c9075798cc
These mitigations are low-overhead, upstream-supported hardening options that only activate on CPUs affected by their respective vulnerabilities. Enabling them provides consistent, defense-in-depth coverage across Intel and AMD systems without impacting unaffected hardware. Detailed list: - CONFIG_MITIGATION_SRSO to guard against known a vulnerability found on AMD processors (Zen generations 1-4) for sure, maybe others. This is tracked under CVE-2023-20569. - CONFIG_MITIGATION_ITS to guard against a bug in BPU on some Intel CPUs that may allow Spectre V2 style attacks. We never enabled this option (and its dependencies). - CONFIG_MITIGATION_SRBDS to guard against Special Register Buffer Data Sampling on affected Intel CPUs (CVE-2020-0543), preventing cross-core leakage of RDRAND/RDSEED/EGETKEY values. - CONFIG_MITIGATION_SLS to guard against Spectre-v4 gadgets on x86 by inserting speculation barriers around RET/JMP/CALL sites when required by CPU/microcode state. - CONFIG_MITIGATION_CALL_DEPTH_TRACKING to guard against speculative call-stack underflow on x86 by enabling hardware-assisted depth tracking where supported, reducing exposure to RET-based misprediction attacks. - CONFIG_MITIGATION_UNRET_ENTRY to guard against RET-based speculation attacks on x86 by replacing vulnerable function returns in kernel entry paths with UNRET sequences when required by CPU/microcode state. Signed-off-by: John Audia <therealgraysky@proton.me> Link: https://github.com/openwrt/openwrt/pull/21078 Signed-off-by: Robert Marko <robimarko@gmail.com> |
||
|---|---|---|
| .. | ||
| base-files/lib/preinit | ||
| config-6.12 | ||
| config-6.18 | ||
| target.mk | ||