`
raja-grewal Sep 25, 2025
4340bf5
Warnings about using `mitigations=auto,nosmt`
raja-grewal Sep 29, 2025
635c216
Update docs on CPU mitigations
raja-grewal Nov 5, 2025
b8f7806
Update usage of `mitigations=auto,nosmt`
raja-grewal Dec 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,11 @@ Mitigations for known CPU vulnerabilities are enabled in their strictest form
and simultaneous multithreading (SMT) is disabled. See the
`/etc/default/grub.d/40_cpu_mitigations.cfg` configuration file.

Importantly, we do not rely on the use of the already enabled-by-default `mitigations=auto`
kernel boot parameter to perform CPU mitigations like many other distributions. This is
because it's use is both totally redundant and it does not apply all hardening settings
to their strictest possible levels. See issue: https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859.

Note, to achieve complete protection for known CPU vulnerabilities, the latest
security microcode (BIOS/UEFI) updates must be installed on the system. Furthermore,
if using Secure Boot, the Secure Boot Forbidden Signature Database (DBX) must be kept
Expand Down
12 changes: 11 additions & 1 deletion etc/default/grub.d/40_cpu_mitigations.cfg#security-misc-shared
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,11 +34,21 @@
## https://uefi.org/revocationlistfile
## https://github.com/fwupd/fwupd

## Enable a subset of known mitigations for some CPU vulnerabilities and disable SMT.
## Enable a subset of known default mitigations for some CPU vulnerabilities and disable SMT.
## Note that this redundant parameter simply applies each mitigation at the already applied default settings.
## The default values are not always the strictest and so we reapply each below to their highest setting.
## We retain it here for completeness as many other distributions heavily rely on this for many CPU mitigations.
##
## https://github.com/Kicksecure/security-misc/issues/199#issuecomment-3327391859
## https://github.com/secureblue/secureblue/issues/1405
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/attack_vector_controls.html
##
## KSPP=yes
## KSPP sets the kernel parameters.
##
## WARNING: Do not rely on this parameter, it is presented here only for educational purposes.
## WARNING: Parameters are applied consecutively and so do not ever move this setting down.
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mitigations=auto,nosmt"

## Disable SMT as it has been the cause of and amplified numerous CPU exploits.
Expand Down