Lesson 3.41: CPU vulnerabilities and their mitigations
Spectre, Meltdown, MDS and their relatives are flaws in how CPUs speculate. They let one program, or one virtual machine, read memory that belongs to another. The kernel works around each one and reports the state of every workaround in /sys/devices/system/cpu/vulnerabilities. Some workarounds cost speed, so they get switched off for 'performance' and forgotten. In the lab a KVM host that runs other teams' virtual machines was booted without two of them and with Hyper-Threading on. You read the kernel's report, trace the options, turn SMT off at once and fix the boot options for the next reboot.
18 min
You will learn to
- Read the kernel's vulnerability report in sysfs
- Tie 'Vulnerable' lines to kernel command line options
- Explain why SMT matters on a multi-tenant host
- Turn SMT off at runtime and persistently
- Know which fixes need a reboot
Key terms
- Speculative execution
- The CPU runs instructions before it knows they're needed; wrong guesses are undone but leave traces in caches.
- Meltdown / PTI
- Meltdown lets a process read kernel memory; page table isolation (PTI) is the fix.
- Spectre v2
- Poisoning branch prediction so another context speculates into chosen code; fixed with retpolines, IBRS, IBPB, STIBP.
- SMT
- Simultaneous multithreading: two logical CPUs on one core, sharing its buffers.
- mitigations=
- Kernel option: off (all fixes off), auto (default), auto,nosmt (also disable SMT).
← LUKS key slots: who can unlock the disk · All lessons · Writing YARA rules →