linux-kernel - Re: [PATCH 5/7] x86: Use IBRS for firmware update path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180105160848.GD17349@kroah.com>
Date:   Fri, 5 Jan 2018 17:08:48 +0100
From:   "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
To:     "Woodhouse, David" <dwmw@...zon.co.uk>
Cc:     "tim.c.chen@...ux.intel.com" <tim.c.chen@...ux.intel.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "arjan.van.de.ven@...el.com" <arjan.van.de.ven@...el.com>,
        "torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "ak@...ux.intel.com" <ak@...ux.intel.com>,
        "aarcange@...hat.com" <aarcange@...hat.com>,
        "luto@...nel.org" <luto@...nel.org>,
        "dave.hansen@...el.com" <dave.hansen@...el.com>
Subject: Re: [PATCH 5/7] x86: Use IBRS for firmware update path

On Thu, Jan 04, 2018 at 08:08:55PM +0000, Woodhouse, David wrote:
> On Thu, 2018-01-04 at 21:05 +0100, Greg KH wrote:
> > On Thu, Jan 04, 2018 at 09:56:46AM -0800, Tim Chen wrote:
> > > 
> > > From: David Woodhouse <dwmw@...zon.co.uk>
> > > 
> > > We are impervious to the indirect branch prediction attack with
> > > retpoline
> > > but firmware won't be, so we still need to set IBRS to protect
> > > firmware code execution when calling into firmware at runtime.
> > Wait, what?
> > 
> > Maybe it's just the wine from dinner talking, but if the firmware has
> > issues, we have bigger things to worry about here, right?  It already
> > handed over the "chain of trust" to us, so we have already implicitly
> > trusted that the firmware was correct here.  So why do we need to do
> > anything about firmware calls in this manner?
> 
> In the ideal world, firmware exists to boot the kernel and then it gets
> out of the way, never to be thought of again.
> 
> In the Intel world, firmware idiocy permeates everything and we
> sometimes end up making calls to it at runtime.
> 
> If an attacker can poison the BTB for an indirect branch in EFI
> firmware, then reliably do something which calls EFI runtime calls,
> that might lead to an exploit. So if we're using retpoline for the
> kernel, then we should be setting IBRS before any firmware calls.

Ugh, ok, seems a bit far-fetched to me, but I will not object anymore.

Except that the patch doesn't actually build, which means no one has
actually tested it at all :(

greg k-h