Ensure all CPU vulnerabilities are mitigated

MittelStufe 1Manuelle Prüfungopenshift-virt

Beschreibung

Ensure that all known CPU vulnerabilities are mitigated. This ensures that known attacks, such as Spectre, Meltdown, etc. either do not affect the node or are mitigated via software. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

View CPU mitigations: $ ls /sys/devices/system/cpu/vulnerabilities Output may resemble the following: "Not affected" CPU is not affected by the vulnerability "Vulnerable" CPU is affected and no mitigation in effect "Mitigation: $M" CPU is affected and mitigation $M is in effect

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Add the appropriate kernel arguments to the MachineConfigPools of the workers nodes and reboot them. See Documentation Chapter 1.Customizing nodes | Red Hat Product Documentation

Eigenschaften

Betriebssysteme: Beliebig
Tags: openshift-virtmanual-review
Referenz: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 6.3 Ensure all CPU vulnerabilities are mitigated