linux-kernel - Re: [PATCH v2 1/1] x86/ia32: Normalize any null selector value to 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b819c31-1972-44e0-87c7-1d11ac13f530@citrix.com>
Date: Wed, 20 Nov 2024 19:34:57 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: Xin Li <xin@...or.com>
Cc: bp@...en8.de, brgerst@...il.com, dave.hansen@...ux.intel.com,
 ebiederm@...ssion.com, hpa@...or.com, linux-kernel@...r.kernel.org,
 mingo@...hat.com, tglx@...utronix.de, x86@...nel.org,
 Andy Lutomirski <luto@...nel.org>
Subject: Re: [PATCH v2 1/1] x86/ia32: Normalize any null selector value to 0

On 20/11/2024 7:09 pm, Xin Li wrote:
> On 11/20/2024 1:33 AM, Andrew Cooper wrote:
>>> GDT, selector values 0~3 all point to the null descriptor, thus values
>>> 0, 1, 2 and 3 are all valid null selector values.
>>>
>>> Furthermore IRET zeros ES, FS, GS, and DS segment registers if any of
>>> them is found to have any null selector value, essentially making 0 a
>>> preferred null selector value.
>>
>> Zeroing of RPL in null selectors is an information leak in pre-FRED
>> systems.  Userspace can spot any interrupt/exception by loading a
>> nonzero NULL selector, and waiting for it to drop to zero.
>>
>> Userspace should not be able to do this; Andy and I lobbied for this
>> during the design of FRED, and Intel agreed.
>
> I wasn't aware of this, and hpa just told me you're right :)

We lobbied for many things.  Most got accepted.

Some did not.  e.g. MCIP isn't on the stack like the NMI flag is, but at
least you don't lose state on the stack any more, so it's definitely
better (if not ideal).

>
>>
>> Right now, this change is codifying the problem behaviour we were trying
>> to fix out under FRED.
>>
>> Under FRED, if userspace loads e.g. 2 into a selector, it should remain
>> 2 until userspace changes it to something else.
>
> Okay, I will fix it by:
> 1) For null selector values, do nothing.
> 2) For non-null selector values, set RPL bits.
>
> sounds okay?

Yeah, that sounds okay.

The selftest ought to work under FRED, but it was speculative coding.  I
can't rule out that tweaks might be needed.

~Andrew