Bug 1845840 (CVE-2020-10766)
| Summary: | CVE-2020-10766 kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection. | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Wade Mealing <wmealing> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | acaringi, airlied, asavkov, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jbastian, jeremy, jforbes, jglisse, jlelli, joe.lawrence, john.j5live, jonathan, josef, jpoimboe, jross, jshortt, jstancek, jthierry, jwboyer, kcarcia, kernel-maint, kernel-mgr, labbott, lgoncalv, lilu, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, mvanderw, nmurray, ppandit, ptalbert, qzhao, rhandlin, rt-maint, rvrbovsk, steved, williams, ycote |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Linux kernel 5.8-rc1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-21 13:28:16 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1846029, 1847354, 1847355, 1847356, 1847357, 1847358, 1847359, 1847360, 1847361, 1847362, 1847369, 1847370, 1847371, 1847372 | ||
| Bug Blocks: | 1845835 | ||
|
Description
Wade Mealing
2020-06-10 08:21:45 UTC
That makes the CPU vulnerable to Spectre v4. Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1847354] FEDORA-2020-125ccdc871 has been pushed to the Fedora 32 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2020-1b2dae6219 has been pushed to the Fedora 31 stable repository. If problem still persists, please make note of it in this bug report. Statement: This flaw is rated as having Important impact because it can be used to disable Spectre v4, which has a rating of Important. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3010 https://access.redhat.com/errata/RHSA-2020:3010 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3016 https://access.redhat.com/errata/RHSA-2020:3016 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10766 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:3041 https://access.redhat.com/errata/RHSA-2020:3041 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3073 https://access.redhat.com/errata/RHSA-2020:3073 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:3222 https://access.redhat.com/errata/RHSA-2020:3222 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:3297 https://access.redhat.com/errata/RHSA-2020:3297 |