linux-kernel - Re: Avoid speculative indirect calls in kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180104115407.51e1c032@alans-desktop>
Date:   Thu, 4 Jan 2018 11:54:07 +0000
From:   Alan Cox <gnomes@...rguk.ukuu.org.uk>
To:     Pavel Machek <pavel@....cz>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Andi Kleen <andi@...stfloor.org>, tglx@...uxtronix.de,
        Greg Kroah-Hartman <gregkh@...ux-foundation.org>,
        dwmw@...zon.co.uk, Tim Chen <tim.c.chen@...ux.intel.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Dave Hansen <dave.hansen@...el.com>
Subject: Re: Avoid speculative indirect calls in kernel

On Thu, 4 Jan 2018 12:26:14 +0100
Pavel Machek <pavel@....cz> wrote:

> On Wed 2018-01-03 15:51:35, Linus Torvalds wrote:
> > On Wed, Jan 3, 2018 at 3:09 PM, Andi Kleen <andi@...stfloor.org> wrote:  
> > > This is a fix for Variant 2 in
> > > https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
> > >
> > > Any speculative indirect calls in the kernel can be tricked
> > > to execute any kernel code, which may allow side channel
> > > attacks that can leak arbitrary kernel data.  
> > 
> > Why is this all done without any configuration options?
> > 
> > A *competent* CPU engineer would fix this by making sure speculation
> > doesn't happen across protection domains. Maybe even a L1 I$ that is
> > keyed by CPL.  
> 
> Would that be enough?

For the entire system - no. To start with the current most dangerous
attack is the javascript one. And that is an attack by a process on
itself. Likewise simply keying L1I by CPL wouldn't stop ring 3
processes attacking one another or deal with virtual machines properly.
For some of those cases (notably the JIT ones) it's quite probable that
there isn't enough information for the processor to even infer what is
needed.

Alan