How do I fix 'MDS CPU bug present and SMT on, data leak possible' errors from logwatch?

Solution 1:

Note: Undo your previous edits to /etc/default/intel-microcode and /etc/default/grub.

Mitigation control on the kernel command line

The kernel command line allows to control the MDS mitigations at boot time with the option “mds=”. The valid arguments for this option are:

full    

If the CPU is vulnerable, enable all available mitigations for the MDS vulnerability, CPU buffer clearing on exit to userspace and when entering a VM. Idle transitions are protected as well if SMT is enabled.

It does not automatically disable SMT.

full,nosmt

The same as mds=full, with SMT disabled on vulnerable CPUs. This is the complete mitigation.

off

Disables MDS mitigations completely.

sudo -H gedit /etc/default/grub

Change:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

To:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash mds=full,nosmt"

Save the file and quit gedit.

sudo update-grub

reboot

Note: Understand that you'll take a HUGE performance hit on multi-cpu or multi-core configurations.

Note: If the performance hit is too great, try mds=full instead of mds=full,nosmt.