Skip to content

Commit 2daedf9

Browse files
pb8ozulinx86
authored andcommitted
test: skip mmio_stale_data vuln
This does not mean the guest is vulnerable, just that we don't give enough information to the guest to tell if it is vulnerable ot not. The docs[1] say that 'Vulnerable: Clear CPU buffers attempted, no microcode': The processor is vulnerable, but microcode is not updated. The mitigation is enabled on a best effort basis. We may not want to pass-through the microcode to the guest, as that could be leveraged by an attacker. [1]: https://www.kernel.org/doc/html/next/admin-guide/hw-vuln/processor_mmio_stale_data.html Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
1 parent ac60477 commit 2daedf9

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

tests/integration_tests/security/test_vulnerabilities.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ def check_vulnerabilities_files_on_guest(microvm):
240240
"""
241241
vuln_dir = "/sys/devices/system/cpu/vulnerabilities"
242242
ecode, stdout, stderr = microvm.ssh.execute_command(
243-
f"grep -r Vulnerable {vuln_dir}"
243+
f"grep -r Vulnerable {vuln_dir} | grep -v mmio_stale_data:"
244244
)
245245
assert ecode == 1, f"stdout:\n{stdout}\nstderr:\n{stderr}\n"
246246

0 commit comments

Comments
 (0)