1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
documentation_complete: true
title: 'Configure Microarchitectural Data Sampling mitigation'
description: |-
Microarchitectural Data Sampling (MDS) is a hardware vulnerability which allows unprivileged
speculative access to data which is available in various CPU internal buffers.
When performing store, load, L1 refill operations, processors write data into temporary
microarchitectural structures (buffers), and the data in the buffer can be forwarded to load
operations as an optimization.
Under certain conditions, data unrelated to the load operations can be speculatively
forwarded from the buffers to a disclosure gadget which allows in turn to infer the value
via a cache side channel attack.
Select the appropriate mitigation by adding the argument
<tt>mds={{{ xccdf_value("var_mds_options") }}}</tt> to the default
GRUB 2 command line for the Linux operating system.
{{{ describe_grub2_argument("mds=" + xccdf_value("var_mds_options")) | indent(4) }}}
Not all processors are affected by all variants of MDS, but the mitigation mechanism is
identical for all of them.
Since Linux Kernel 5.2 you can check whether the system is vulnerable or mitigated with the
following command:
<tt>cat /sys/devices/system/cpu/vulnerabilities/mds</tt>
rationale: |-
The MDS vulnerability allows an attacker to sample data from internal CPU buffers.
warnings:
- performance: |-
Enabling MDS mitigations will impact performance of the system, mainly by workloads with
high rates of user-kernel-user space transitions. For example, system calls, NMIs and interrupts.
severity: medium
identifiers:
cce@rhel8: CCE-89456-8
cce@rhel9: CCE-90456-5
cce@rhel10: CCE-88327-2
ocil_clause: 'MDS mitigations are not configured appropriately'
ocil: |-
{{{ ocil_grub2_argument("mds=" + xccdf_value(var_mds_options)) | indent(4) }}}
template:
name: grub2_bootloader_argument
vars:
arg_name: mds
arg_variable: var_mds_options
|
