oss-security - Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230925163652.GA6750@openwall.com>
Date: Mon, 25 Sep 2023 18:36:52 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: "Xen. org security team" <security-team-members@....org>
Subject: Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak

Hi,

Thank you Xen security team for indirectly bringing the various CPU
issues in here.  This is very helpful, as your messages on them serve
two purposes at once - informing the community about issues fixed in Xen
(so directly on-topic here, with Xen being Open Source) and about the
CPU issues that typically also need to be mitigated by other projects.

On Mon, Sep 25, 2023 at 04:05:37PM +0000, Xen. org security team wrote:
>             Xen Security Advisory CVE-2023-20588 / XSA-439
> 
>              x86/AMD: Divide speculative information leak
> 
> ISSUE DESCRIPTION
> =================
> 
> In the Zen1 microarchitecure, there is one divider in the pipeline which
> services uops from both threads.  In the case of #DE, the latched result
> from the previous DIV to execute will be forwarded speculatively.
> 
> This is a covert channel that allows two threads to communicate without
> any system calls.  In also allows userspace to obtain the result of the
> most recent DIV instruction executed (even speculatively) in the core,
> which can be from a higher privilege context.
> 
> For more information, see:
>  * https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html

The above link is wrong - it's for CVE-2023-20593 Zenbleed in Zen2.

The correct link for CVE-2023-20588, the DIV bug in Zen1, appears to be:

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7007.html

While I am at it, here's the corresponding mitigation in Linux kernel:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=77245f1c3c6495521f6a3af082696ee2f8ce3921

> author	Borislav Petkov (AMD) <bp@...en8.de>	2023-08-05 00:06:43 +0200
> committer	Linus Torvalds <torvalds@...ux-foundation.org>	2023-08-09 07:55:00 -0700
> 
> x86/CPU/AMD: Do not leak quotient data after a division by 0
> 
> Under certain circumstances, an integer division by 0 which faults, can
> leave stale quotient data from a previous division operation on Zen1
> microarchitectures.
> 
> Do a dummy division 0/1 before returning from the #DE exception handler
> in order to avoid any leaks of potentially sensitive data.
> 
> Signed-off-by: Borislav Petkov (AMD) <bp@...en8.de>
> Cc: <stable@...nel.org>
> Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.