Attack Vector Controls Can Now Manage VMSCAPE Mitigation
Made public and mitigated within the mainline Linux kernel last month was the VMSCAPE vulnerability affecting both AMD and Intel CPUs. Now merged for the in-development Linux 6.18 kernel is adding VMSCAPE to the recently-introduced Attack Vector Controls functionality.
Attack Vector Controls was merged in Linux 6.17 as a new means of controlling Linux CPU security vulnerability mitigations. With Attack Vector Controls you just need to manage the system/server use-cases and in turn the classes of possible CPU security attacks (such as VM usage with guest to host attacks or cross-VM untrusted scenarios) rather than managing CPU mitigation options individually.
With Linux 6.18, VMSCAPE is now covered by the Attack Vector Controls support. VMSCAPE mitigations are applied with Attack Vector Controls just for those concerned about guest-to-host attack vectors.
This support was merged via the x86/bugs pull.
Attack Vector Controls was merged in Linux 6.17 as a new means of controlling Linux CPU security vulnerability mitigations. With Attack Vector Controls you just need to manage the system/server use-cases and in turn the classes of possible CPU security attacks (such as VM usage with guest to host attacks or cross-VM untrusted scenarios) rather than managing CPU mitigation options individually.
With Linux 6.18, VMSCAPE is now covered by the Attack Vector Controls support. VMSCAPE mitigations are applied with Attack Vector Controls just for those concerned about guest-to-host attack vectors.
This support was merged via the x86/bugs pull.