Bug 1845840 (CVE-2020-10766) - CVE-2020-10766 kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection.
Summary: CVE-2020-10766 kernel: Rogue cross-process SSBD shutdown. Linux scheduler log...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10766
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1846029 1847354 1847355 1847356 1847357 1847358 1847359 1847360 1847361 1847362 1847369 1847370 1847371 1847372
Blocks: 1845835
TreeView+ depends on / blocked
 
Reported: 2020-06-10 08:21 UTC by Wade Mealing
Modified: 2021-06-16 02:57 UTC (History)
57 users (show)

Fixed In Version: Linux kernel 5.8-rc1
Doc Type: If docs needed, set a value
Doc Text:
A logic bug flaw was found in the Linux kernel’s implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.
Clone Of:
Environment:
Last Closed: 2020-07-21 13:28:16 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:3086 0 None None None 2020-07-22 01:04:39 UTC
Red Hat Product Errata RHSA-2020:3010 0 None None None 2020-07-21 11:05:47 UTC
Red Hat Product Errata RHSA-2020:3016 0 None None None 2020-07-21 11:23:49 UTC
Red Hat Product Errata RHSA-2020:3041 0 None None None 2020-07-21 14:32:41 UTC
Red Hat Product Errata RHSA-2020:3073 0 None None None 2020-07-21 16:24:17 UTC
Red Hat Product Errata RHSA-2020:3222 0 None None None 2020-07-29 19:37:29 UTC
Red Hat Product Errata RHSA-2020:3297 0 None None None 2020-08-04 07:38:08 UTC

Description Wade Mealing 2020-06-10 08:21:45 UTC 
A logic bug was found in the Linux kernels implementation of SSBD. A bug in the logic handling can allow an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place.

This was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching.

Introduced by:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5bfbe3ad5840d941b89bcac54b821ba14f50a0ba
Comment 1 Wade Mealing 2020-06-10 10:54:46 UTC 
That makes the CPU vulnerable to Spectre v4.
Comment 3 Wade Mealing 2020-06-11 06:39:43 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 8 Wade Mealing 2020-06-16 09:28:03 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1847354]
Comment 11 Fedora Update System 2020-06-19 01:04:38 UTC 
FEDORA-2020-125ccdc871 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 12 Fedora Update System 2020-06-23 01:13:39 UTC 
FEDORA-2020-1b2dae6219 has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 14 Petr Matousek 2020-06-23 15:29:33 UTC 
Statement:

This flaw is rated as having Important impact because it can be used to disable Spectre v4, which has a rating of Important.
Comment 21 errata-xmlrpc 2020-07-21 11:05:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3010 https://access.redhat.com/errata/RHSA-2020:3010
Comment 22 errata-xmlrpc 2020-07-21 11:23:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3016 https://access.redhat.com/errata/RHSA-2020:3016
Comment 23 Product Security DevOps Team 2020-07-21 13:28:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10766
Comment 24 errata-xmlrpc 2020-07-21 14:32:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3041 https://access.redhat.com/errata/RHSA-2020:3041
Comment 25 errata-xmlrpc 2020-07-21 16:24:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3073 https://access.redhat.com/errata/RHSA-2020:3073
Comment 26 errata-xmlrpc 2020-07-29 19:37:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3222 https://access.redhat.com/errata/RHSA-2020:3222
Comment 27 errata-xmlrpc 2020-08-04 07:38:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3297 https://access.redhat.com/errata/RHSA-2020:3297
Comment 28 Petr Matousek 2020-09-14 11:39:34 UTC 
External References:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbbe2ad02e9df26e372f38cc3e70dab9222c832e
Note You need to log in before you can comment on or make changes to this bug.