Configure Microarchitectural Data Sampling mitigation
Requires the mds=full,nosmt kernel boot parameter to fully mitigate Microarchitectural Data Sampling side-channels, including the cross-hyperthread leak path.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Microarchitectural Data Sampling (MDS) is a class of side-channel vulnerabilities (Fallout, RIDL, ZombieLoad) that let an attacker sample stale data from internal CPU buffers (store, fill and load buffers) belonging to other processes, the kernel, VMs or SGX enclaves. Because these buffers are shared across hyperthreads, a partial mitigation that does not disable SMT can still leak data. Setting mds=full,nosmt flushes the affected buffers on every context switch and disables SMT, closing the cross-thread leak path entirely.
What Pavois checks
Pavois reads the live kernel command line from /proc/cmdline and checks for mds=full,nosmt. This is the boot line the running kernel actually parsed, not /etc/default/grub, a file-based scan could pass on an edited GRUB config that was never regenerated, leaving SMT and the buffers still exposed. You can cross-check the kernel's own verdict via /sys/devices/system/cpu/vulnerabilities/mds.
describe command('cat /proc/cmdline') do
its('stdout') { should match(/(^| )mds=full( |$)/) }
end
describe command("grep -hwsF 'mds=full' /etc/default/grub /etc/kernel/cmdline /boot/grub/grub.cfg /boot/grub2/grub.cfg /boot/efi/EFI/*/grub.cfg 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run cat /proc/cmdline and confirm it contains mds=full,nosmt. Confirm the mitigation is active with:
cat /sys/devices/system/cpu/vulnerabilities/mds
Expected output reports Mitigation: Clear CPU buffers; SMT disabled.
Inspect & investigate
The mitigation state is exposed under sysfs: cat /sys/devices/system/cpu/vulnerabilities/mds. The kernel also prints its decision at boot, dmesg | grep -i 'MDS' or journalctl -k | grep -i mds.
Remediation
pavois harden apply uses the kernel_cmdline resource to add mds=full,nosmt to the bootloader configuration and regenerate it, so the option is present on next boot. A reboot is required to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| param | mds=full |
|---|---|
| reboot_required | true |
| resource | kernel_cmdline |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
nosmt disables Hyper-Threading, which can cut throughput on CPU-bound, multi-threaded workloads by up to ~30%. Precautions:
- Benchmark latency-sensitive or high-core-count workloads first; you lose logical cores.
- On single-tenant, trusted hosts you may keep SMT and accept residual risk, but this rule mandates the strict
full,nosmtprofile. - The flush is harmless on patched CPUs that already report Not affected.
- Applies after reboot only, schedule a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R8 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.