Date: Tue, 8 Aug 2023 14:26:58 -0400 From: Demi Marie Obenour <demi@...isiblethingslab.com> To: oss-security@...ts.openwall.com, "Xen. org security team" <security@....org> Subject: Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed On Tue, Aug 08, 2023 at 08:00:09PM +0200, Solar Designer wrote: > On Mon, Jul 31, 2023 at 05:00:35PM +0000, Xen. org security team wrote: > > The patch provided with earlier versions was buggy. It unintentionally > > disable more bits than expected in the control register. The contents of this > > register is not generally known, so the effects on the system are unknown. > > > > A patch correcting this error has been committed and backported to all stable > > trees which got the XSA-433 fix originally. Additionally, it is attached to > > this advisory as xsa433-bugfix.patch, and applicable to all branches in this > > form. > > where xsa433-bugfix.patch includes this description: > > > This line: > > > > val &= ~chickenbit; > > > > ends up truncating val to 32 bits, and turning off various errata workarounds > > in Zen2 systems. > > and that patch then corrects the truncation by changing the type of the > chickenbit variable to 64-bit. The context is: > > + /* > + * Microcode is the preferred mitigation, in terms of performance. > + * However, without microcode, this chickenbit (specific to the Zen2 > + * uarch) disables Floating Point Mov-Elimination to mitigate the > + * issue. > + */ > + val &= ~chickenbit; > + if (sig->rev < good_rev) > + val |= chickenbit; > > This leaves me wondering: why have this line at all? I understand Xen > wanting to enable the chicken bit on vulnerable CPUs, but why disable it > on other AMD CPUs? If someone or something had enabled the bit, that's > probably intentional, and even if not it probably shouldn't be Xen's > business to alter CPU behavior beyond what's necessary for Xen itself to > work reliably and securely. > > Am I missing something? > > Alexander The microcode is effective when late-loaded, and this code might run after a microcode update and/or kexec. Not sure if this is the actual explanation. -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.