linux-kernel - Re: [PATCH 3/7] x86/enter: Use IBRS on syscall and interrupts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2cd1624f-7e1b-6bdd-a793-d97b8e280ed7@intel.com>
Date:   Fri, 5 Jan 2018 10:00:30 -0800
From:   Dave Hansen <dave.hansen@...el.com>
To:     84a6f2f2-d5fe-6b42-0590-33723c1b4960@...el.com
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg KH <gregkh@...uxfoundation.org>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Arjan Van De Ven <arjan.van.de.ven@...el.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...nel.org>
Subject: Re: [PATCH 3/7] x86/enter: Use IBRS on syscall and interrupts

On 01/05/2018 04:27 AM, Dr. David Alan Gilbert wrote:
>>> Patches for 1-3 are out there and 4 is pretty straightforward.  Doing a
>>> arch_prctl() is still straightforward, but will be a much more niche
>>> thing than any of the other choices.  Plus, with a user interface, we
>>> have to argue over the ABI for at least a month or two. ;)
> I was chatting to Andrea about this, and we came to the conclusion one
> use might be for qemu;  I was worried about (theoretically) whether
> userspace in a guest could read privileged data from the guest kernel by
> attacking the qemu process rather than by attacking the kernels.

Theoretically, I believe it's possible.  The SMEP-based mitigations are
effective when crossing rings, but do not help with
guest-ring0->host-ring0 or presumably guest-ring3->host-ring3.

For the same-ring things, we have the indirect branch predictor flush
operation MSR (IBPB).  Expect those to be posted once we have the IBRS
and retpoline approaches settled.