From 1e33f40f0a7fc0135ebb17692bd0c9fd7831b6df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Lesimple?= Date: Sat, 6 Jun 2026 15:57:45 +0200 Subject: [PATCH] mds/mmio/taa: don't claim "disable SMT" inside a VM guest (#343) Inside a Xen PVH domU (and any guest where the kernel sets X86_FEATURE_HYPERVISOR), the kernel appends "; SMT Host state unknown" to the MDS/MMIO sysfs vuln string: the host controls SMT scheduling and the guest genuinely can't see it. The "SMT is either mitigated or disabled" check only matched 'SMT (disabled|mitigated)', so this read as "not mitigated" and --paranoid flipped the verdict to a misleading VULN "you must disable SMT (Hyper-Threading)". Make *_smt_mitigated a tri-state: 1 (disabled/mitigated), 0 (vulnerable), and 2 (host state unknown). In paranoid mode, when the in-guest mitigation is active but SMT host state is unknown, report UNK with an explanation that cross-thread protection depends on the hypervisor host's SMT/core-scheduling config, instead of VULN. PV DomUs (kernel reports "SMT vulnerable", no HYPERVISOR bit) are unchanged and still flagged. --- src/vulns-helpers/check_mds.sh | 9 +++++++++ src/vulns-helpers/check_mmio.sh | 9 +++++++++ src/vulns/CVE-2019-11135.sh | 5 +++++ 3 files changed, 23 insertions(+) diff --git a/src/vulns-helpers/check_mds.sh b/src/vulns-helpers/check_mds.sh index e45c27b..e6ded22 100644 --- a/src/vulns-helpers/check_mds.sh +++ b/src/vulns-helpers/check_mds.sh @@ -174,6 +174,12 @@ check_mds_linux() { if echo "$ret_sys_interface_check_fullmsg" | grep -Eq 'SMT (disabled|mitigated)'; then mds_smt_mitigated=1 pstatus green YES + elif echo "$ret_sys_interface_check_fullmsg" | grep -q 'SMT Host state unknown'; then + # The kernel appends "SMT Host state unknown" when running under + # a hypervisor (X86_FEATURE_HYPERVISOR): the host controls SMT + # scheduling, so it can't be determined from inside the guest (#343). + mds_smt_mitigated=2 + pstatus yellow UNKNOWN "running in a VM guest, the hypervisor host controls SMT" else mds_smt_mitigated=0 pstatus yellow NO @@ -200,6 +206,9 @@ check_mds_linux() { if [ "$opt_paranoid" != 1 ] || [ "$mds_smt_mitigated" = 1 ]; then mystatus=OK mymsg="Your microcode and kernel are both up to date for this mitigation, and mitigation is enabled" + elif [ "$mds_smt_mitigated" = 2 ]; then + mystatus=UNK + mymsg="Your microcode and kernel are both up to date for this mitigation and it's enabled, but SMT (Hyper-Threading) cross-thread protection can't be verified from inside a VM guest: it depends on the hypervisor host's SMT/core-scheduling configuration" else mystatus=VULN mymsg="Your microcode and kernel are both up to date for this mitigation, but you must disable SMT (Hyper-Threading) for a complete mitigation" diff --git a/src/vulns-helpers/check_mmio.sh b/src/vulns-helpers/check_mmio.sh index 99d2fb0..5440240 100644 --- a/src/vulns-helpers/check_mmio.sh +++ b/src/vulns-helpers/check_mmio.sh @@ -216,6 +216,12 @@ check_mmio_linux() { if echo "$ret_sys_interface_check_fullmsg" | grep -Eq 'SMT (disabled|mitigated)'; then mmio_smt_mitigated=1 pstatus green YES + elif echo "$ret_sys_interface_check_fullmsg" | grep -q 'SMT Host state unknown'; then + # The kernel appends "SMT Host state unknown" when running under + # a hypervisor (X86_FEATURE_HYPERVISOR): the host controls SMT + # scheduling, so it can't be determined from inside the guest (#343). + mmio_smt_mitigated=2 + pstatus yellow UNKNOWN "running in a VM guest, the hypervisor host controls SMT" else mmio_smt_mitigated=0 pstatus yellow NO @@ -253,6 +259,9 @@ check_mmio_linux() { if [ "$opt_paranoid" != 1 ] || [ "$mmio_smt_mitigated" = 1 ]; then mystatus=OK mymsg="Your microcode and kernel are both up to date for this mitigation, and mitigation is enabled" + elif [ "$mmio_smt_mitigated" = 2 ]; then + mystatus=UNK + mymsg="Your microcode and kernel are both up to date for this mitigation and it's enabled, but SMT (Hyper-Threading) cross-thread protection can't be verified from inside a VM guest: it depends on the hypervisor host's SMT/core-scheduling configuration" else mystatus=VULN mymsg="Your microcode and kernel are both up to date for this mitigation, but you must disable SMT (Hyper-Threading) for a complete mitigation" diff --git a/src/vulns/CVE-2019-11135.sh b/src/vulns/CVE-2019-11135.sh index 0781bd5..eb85a1a 100644 --- a/src/vulns/CVE-2019-11135.sh +++ b/src/vulns/CVE-2019-11135.sh @@ -86,6 +86,11 @@ check_CVE_2019_11135_linux() { pvulnstatus "$cve" VULN "TSX must be disabled for full mitigation" elif echo "$ret_sys_interface_check_fullmsg" | grep -qF 'SMT vulnerable'; then pvulnstatus "$cve" VULN "SMT (HyperThreading) must be disabled for full mitigation" + elif echo "$ret_sys_interface_check_fullmsg" | grep -qF 'SMT Host state unknown'; then + # The kernel appends "SMT Host state unknown" when running under a + # hypervisor (X86_FEATURE_HYPERVISOR): the host controls SMT + # scheduling, so it can't be determined from inside the guest (#343). + pvulnstatus "$cve" UNK "TAA is mitigated and TSX is disabled, but SMT (Hyper-Threading) cross-thread protection can't be verified from inside a VM guest: it depends on the hypervisor host's SMT/core-scheduling configuration" else pvulnstatus "$cve" "$status" "$msg" fi