linux-kernel - Re: [PATCH v2 1/1] x86/ia32: Normalize any null selector value to 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b6f8fb05-057f-4531-b03b-839374ac9dc0@zytor.com>
Date: Wed, 20 Nov 2024 11:09:09 -0800
From: Xin Li <xin@...or.com>
To: Andrew Cooper <andrew.cooper3@...rix.com>
Cc: bp@...en8.de, brgerst@...il.com, dave.hansen@...ux.intel.com,
        ebiederm@...ssion.com, hpa@...or.com, linux-kernel@...r.kernel.org,
        mingo@...hat.com, tglx@...utronix.de, x86@...nel.org,
        Andy Lutomirski <luto@...nel.org>
Subject: Re: [PATCH v2 1/1] x86/ia32: Normalize any null selector value to 0

On 11/20/2024 1:33 AM, Andrew Cooper wrote:
>> The first GDT descriptor is reserved as 'null descriptor'.  As bits 0
>> and 1 of a segment selector, i.e., the DPL bits, are NOT used to index
> 
> That's RPL in segment selector, not DPL.  Same correction is needed in
> the code comments.

Intel SDM says:

• Descriptor privilege level (DPL) field —
   (Bits 13 and 14 in the second doubleword of a segment descriptor.)
   Determines the privilege level of the segment.
• Requested privilege level (RPL) field —
   (Bits 0 and 1 of any segment selector.) Specifies the requested
   privilege level of a segment selector.

I got lost somehow.

> 
>> GDT, selector values 0~3 all point to the null descriptor, thus values
>> 0, 1, 2 and 3 are all valid null selector values.
>>
>> Furthermore IRET zeros ES, FS, GS, and DS segment registers if any of
>> them is found to have any null selector value, essentially making 0 a
>> preferred null selector value.
> 
> Zeroing of RPL in null selectors is an information leak in pre-FRED
> systems.  Userspace can spot any interrupt/exception by loading a
> nonzero NULL selector, and waiting for it to drop to zero.
> 
> Userspace should not be able to do this; Andy and I lobbied for this
> during the design of FRED, and Intel agreed.

I wasn't aware of this, and hpa just told me you're right :)

> 
> Right now, this change is codifying the problem behaviour we were trying
> to fix out under FRED.
> 
> Under FRED, if userspace loads e.g. 2 into a selector, it should remain
> 2 until userspace changes it to something else.

Okay, I will fix it by:
1) For null selector values, do nothing.
2) For non-null selector values, set RPL bits.

sounds okay?

Thanks!
     Xin