linux-kernel - Re: [FYI PATCH 0/7] Mitigation for CVE-2018-12207

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 13 Nov 2019 21:26:24 -0800
From:   Dave Hansen <dave.hansen@...el.com>
To:     Nadav Amit <nadav.amit@...il.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Jan Kiszka <jan.kiszka@...mens.com>,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        Ralf Ramsauer <ralf.ramsauer@...-regensburg.de>,
        "Gupta, Pawan Kumar" <pawan.kumar.gupta@...el.com>
Subject: Re: [FYI PATCH 0/7] Mitigation for CVE-2018-12207

On 11/13/19 5:17 PM, Nadav Amit wrote:
> But is it always the case? Looking at __split_large_page(), it seems that the
> TLB invalidation is only done after the PMD is changed. Can't this leave a
> small time window in which a malicious actor triggers a machine-check on 
> another core than the one that runs __split_large_page()?

It's not just a split.  It has to be a change that results in
inconsistencies between two entries in the TLB.  A normal split doesn't
change the resulting final translations and is never inconsistent
between the two translations.

To have an inconsistency, you need to change the backing physical
address (or cache attributes?).  I'd need to go double-check the erratum
to be sure about the cache attributes.

In any case, that's why we decided that normal kernel mapping
split/merges don't need to be mitigated.  But, we should probably
document this somewhere if it's not clear.

Pawan, did we document the results of the audit you did anywhere?