Centralized CPU issue mitigation control (incl. CPU side-channel leak attacks)

This document (7023836) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15

SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 11

Situation

Since January 2018, various CPU side-channel information leaks have been published, starting with Spectre and Meltdown going up to L1 Terminal Fault in August 2018.

For all the software mitigations that were deployed, one or more kernel boot command line options were added that enable, disable or control the behavior of the mitigations.

Additionally all the mitigations also do auto-detection of affected CPUs.

While SUSE tries to release updates with sensible secure defaults, we cannot foresee the balancing between performance and security depending on the usage scenario.

Resolution

The upstream kernel team has introduced a new 'meta' command line option called "mitigations" that controls all the current options for CPU issues in an easy to understand manner and centralized place.

SUSE is backporting this option to its currently supported and maintained kernels, starting with SUSE Linux Enterprise 15, 12 SP3 and newer kernels.

This setting will also be configurable in the SUSE Linux Enterprise 15 SP1 and later versions during installation.

The "mitigations" option has following settings:

mitigations=off

All CPU side channel mitigations are disabled. This setting gives the highest performance, but least security and should only be used in settings where no untrusted code is used.

mitigations=auto

All CPU side channel mitigations are enabled as they are detected based on the CPU type. The auto-detection handles both unaffected older CPUs and unaffected newly released CPUs and transparently disables mitigations.

This options leave SMT enabled.

mitigations=auto,nosmt

The same as the auto option for mitigations, additionally the symmetric multi-threading of the CPU is disabled if necessary, for instance to mitigate the L1 Terminal Fault side channel issue.

Cause

CPU side-channel leak attacks

Additional Information

TID 7022512 - Security Vulnerability: "Meltdown" and "Spectre" side channel attacks against CPUs with speculative execution.

TID 7022937 - Security Vulnerability: Spectre Variant 4 (Speculative Store Bypass) aka CVE-2018-3639.

TID 7023075 - Security Vulnerability: Spectre side channel attack "Bounds Check Bypass Store" aka CVE-2018-3693.

TID 7023076 - Security Vulnerability: Spectre side channel attack "Lazy FPU Save/Restore" aka CVE-2018-3665.

TID 7023077 - Security Vulnerability: "L1 Terminal Fault" (L1TF) aka CVE-2018-3615, CVE-2018-3620 & CVE-2018-3646.
TID 000019643 - Security Vulnerability: Special Register Buffer Data Sampling aka CrossTalk (CVE-2020-0543)

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.