linux-kernel - Re: DO NOT APPLY: x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAObL_7EzYQFWm0VsWbp6u67NWWTc=mN=4pQQOt7GYjwL0dzmrw@mail.gmail.com>
Date:	Tue, 15 Jul 2014 16:56:36 -0700
From:	Andrew Lutomirski <amluto@...il.com>
To:	Greg KH <greg@...ah.com>
Cc:	Kamal Mostafa <kamal@...onical.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	stable <stable@...r.kernel.org>, kernel-team@...ts.ubuntu.com,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>,
	Borislav Petkov <bp@...en8.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Dirk Hohndel <dirk@...ndel.org>,
	Arjan van de Ven <arjan.van.de.ven@...el.com>,
	comex <comexk@...il.com>,
	Alexander van Heukelum <heukelum@...tmail.fm>,
	Boris Ostrovsky <boris.ostrovsky@...cle.com>
Subject: Re: DO NOT APPLY: x86-64, espfix: Don't leak bits 31:16 of %esp
 returning to 16-bit stack

On Tue, Jul 15, 2014 at 4:52 PM, Greg KH <greg@...ah.com> wrote:
> On Tue, Jul 15, 2014 at 04:21:46PM -0700, Andrew Lutomirski wrote:
>> On Tue, Jul 15, 2014 at 2:28 PM, Kamal Mostafa <kamal@...onical.com> wrote:
>> > 3.13.11.5 -stable review patch.  If anyone has any objections, please let me know.
>> >
>> > ------------------
>> >
>> > From: "H. Peter Anvin" <hpa@...ux.intel.com>
>> >
>> > commit 3891a04aafd668686239349ea58f3314ea2af86b upstream.
>>
>> Do not apply to any -stable release yet.  This causes nasty regressions on Xen.
>
> I thought you all found the Xen-regression-fix patch a few hours ago,
> right?

That patch is insufficient: Xen guests still fail to initialize
espfix64 correctly on SMP.  It's currently unclear that espfix64 can
work at all on Xen -- it's may be rather fundamentally incompatible
with the Xen hypercall IRET mechanism.  So it might need to be
disabled entirely on Xen (and maybe Xen will fix the info leak in the
hypervisor).

>
> This means that Linus's tree is also broken?

Yes.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/