The latest development version of this page may be more current than this released 1.14.0 version.

CONFIG_BOUNDS_CHECK_BYPASS_MITIGATION¶

Enable bounds check bypass mitigations for speculative execution

Type: bool

Help¶

Untrusted parameters from user mode may be used in system calls to index arrays during speculative execution, also known as the Spectre V1 vulnerability. When enabled, various macros defined in misc/speculation.h will insert fence instructions or other appropriate mitigations after bounds checking any array index parameters passed in from untrusted sources (user mode threads). When disabled, these macros do nothing.

Direct dependencies¶

USERSPACE

(Includes any dependencies from if’s and menus.)

Defaults¶

No defaults. Implicitly defaults to n.

Symbols that select this symbol¶

X86_BOUNDS_CHECK_BYPASS_MITIGATION

Kconfig definition¶

At kernel/Kconfig:664

Included via Kconfig:10 → Kconfig.zephyr:31

Menu path: (top menu) → General Kernel Options → Security Options

config BOUNDS_CHECK_BYPASS_MITIGATION
    bool
    prompt "Enable bounds check bypass mitigations for speculative execution" if USERSPACE
    depends on USERSPACE
    help
      Untrusted parameters from user mode may be used in system calls to
      index arrays during speculative execution, also known as the Spectre
      V1 vulnerability. When enabled, various macros defined in
      misc/speculation.h will insert fence instructions or other appropriate
      mitigations after bounds checking any array index parameters passed
      in from untrusted sources (user mode threads). When disabled, these
      macros do nothing.

(Definitions include propagated dependencies, including from if’s and menus.)