Bezpečnostní chyba CVE-2020-0543 (SRBDS/CrossTalk) v procesorech Intel

Intel potvrdil bezpečnostní chybu CVE-2020-0543 ve svých procesorech. Pojmenoval ji SRBDS - Special Register Buffer Data Sampling. Výzkumníci z VUSec (Systems and Network Security Group at Vrije Universiteit Amsterdam) ji pojmenovali CrossTalk. Ukázka zneužití na YouTube. Detaily související s Linuxem v souboru special-register-buffer-data-sampling.rst.

10.6.2020 08:00 | Ladislav Hagara | Bezpečnostní upozornění

Komentáře

[Peter Golis]

Bude aj nová doména?

[lertimir]

Kolik máte položek v /sys/devices/system/cpu/vulnerabilities/ a kolik z nich jsou jiné než "Not affected"? Já mám

 
$ cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass 
Mitigation: Speculative Store Bypass disabled via prctl and seccomp

$ cat /sys/devices/system/cpu/vulnerabilities/spectre_v1       
Mitigation: usercopy/swapgs barriers and __user pointer sanitization

$ cat /sys/devices/system/cpu/vulnerabilities/spectre_v2
Mitigation: Full AMD retpoline, STIBP: disabled, RSB filling

[Jiri]

/sys/devices/system/cpu/vulnerabilities/itlb_multihit KVM: Mitigation: Split huge pages
/sys/devices/system/cpu/vulnerabilities/l1tf Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/mds Mitigation: Clear CPU buffers; SMT vulnerable
/sys/devices/system/cpu/vulnerabilities/meltdown Mitigation: PTI
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass Mitigation: Speculative Store Bypass disabled via prctl and seccomp
/sys/devices/system/cpu/vulnerabilities/spectre_v1 Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2 Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort Mitigation: Clear CPU buffers; SMT vulnerable

[Peter Fodrek]

u mňa

ls /sys/devices/system/cpu/vulnerabilities/ |wc -l

8

cat /sys/devices/system/cpu/vulnerabilities/*

Not affected

Not affected

Not affected

Not affected

Mitigation: Speculative Store Bypass disabled via prctl and seccomp

Mitigation: usercopy/swapgs barriers and __user pointer sanitization

Mitigation: Full AMD retpoline, STIBP: disabled, RSB filling

Not affected

uname -a

Linux ....PC-SUSE 5.7.1-2.gc4df4ce-default #1 SMP Mon Jun 8 12:06:34 UTC 2020 (c4df4ce) x86_64 x86_64 x86_64 GNU/Linux

[AraxoN]

Intel(R) Atom(TM) CPU N2800 @ 1.86GHz:

cat /sys/devices/system/cpu/vulnerabilities/*
Not affected
Not affected
Not affected
Not affected
Not affected
Not affected
Not affected
Not affected

[Michal Kubeček]

To je dost překvapivé, protože když jsem to před časem zkoušel na 10 let starém netbooku s Atomem N450, našlo se tam toho docela dost.

[Jiri Kosina]

Kompletni seznam vyjimek, posveceny Intelem, je v arch/x86/kernel/cpu/common.c:cpu_vuln_whitelist[]

[AraxoN]

Cedarview sa tam nespomína... Ale že by práve tento jeden Atom bol imúnny voči všetkým tým chybám, to sa mi nechce veriť.

[Jiri Kosina]

To je family fam 0x06 model 0x36, coz je pod konstantou INTEL_FAM6_ATOM_SALTWELL.

[Jana J.]

Není Atom jako Atom, tohle mi vyhodí C2750 s jádrem 5.4.38:

itlb_multihit:Not affected
l1tf:Not affected
mds:Mitigation: Clear CPU buffers; SMT disabled
meltdown:Mitigation: PTI
spec_store_bypass:Not affected
spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling
tsx_async_abort:Not affected

[k3dAR]

Atom x5-Z8350 (Xubuntu 18.04 s 5.3.0-46), Atom Z3795 (Ubuntu 20.04 s 5.4.0-33):

$ grep ^ /sys/devices/system/cpu/vulnerabilities/* | cut -d/ -f7
itlb_multihit:Not affected
l1tf:Not affected
mds:Mitigation: Clear CPU buffers; SMT disabled
meltdown:Mitigation: PTI
spec_store_bypass:Not affected
spectre_v1:Mitigation: usercopy
spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling
tsx_async_abort:Not affected