Date: Fri, 20 Nov 2020 10:29:34 +1100 From: Daniel Axtens <dja@...ens.net> To: oss-security@...ts.openwall.com Cc: cmr@...ormatik.wtf, ruscur@...sell.cc, npiggin@...il.com, mpe@...erman.id.au, spoorts2@...ibm.com, dja@...ens.net Subject: CVE-2020-4788: Speculation on incompletely validated data on IBM Power9 Hi, IBM Power9 processors can speculatively operate on data in the L1 cache before it has been completely validated, via a way-prediction mechanism. It is not possible for an attacker to determine the contents of impermissible memory using this method, since these systems implement a combination of hardware and software security measures to prevent scenarios where protected data could be leaked. However these measures don't address the scenario where an attacker induces the operating system to speculatively execute instructions using data that the attacker controls. This can be used for example to speculatively bypass "kernel user access prevention" techniques, as discovered by Anthony Steinhauser of Google's Safeside Project. This is not an attack by itself, but there is a possibility it could be used in conjunction with side-channels or other weaknesses in the privileged code to construct an attack. This issue can be mitigated by flushing the L1 cache between privilege boundaries of concern. Patches to fix this have been sent to the linuxppc-dev mailing list: https://firstname.lastname@example.org/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=215657&state=%2A&archive=both Backports to supported stable trees are currently being sent to the stable mailing list. Fixes for AIX and IBM i are also available from IBM. CVE-2020-4788 has been assigned. Further details, including the CVSS score, will be available at https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2020-4788 Thanks to Nick Piggin, Russell Currey, Christopher M. Riedl, Michael Ellerman and Spoorthy S for their work in developing, optimising, testing and backporting these fixes, and to the many others who helped behind the scenes. Kind regards, Daniel Axtens
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.