Certain CPUs are vulnerable to an exploit against a common wide industry wide performance
optimization known as Speculative Store Bypass (SSB).
In such cases, recent stores to the same memory location cannot always be observed by later
loads during speculative execution. However, such stores are unlikely and thus they can be
detected prior to instruction retirement at the end of a particular speculation execution
window.
Since Linux Kernel 4.17 you can check the SSB mitigation state with the following command:
cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
Select the appropriate SSB state by adding the argument
spec_store_bypass_disable= to the default
GRUB 2 command line for the Linux operating system.
To ensure that spec_store_bypass_disable= is added as a kernel command line
argument to newly installed kernels, add spec_store_bypass_disable= to the
default Grub2 command line for Linux operating systems. Modify the line within
/etc/default/grub as shown below:
GRUB_CMDLINE_LINUX="... spec_store_bypass_disable= ..."
Run the following command to update command line for already installed kernels:# grubby --update-kernel=ALL --args="spec_store_bypass_disable="