lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <C6FE7867-EA7D-495F-9A27-D598EAFBD280@amacapital.net>
Date:   Mon, 15 Jan 2018 09:20:33 -0800
From:   Andy Lutomirski <luto@...capital.net>
To:     Nadav Amit <namit@...are.com>
Cc:     linux-kernel@...r.kernel.org, dave.hansen@...ux.intel.com,
        luto@...nel.org, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, nadav.amit@...il.com, w@....eu
Subject: Re: [RFC] x86: Avoid CR3 load on compatibility mode with PTI


> On Jan 14, 2018, at 12:13 PM, Nadav Amit <namit@...are.com> wrote:
> 
> Currently, when page-table isolation is on to prevent the Meltdown bug
> (CVE-2017-5754), CR3 is always loaded on system-call and interrupt.
> 
> However, it appears that this is an unnecessary measure when programs
> run in compatibility mode. In this mode only 32-bit registers are
> available, which means that there *should* be no way for the CPU to
> access, even speculatively, memory that belongs to the kernel, which
> sits in high addresses.

You're assuming that TIF_IA32 prevents the execution of 64-bit code.  It doesn't.

I've occasionally considered adding an opt-in hardening mechanism to enforce 32-bit or 64-bit execution, but we don't have this now.

Anything like this would also need to spend on SMEP, I think -- the pseudo-SMEP granted by PTI is too valuable to give up on old boxes, I think.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ