linux-kernel - Re: Do the x86 kernel entry points need an xabort on TSX cpus?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F35517F.9070904@linux.intel.com>
Date:	Fri, 10 Feb 2012 09:18:55 -0800
From:	"H. Peter Anvin" <hpa@...ux.intel.com>
To:	Andy Lutomirski <luto@...capital.net>
CC:	x86@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: Do the x86 kernel entry points need an xabort on TSX cpus?

On 02/09/2012 11:40 PM, Andy Lutomirski wrote:
> [...]
>
>   - Ring transitions: SYSENTER, SYSCALL, SYSEXIT, and SYSRET.
>
> I suspect that many bits of the kernel expect that things they do
> won't unhappen.  For example, it could be fun to do:
>

That's why entering the kernel will cause an abort.  In other words, you 
will ALWAYS abort when you do a read(), and you will never reach your 
_xabort().

> int devrandom = open("/dev/random", O_RDONLY);
> unsigned int abort_code = _xbegin();
>
> if (abort_code&  1) {
>    printf("Your next random byte is %d\n", (int)(abort_code>>  24));
> } else if (abort_code != 0) {
>    printf("Attack failed\n");
> } else {
>    char r;
>    read(devrandom,&r, 1);
>    _xabort(r);
> }

	-hpa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/