Linux 4.21 Will Better Protect Against Malicious Thunderbolt Devices
Written by Michael Larabel in Hardware on 10 December 2018 at 02:45 PM EST. Add A Comment
HARDWARE --
Linux 4.21 is set to further improve the system security around potentially malicious Thunderbolt devices.

The new protection with Linux 4.21 is the enabling of IOMMU-based direct memory access (DMA) protection from devices connected via Thunderbolt. PCI Express Address Translation Services (PCIe ATS) is also disabled to prevent possibly bypassing that IOMMU protection, per this pull.

DMA protection via IOMMU has appeared on systems/motherboards beginning this year and ensures that Thunderbolt devices cannot access memory regions outside of where they should be permitted. On supported systems, this protection will be automatically enabled. Likewise, the PCIe ATS support is automatically going to be disabled for all "untrusted" Thunderbolt devices.

These latest kernel enhancements paired with the other efforts namely Red Hat's Bolt initiative have led to much better Thunderbolt device safety on Linux this year.
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Hardware News
Popular News This Week