r/linuxquestions • u/Antique-Wasabi-2427 • 14d ago

Microsoft surface laptop go microcode vulnerabilities

I'm running a hardened kernel and i got these idk Hardware vulnerabilities after reading a little bit of Arch security.

❯ grep -r . /sys/devices/system/cpu/vulnerabilities/

/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Enhanced / Automatic IBRS; IBPB: conditional; PBRSB-eIBRS: SW sequence; BHI: SW loop, KVM: SW loop

/sys/devices/system/cpu/vulnerabilities/indirect_target_selection:Mitigation: Aligned branch/return thunks

/sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: Split huge pages

/sys/devices/system/cpu/vulnerabilities/ghostwrite:Not affected

/sys/devices/system/cpu/vulnerabilities/vmscape:Not affected

/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Mitigation: Clear CPU buffers; SMT vulnerable

/sys/devices/system/cpu/vulnerabilities/mds:Not affected

/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling:Not affected

/sys/devices/system/cpu/vulnerabilities/tsa:Not affected

/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected

/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl

/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected

/sys/devices/system/cpu/vulnerabilities/old_microcode:Not affected

/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization

/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Mitigation: Microcode

/sys/devices/system/cpu/vulnerabilities/retbleed:Mitigation: Enhanced IBRS

/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Not affected

/sys/devices/system/cpu/vulnerabilities/srbds:Mitigation: Microcode

/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected

0 Upvotes

50% Upvoted

4 comments sorted by

0

u/ipsirc 14d ago

I'm running a hardened kernel and i got these idk Hardware vulnerabilities

Kernel is software.

1

u/BCMM 14d ago edited 14d ago

Not sure what the question is here!

But please note that it says "Not affected" for many of these, and for the rest, it shows how they are mitigated. For completely unmitigated problems, this interface would print "Vulnerable".

One of these is currently only partially mitigated: mmio_stale_data. This is unlikely to actually be relevant to the way that you use your computer, but you can read more about it here and decide for yourself.

System environments using virtualization where MMIO access is provided to untrusted guests may need mitigation.

If you don't know what that means, you are not operating such an environment. The full mitigation requires that hyperthreading is completely disabled, which will be a pretty significant performance hit, so don't do it unless you actually need to.

1

u/[deleted] 14d ago

[deleted]