Enforce Spectre v2 mitigation
An XCCDF Rule
Description
Spectre V2 is an indirect branch poisoning attack that can lead to data leakage.
An exploit for Spectre V2 tricks the indirect branch predictor into executing
code from a future indirect branch chosen by the attacker, even if the privilege
level is different.
Since Linux Kernel 4.15 you can check the Spectre V2 mitigation state with the following command:
cat /sys/devices/system/cpu/vulnerabilities/spectre_v2
Enforce the Spectre V2 mitigation by adding the argument
spectre_v2=on to the default
GRUB 2 command line for the Linux operating system.
Configure the default Grub2 kernel command line to contain spectre_v2=on) as follows:
# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) spectre_v2=on)"
Rationale
The Spectre V2 vulnerability allows an attacker to read memory that he should not have access to.
- ID
- xccdf_org.ssgproject.content_rule_grub2_spectre_v2_argument
- Severity
- High
- References
- Updated
Remediation - OS Build Blueprint
[customizations.kernel]
append = "spectre_v2=on"
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- grub2_spectre_v2_argument
- high_severity
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q grub2 && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
# Correct the form of default kernel command line in GRUB
if grep -q '^\s*GRUB_CMDLINE_LINUX=.*spectre_v2=.*"' '/etc/default/grub' ; then
# modify the GRUB command-line if an spectre_v2= arg already exists