Date: Tue, 10 Dec 2019 17:10:40 +0530 (IST) From: P J P <ppandit@...hat.com> To: oss security list <oss-security@...ts.openwall.com> Subject: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) Hello, Transaction Asynchronous Abort (TAA) h/w issue, which affects Intel CPUs, is mitigated in two ways. One is by disabling Transactional Synchronisation Extensions (TSX) feature of the CPU. And second is by clearing the affected Store/Fill/Load port architectural buffers, which may hold sensitive information bits. It was found that the current kernel fixes don't completely fix TAA issue for guest VMs. When a guest is running on a host CPU affected by TAA (ie. TAA_NO=0) but not affected by MDS issue (ie MDS_NO=1), to mitigate TAA issue, guest was to clear the affected buffers by using VERW instruction mechanism. But when MDS_NO=1 bit was exported to the guests, it did not quite use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs, which are affected by the TAA (ie. TAA_NO=0) issue, but are not affected by the MDS (ie. MDS_NO=1) issue. It requires that host has 'TSX' enabled. Upstream patches: ----------------- -> https://git.kernel.org/linus/cbbaa2727aa3ae9e0a844803da7cef7fd3b94f2b -> https://git.kernel.org/linus/c11f83e0626bdc2b6c550fc8b9b6eeefbd8cefaa -> https://git.kernel.org/linus/b07a5c53d42a8c87b208614129e947dd2338ff9c Another option: Export MDS_NO=0 to guests when TSX is enabled -> https://git.kernel.org/linus/e1d38b63acd843cfdd4222bf19a26700fd5c699e 'CVE-2019-19338' is assigned by Red Hat Inc. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.