linux-kernel - [PATCH v3 0/3] x86/entry: Clear registers to sanitize speculative usages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 05 Feb 2018 17:18:00 -0800
From:   Dan Williams <dan.j.williams@...el.com>
To:     tglx@...utronix.de, mingo@...nel.org
Cc:     Andi Kleen <ak@...ux.intel.com>, x86@...nel.org,
        linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...hat.com>,
        luto@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
        torvalds@...ux-foundation.org
Subject: [PATCH v3 0/3] x86/entry: Clear registers to sanitize speculative
 usages

Changes since v2 [1]:
* Interleave clearing with preserving in the syscall and compat syscall
  path (Linus)

* Extend clearing protection to r10 and r11 in the sycall path and r8 +
  r9 in the compat syscall path. (Ingo)

* Drop some redundant clearing at interrupt / exception entry.

[1]: https://lkml.org/lkml/2018/2/4/125

---

At entry userspace may have populated callee saved registers with values
that could be useful in a speculative execution attack. Clear them to
minimize the kernel's attack surface.

Note, this is done to make it harder to find / manipulate exploitable
sequences in the kernel.

The clearing is limited to the 64-bit 'extra' registers since those are
the most likely to survive with user populated values deep into the call
chain. Normal register pressure likely clobbers values in the lower
registers and the 32-bit case.

As for cycle impact, interleaving the clearing with pushing values onto
the stack hides most the overhead.

---

Andi Kleen (2):
      x86/entry: Clear registers for 64bit exceptions/interrupts
      x86/entry: Clear registers for compat syscalls

Dan Williams (1):
      x86/entry: Clear extra registers beyond syscall arguments for 64bit kernels

 arch/x86/entry/calling.h         |   19 +++++++++++++++++++
 arch/x86/entry/entry_64.S        |   20 ++++++++++++++++++--
 arch/x86/entry/entry_64_compat.S |   30 ++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)