linux-kernel - Re: [PATCH] x86/msr: do not warn on writes to OC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200908172558.GG25236@zn.tnic>
Date:   Tue, 8 Sep 2020 19:25:58 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     "Jason A. Donenfeld" <Jason@...c4.com>,
        Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>
Cc:     kitsunyan <kitsunyan@...mail.cc>,
        "Brown, Len" <len.brown@...el.com>, X86 ML <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86/msr: do not warn on writes to OC_MAILBOX

On Tue, Sep 08, 2020 at 07:12:44PM +0200, Jason A. Donenfeld wrote:
> > Overclocking is not architectural I/F and is supported by some special
> > CPU skews. I can't find any public document to specify the commands
> > which can be used via this OC mailbox. I have to check internally to
> > see if there is any. To add a proper sysfs interface we have to make
> > sure that we are not allowing some random commands to hardware and
> > crash the system.
> 
> Well you can definitely crash the system this way -- undervolting can
> result in all sorts of nice glitching. You might be able to even
> programmatically undervolt to compromise the kernel in clever ways (a
> lockdown bypass, I guess, but who cares).
> 
> That's why I initially suggested this was pretty squarely in the realm
> of hobbyists and should just be added to that whitelist.

If that MSR can cause all kinds of crazy, I'd prefer writes to it from
userspace to be completely forbidden, actually. And if force-enabled,
with a BIG FAT WARNING each time userspace writes to it.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette