Date: Tue, 08 Aug 2023 17:00:26 +0000 From: Xen.org security team <security@....org> To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org, xen-users@...ts.xen.org, oss-security@...ts.openwall.com CC: Xen.org security team <security-team-members@....org> Subject: Xen Security Advisory 435 v1 (CVE-2022-40982) - x86/Intel: Gather Data Sampling -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2022-40982 / XSA-435 x86/Intel: Gather Data Sampling ISSUE DESCRIPTION ================= A researcher has discovered Gather Data Sampling, a transient execution side-channel whereby the AVX GATHER instructions can forward the content of stale vector registers to dependent instructions. The physical register file is a structure competitively shared between sibling threads. Therefore an attacker can infer data from the sibling thread, or from a more privileged context. For more details, see: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/gather-data-sampling.html IMPACT ====== An attacker can infer data from different contexts on the same core. Examples of such data includes key material, cipher and plaintext from the AES-NI instructions, or the contents of REP-MOVS instructions, commonly used to implement memcpy(). VULNERABLE SYSTEMS ================== Systems running all versions of Xen are affected. See the Intel documentation for a list of affected processors. CPUs from other hardware vendors are not believed to be affected. MITIGATION ========== This issue can be mitigated by disabling AVX, either by booting Xen with `cpuid=no-avx` on the command line, or by specifying `cpuid="host:avx=0"` in the vm.cfg file of all untrusted VMs. However, this may come with a significant performance impact on the system and is not recommended for anyone able to deploy the microcode and patch described below. RESOLUTION ========== Intel are producing microcode updates to address the issue for most affected CPUs. Consult your dom0 OS vendor. This microcode is effective when late-loaded, which can be performed on a live system without reboot. Without microcode, disabling AVX is the only mitigation. This is implemented by the patches to Xen on hardware believed to be vulnerable. In addition, to indicate safety to guest kernels, Xen needs to synthesise new bits for guests to see, which depends on MSR_ARCH_CAPS being visible to guests. The work to support MSR_ARCH_CAPS is extensive and has been going on in public in earnest since March. The backports to security trees are more-extensive still. Therefore, we have decided to produce new releases on all stable trees. Please find fixes in the respective branches under the following release tags: RELEASE-4.17.2 RELEASE-4.16.5 RELEASE-4.15.5 RELEASE-4.14.6 Other release activities (tarballs, announcements, etc) will happen in due course. -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmTSZQcMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZoMQH/RAjt/wZHCg/aFunhbiAbdzWmJo36Cz6KL+R2G+v sBiPMsBvZxSikl6yeYAADgEUFKqNWQhLCAl6oaqgPbtDhFOxeZ72DRhgwZIx2KNL 85ECXk3rFhipiai6oHHbOemjPglXsyz+B5+NE64gOjpjdms9cfvfWnMnSQRF+NKa vbpEeP+KIK1EcmKOp/xfzjjgEzg7VmJ8jnct0A77sUQYi3Ll1+ENLEcqDElP+Qob wmM6QYkz78q/xO+R+bT+NNJ33q6JXQdixXa3ddiWrcvL/A3SveqtQh78u9daKmFM aaivBTgJSWk0348aelEF8UjLNKx8rVRc4Dk2elioiE1PCe8= =05gz -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.