0

I have found a log in my /log/messages showing a CVE-2018-3646 error with the following link, (https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html). I have accessed the mentioned file-path from the link (/sys/devices/system/cpu/vulnerabilities/l1tf) to check for specific vulnerabilities and it said 'Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable'. How can I fix this? Could there be any possible consequences from altering these settings?

Improve this question

2 Answers 2

Reset to default
2

Guest mitigation mechanisms lists everything you can do. The easiest solution: boot with l1tf=full kvm-intel.vmentry_l1d_flush=always. This will destroy performance (specially multithreaded since this option disables hyperthreading) but it looks like you're not exactly interested in real implications of the vulnerability, you're just interested in solving it no matter what.

As a reminder: to this day there have been zero exploits found in the wild using architectural errors in CPUs.

Improve this answer
2
  • Could you clarify on what you mean by real implications?
    – Mel
    Commented May 15, 2022 at 14:16
  • 1
    Exploit vectors/possible exploitation. In what ways it can be used against you. Kernel hackers left it unpatched maybe because there were reasons behind that. Normally vulnerabilities are patched.
    – Artem S. Tashkinov
    Commented May 15, 2022 at 14:23
0

Artem S. Tashkinov’s answer explains how to fully enable all L1TF mitigations.

Beyond Artem’s point that there are no known exploits, it’s worth noting that you do already benefit from mitigations. PTE inversion is enabled, and that protects you from all non-VM-based attacks — for example, potential browser-based attacks. Conditional VMX cache flushes are also enabled, which means that malicious VMs can’t extract secrets from the host, other than the hypervisor’s address-space layout (which may help a piggy-back attack — again, this is all theoretical as far as we know).

Enabling any further mitigations is only useful if you want to guarantee that running untrusted VMs won’t lead to exploitation using L1TF. Unless you’re hosting VMs for multiple tenants, this is unlikely to be a relevant security threat.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .