2

I don't know how to mitigate iTLB multihit vulnerability.

/sys/devices/system/cpu/vulnerabilities/itlb_multihit | KVM: Vulnerable

Found this: iTLB multihit, But i have no access to the host machine where the VM is hosted. Is it possible to fix or mitigate this vulnerability from the guest operating system ?

System specification: 
Ubuntu Server 20.04 LTS
Kernel: 5.4.0-125-generic

I was trying to modify GRUB_CMDLINE_LINUX_DEFAULT="maybe-ubiquity mitigations=on" and append mitigations=on but it doesn't provide any result.

Improve this question
6
  • 1
    kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html Virtualization with trusted guests¶ If the guest comes from a trusted source, you may assume that the guest will not attempt to maliciously exploit these errata and no further action is required.
    – Artem S. Tashkinov
    Aug 25, 2022 at 18:43
  • @ArtemS.Tashkinov I see. We rent the private cloud so, i'm the guest and we are a trusted source, but what if the server(VM) is exposed to the internet and someone will getting unattended access ? Maybe i should ask our cloud provider to mitigate this issue by editing /sys/module/kvm/parameters/nx_huge_pages at hypervisor system.
    – Przemon
    Aug 26, 2022 at 6:33
  • 1
    Sounds like a good idea. Most mitigations incur a performance loss (some very heavy) though, so they might not be inclined to fix it.
    – Artem S. Tashkinov
    Aug 26, 2022 at 6:54
  • @ArtemS.Tashkinov I will try to go this way and report it to cloud provider. Thanks for help and your time. Have a good day.
    – Przemon
    Aug 26, 2022 at 7:05
  • I found one more approach. I will be able to check it at the beginning of the next week. mitigations=auto,nosmt - it should enable all CPU vulnerabilities mitigation.
    – Przemon
    Aug 26, 2022 at 7:41

1 Answer 1

Reset to default
0

Finally, I find solution.

In my case i need to install sudo apt install --install-recommends linux-generic-hwe-20.04 after this step Vulnerability scanners display 0.0 points.

lscpu

showing

Vulnerability Itlb multihit:     KVM: Mitigation: VMX unsupported

it means base at iTLB multihit

KVM: Mitigation: VMX unsupported

KVM is not vulnerable because Virtual Machine Extensions (VMX) is not supported.

cat /sys/devices/system/cpu/vulnerabilities/itlb_multihit 
KVM: Mitigation: VMX unsupported
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .