CVE-2020-4788: Speculation on incompletely validated data on IBM Power9
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Hi,
IBM Power9 processors can speculatively operate on data in the L1 cache before it has been completely validated, via a way-prediction mechanism. It is not possible for an attacker to determine the contents of impermissible memory using this method, since these systems implement a combination of hardware and software security measures to prevent scenarios where protected data could be leaked.
However these measures don't address the scenario where an attacker induces the operating system to speculatively execute instructions using data that the attacker controls. This can be used for example to speculatively bypass "kernel user access prevention" techniques, as discovered by Anthony Steinhauser of Google's Safeside Project. This is not an attack by itself, but there is a possibility it could be used in conjunction with side-channels or other weaknesses in the privileged code to construct an attack.
This issue can be mitigated by flushing the L1 cache between privilege boundaries of concern.
CVEID: CVE-2020-4788
Current description/CVSS info (subject to revision)
-------
Description: IBM Power9 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances.
CVSS Base Score: 2.9
CVSS Temporal Score: https:/
CVSS Vector: (CVSS:3.
Embargo details
---------------
Please do not disclose any of this information prior to 20 November 2020, as that is the coordinated date for CVE details, AIX and IBM i fixes to be released. We will confirm the precise time of day shortly.
Fix details
-----------
In general, this issue is mitigated by flushing the L1D cache when entering the kernel and after any in-kernel userspace memory accesses.
Please find attached patches against Focal, Bionic and Xenial. Let me know if you want backports to Groovy done at this stage.
Changed in linux (Ubuntu): | |
status: | New → Confirmed |
Changed in linux (Ubuntu): | |
status: | Confirmed → Fix Committed |
We've detected an issue where these patches will cause the `rfi_flush` self-test to fail. This failure does *not* indicate a failure of the RFI flush (kernel exit flush) mechanism. The test measures the number of L1D cache misses with RFI flushing enabled and disabled. The test expects the number of L1D misses to fall when RFI flush is disabled. However, the entry flush is causing the number of flushes to remain high, causing a test failure. If entry flushes are disabled before running the test, it will pass.
We are fixing this and will supply you with an additional patch for supported kernel trees that fixes the test.