Enforce Spectre v2 mitigation

Description

Spectre V2 is an indirect branch poisoning attack that can lead to data leakage. An exploit for Spectre V2 tricks the indirect branch predictor into executing code from a future indirect branch chosen by the attacker, even if the privilege level is different. Since Linux Kernel 4.15 you can check the Spectre V2 mitigation state with the following command: cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 Enforce the Spectre V2 mitigation by adding the argument spectre_v2=on to the default GRUB 2 command line for the Linux operating system. Configure the default Grub2 kernel command line to contain spectre_v2=on) as follows:

# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) spectre_v2=on)"

Rationale

The Spectre V2 vulnerability allows an attacker to read memory that he should not have access to.