linux-kernel - l1tf: Kernel suggests I throw away third of my memory. I'd rather not

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 Oct 2018 12:56:10 +0200
From:   Pavel Machek <pavel@....cz>
To:     vbabka@...e.cz, mhocko@...e.com, hpa@...or.com,
        torvalds@...ux-foundation.org, ak@...ux.intel.com,
        dave.hansen@...el.com, kernel list <linux-kernel@...r.kernel.org>,
        tglx@...utronix.de, mingo@...hat.com, bp@...en8.de
Subject: l1tf: Kernel suggests I throw away third of my memory. I'd rather not

Hi!

6a012288 suggests I throw away 1GB on RAM. On 3GB system.. that is not
going to be pleasant.

l1tf.html says:

# The Linux kernel contains a mitigation for this attack vector, PTE
# inversion, which is permanently enabled and has no performance
# impact.

I don't believe it has "no" performance impact, but I guess it is lost
in the noise.

#  The kernel ensures that the address bits of PTEs, which are
# not marked present, never point to cacheable physical memory space.

# A system with an up to date kernel is protected against attacks from
# malicious user space applications.

These are not true.

cat /sys/devices/system/cpu/vulnerabilities/l1tf
Vulnerable
uname -a
Linux amd 4.19.0-rc8-next-20181017autobisect1539371050 #189 SMP Wed
Oct 17 12:04:23 CEST 2018 i686 GNU/Linux

Now question is... can we do better? Kernel stores information about
swapped-out pages there, right? That sounds like a cool hack, but
maybe it is time to get rid of that hack?

As a workaround, can I simply do swapoff -a to be safe for now?

Thanks,
								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)