oss-security - CVE-2020-4788: Speculation on incompletely validated data on IBM Power9

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201119232934.366442-1-dja@axtens.net>
Date: Fri, 20 Nov 2020 10:29:34 +1100
From: Daniel Axtens <dja@...ens.net>
To: oss-security@...ts.openwall.com
Cc: cmr@...ormatik.wtf,
	ruscur@...sell.cc,
	npiggin@...il.com,
	mpe@...erman.id.au,
	spoorts2@...ibm.com,
	dja@...ens.net
Subject: CVE-2020-4788: Speculation on incompletely validated data on IBM Power9

Hi,

IBM Power9 processors can speculatively operate on data in the L1
cache before it has been completely validated, via a way-prediction
mechanism. It is not possible for an attacker to determine the
contents of impermissible memory using this method, since these
systems implement a combination of hardware and software security
measures to prevent scenarios where protected data could be leaked.

However these measures don't address the scenario where an attacker
induces the operating system to speculatively execute instructions
using data that the attacker controls. This can be used for example to
speculatively bypass "kernel user access prevention" techniques, as
discovered by Anthony Steinhauser of Google's Safeside Project. This
is not an attack by itself, but there is a possibility it could be
used in conjunction with side-channels or other weaknesses in the
privileged code to construct an attack.

This issue can be mitigated by flushing the L1 cache between privilege
boundaries of concern.

Patches to fix this have been sent to the linuxppc-dev mailing list:
https://lore.kernel.org/linuxppc-dev/20201119231333.361771-1-dja@axtens.net/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc
https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=215657&state=%2A&archive=both

Backports to supported stable trees are currently being sent to the
stable mailing list.

Fixes for AIX and IBM i are also available from IBM.

CVE-2020-4788 has been assigned. Further details, including the CVSS
score, will be available at
https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-2020-4788

Thanks to Nick Piggin, Russell Currey, Christopher M. Riedl, Michael
Ellerman and Spoorthy S for their work in developing, optimising,
testing and backporting these fixes, and to the many others who helped
behind the scenes.

Kind regards,
Daniel Axtens

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.