linux-kernel - Re: [PATCH] x86, x2apic: Only WARN on broken BIOSes inside a virtual guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 31 Jan 2013 14:34:27 -0500
From:	Don Zickus <dzickus@...hat.com>
To:	Gleb Natapov <gleb@...hat.com>
Cc:	x86@...nel.org, LKML <linux-kernel@...r.kernel.org>,
	Suresh Siddha <suresh.b.siddha@...el.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Prarit Bhargava <prarit@...hat.com>
Subject: Re: [PATCH] x86, x2apic: Only WARN on broken BIOSes inside a virtual
 guest

On Thu, Jan 31, 2013 at 08:52:00PM +0200, Gleb Natapov wrote:
> > http://www.invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf
> > 
> > After talking with folks, the threat of irq injections on virtual guests
> > made sense.  However, when discussing if this was possible on bare metal
> > machines, we could not come up with a plausible scenario.
> > 
> The irq injections is something that a guest with assigned device does
> to attack a hypervisor it runs on. Interrupt remapping protects host
> from this attack. According to pdf above if x2apic is disabled in a
> hypervisor interrupt remapping can be bypassed and leave host vulnerable
> to guest attack. This means that situation is exactly opposite: warning
> has sense on a bare metal, but not in a guest. I am not sure that there is
> a hypervisor that emulates interrupt remapping device though and without
> it the warning cannot be triggered in a guest.

Ah, it makes sense.  Not sure how I got it backwards then.  So my patch is
pointless then?  I'll asked for it to be dropped.

>From my previous discussions with folks, is that KVM was protected from
this type of attack.  Is that still true?

Cheers,
Don
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/