mbox series

[SRU,OEM-6.0,0/3] CVE-2022-27672

Message ID 20230808171842.83827-1-cascardo@canonical.com
Headers show
Series CVE-2022-27672 | expand

Message

Thadeu Lima de Souza Cascardo Aug. 8, 2023, 5:18 p.m. UTC 
[Impact]
A VM may force the CPU to go to idle and when it gets back from idle, it
could leverage the RSB from a sibling thread to mount a speculative
execution attack.

[Backport]
Simple conflicts and the placement of setting mitigate_smt_rsb.

[Potential regression]
It would affect VMs, specially when dealing with idleness.


Tom Lendacky (3):
  x86/speculation: Identify processors vulnerable to SMT RSB predictions
  KVM: x86: Mitigate the cross-thread return address predictions bug
  Documentation/hw-vuln: Add documentation for Cross-Thread Return
    Predictions

 .../admin-guide/hw-vuln/cross-thread-rsb.rst  | 92 +++++++++++++++++++
 Documentation/admin-guide/hw-vuln/index.rst   |  1 +
 arch/x86/include/asm/cpufeatures.h            |  1 +
 arch/x86/kernel/cpu/common.c                  |  9 +-
 arch/x86/kvm/x86.c                            | 43 ++++++---
 5 files changed, 133 insertions(+), 13 deletions(-)
 create mode 100644 Documentation/admin-guide/hw-vuln/cross-thread-rsb.rst

Comments

Cengiz Can Aug. 9, 2023, 3:57 a.m. UTC | #1 
On 08/08/2023 20:18, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> A VM may force the CPU to go to idle and when it gets back from idle, it
> could leverage the RSB from a sibling thread to mount a speculative
> execution attack.
>
> [Backport]
> Simple conflicts and the placement of setting mitigate_smt_rsb.
>
> [Potential regression]
> It would affect VMs, specially when dealing with idleness.
>
>
> Tom Lendacky (3):
>    x86/speculation: Identify processors vulnerable to SMT RSB predictions
>    KVM: x86: Mitigate the cross-thread return address predictions bug
>    Documentation/hw-vuln: Add documentation for Cross-Thread Return
>      Predictions
Acked-by: Cengiz Can <cengiz.can@canonical.com>
>
>   .../admin-guide/hw-vuln/cross-thread-rsb.rst  | 92 +++++++++++++++++++
>   Documentation/admin-guide/hw-vuln/index.rst   |  1 +
>   arch/x86/include/asm/cpufeatures.h            |  1 +
>   arch/x86/kernel/cpu/common.c                  |  9 +-
>   arch/x86/kvm/x86.c                            | 43 ++++++---
>   5 files changed, 133 insertions(+), 13 deletions(-)
>   create mode 100644 Documentation/admin-guide/hw-vuln/cross-thread-rsb.rst
>
Tim Gardner Aug. 9, 2023, 12:30 p.m. UTC | #2 
On 8/8/23 11:18 AM, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> A VM may force the CPU to go to idle and when it gets back from idle, it
> could leverage the RSB from a sibling thread to mount a speculative
> execution attack.
> 
> [Backport]
> Simple conflicts and the placement of setting mitigate_smt_rsb.
> 
> [Potential regression]
> It would affect VMs, specially when dealing with idleness.
> 
> 
> Tom Lendacky (3):
>    x86/speculation: Identify processors vulnerable to SMT RSB predictions
>    KVM: x86: Mitigate the cross-thread return address predictions bug
>    Documentation/hw-vuln: Add documentation for Cross-Thread Return
>      Predictions
> 
>   .../admin-guide/hw-vuln/cross-thread-rsb.rst  | 92 +++++++++++++++++++
>   Documentation/admin-guide/hw-vuln/index.rst   |  1 +
>   arch/x86/include/asm/cpufeatures.h            |  1 +
>   arch/x86/kernel/cpu/common.c                  |  9 +-
>   arch/x86/kvm/x86.c                            | 43 ++++++---
>   5 files changed, 133 insertions(+), 13 deletions(-)
>   create mode 100644 Documentation/admin-guide/hw-vuln/cross-thread-rsb.rst
> 
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Timo Aaltonen Aug. 11, 2023, 9:44 a.m. UTC | #3 
Thadeu Lima de Souza Cascardo kirjoitti 8.8.2023 klo 20.18:
> [Impact]
> A VM may force the CPU to go to idle and when it gets back from idle, it
> could leverage the RSB from a sibling thread to mount a speculative
> execution attack.
> 
> [Backport]
> Simple conflicts and the placement of setting mitigate_smt_rsb.
> 
> [Potential regression]
> It would affect VMs, specially when dealing with idleness.
> 
> 
> Tom Lendacky (3):
>    x86/speculation: Identify processors vulnerable to SMT RSB predictions
>    KVM: x86: Mitigate the cross-thread return address predictions bug
>    Documentation/hw-vuln: Add documentation for Cross-Thread Return
>      Predictions
> 
>   .../admin-guide/hw-vuln/cross-thread-rsb.rst  | 92 +++++++++++++++++++
>   Documentation/admin-guide/hw-vuln/index.rst   |  1 +
>   arch/x86/include/asm/cpufeatures.h            |  1 +
>   arch/x86/kernel/cpu/common.c                  |  9 +-
>   arch/x86/kvm/x86.c                            | 43 ++++++---
>   5 files changed, 133 insertions(+), 13 deletions(-)
>   create mode 100644 Documentation/admin-guide/hw-vuln/cross-thread-rsb.rst
> 

applied to oem-6.0, thanks