Bug 1519780 (CVE-2017-5715)
| Summary: | CVE-2017-5715 hw: cpu: speculative execution branch target injection | |||
|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Petr Matousek <pmatouse> | |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | |
| Status: | CLOSED ERRATA | QA Contact: | ||
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | unspecified | CC: | admin, airlied, ajax, apevec, apmukher, aquini, areis, berrange, bhu, blc, bmcclain, bskeggs, ccui, chrisw, cperry, crobinso, cvsbot-xmlrpc, cye, danken, dblechte, dfediuck, dhoward, dominik.mierzejewski, dougsland, dracut-maint-list, dvlasenk, eblake, eedri, esammons, ewk, fadamo, fhrbata, gcovolo, gmollett, gnaik, hannsj_uhl, haoqf, hdegoede, herrold, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jbastian, jdenemar, jen, jforbes, jglisse, jjoyce, jkacur, jkastner, joe, john.j5live, jonathan, jon.dufresne, jonte.regnell, josef, jpriddy, jross, jrusnack, jschluet, jstancek, jsuchane, jwboyer, kbasil, kernel-maint, kernel-mgr, klaas, knoel, kraxel, labbott, lersek, lgoncalv, lhh, libvirt-maint, linville, liwan, lpeer, lsurette, lwang, markmc, matt, mburns, mchehab, mcressma, mgoldboi, mguzik, michal.skrivanek, mjg59, mkenneth, mlangsdo, mmilgram, mpoole, mrezanin, mst, nmurray, pbonzini, pbrobinson, pkrempa, plougher, pmatouse, poros, ppandit, pstehlik, qguo, rbalakri, rbarry, rbryant, rcain, rvrbovsk, sbonazzo, sclewis, security-response-team, sherold, skozina, slawomir, slinaber, srevivo, steved, tdecacqu, ubellavance, vcojot, victor.melnichenko, virt-maint, wainersm, williams, ycui, ykaul, ykopkova, ylavi, yozone, yturgema, zhijwang | |
| Target Milestone: | --- | Keywords: | Security | |
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: |
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks.
|
Story Points: | --- | |
| Clone Of: | CVE-2017-5753 | |||
| : | CVE-2017-5754, Meltdown (view as bug list) | Environment: | ||
| Last Closed: | 2018-05-28 14:00:02 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1476039, 1519795, 1519796, 1519797, 1519798, 1525939, 1525940, 1525942, 1525943, 1525944, 1525945, 1525946, 1525947, 1525948, 1525949, 1526943, 1526974, 1526975, 1526976, 1526977, 1526978, 1526979, 1526980, 1526981, 1526982, 1526983, 1526984, 1526985, 1526986, 1526987, 1526988, 1526989, 1526990, 1526991, 1526992, 1526993, 1526994, 1526995, 1526996, 1527310, 1527311, 1527340, 1527341, 1527342, 1527343, 1527351, 1527352, 1527353, 1527354, 1527355, 1527356, 1527357, 1527358, 1527359, 1527360, 1527361, 1527463, 1527467, 1527468, 1527469, 1527470, 1527471, 1527472, 1527549, 1527550, 1527601, 1527603, 1527863, 1527864, 1527865, 1527913, 1527914, 1527919, 1527931, 1527932, 1528023, 1528024, 1528285, 1528286, 1528287, 1528623, 1529308, 1529309, 1529310, 1529311, 1530827, 1532113, 1532114, 1532117, 1532118, 1532143, 1532733, 1532734, 1533626, 1533627, 1537188, 1538542, 1542084, 1542085, 1702512 | |||
| Bug Blocks: | 1516900, 1789852 | |||
|
Description
Petr Matousek
2017-12-01 12:59:35 UTC
Acknowledgments: Name: Google Project Zero Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1530827] This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.2 Telco Extended Update Support Via RHSA-2018:0010 https://access.redhat.com/errata/RHSA-2018:0010 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0009 https://access.redhat.com/errata/RHSA-2018:0009 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2018:0011 https://access.redhat.com/errata/RHSA-2018:0011 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0007 https://access.redhat.com/errata/RHSA-2018:0007 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0008 https://access.redhat.com/errata/RHSA-2018:0008 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0012 https://access.redhat.com/errata/RHSA-2018:0012 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0013 https://access.redhat.com/errata/RHSA-2018:0013 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0015 https://access.redhat.com/errata/RHSA-2018:0015 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0014 https://access.redhat.com/errata/RHSA-2018:0014 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0016 https://access.redhat.com/errata/RHSA-2018:0016 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 Advanced Update Support Red Hat Enterprise Linux 6.6 Telco Extended Update Support Via RHSA-2018:0017 https://access.redhat.com/errata/RHSA-2018:0017 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.4 Advanced Update Support Via RHSA-2018:0018 https://access.redhat.com/errata/RHSA-2018:0018 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.2 Advanced Update Support Via RHSA-2018:0020 https://access.redhat.com/errata/RHSA-2018:0020 This issue has been addressed in the following products: Red Hat Enterprise MRG 2 Via RHSA-2018:0021 https://access.redhat.com/errata/RHSA-2018:0021 This issue has been addressed in the following products: RHEV 4.X RHEV-H and Agents for RHEL-7 Via RHSA-2018:0025 https://access.redhat.com/errata/RHSA-2018:0025 This issue has been addressed in the following products: RHEV 3.X Hypervisor and Agents for RHEL-7 ELS Via RHSA-2018:0028 https://access.redhat.com/errata/RHSA-2018:0028 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0023 https://access.redhat.com/errata/RHSA-2018:0023 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.2 Telco Extended Update Support Via RHSA-2018:0026 https://access.redhat.com/errata/RHSA-2018:0026 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.5 Advanced Update Support Via RHSA-2018:0022 https://access.redhat.com/errata/RHSA-2018:0022 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0024 https://access.redhat.com/errata/RHSA-2018:0024 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0027 https://access.redhat.com/errata/RHSA-2018:0027 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.2 Telco Extended Update Support Via RHSA-2018:0032 https://access.redhat.com/errata/RHSA-2018:0032 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0030 https://access.redhat.com/errata/RHSA-2018:0030 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0031 https://access.redhat.com/errata/RHSA-2018:0031 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.2 Telco Extended Update Support Via RHSA-2018:0035 https://access.redhat.com/errata/RHSA-2018:0035 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.2 Advanced Update Support Via RHSA-2018:0039 https://access.redhat.com/errata/RHSA-2018:0039 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.4 Advanced Update Support Via RHSA-2018:0038 https://access.redhat.com/errata/RHSA-2018:0038 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0034 https://access.redhat.com/errata/RHSA-2018:0034 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 Advanced Update Support Red Hat Enterprise Linux 6.6 Telco Extended Update Support Via RHSA-2018:0037 https://access.redhat.com/errata/RHSA-2018:0037 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2018:0036 https://access.redhat.com/errata/RHSA-2018:0036 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0029 https://access.redhat.com/errata/RHSA-2018:0029 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.5 Advanced Update Support Via RHSA-2018:0040 https://access.redhat.com/errata/RHSA-2018:0040 This issue has been addressed in the following products: RHEV 3.X Hypervisor and Agents for RHEL-7 ELS Via RHSA-2018:0048 https://access.redhat.com/errata/RHSA-2018:0048 This issue has been addressed in the following products: RHEV 3.X Hypervisor and Agents for RHEL-6 RHEV 3.X Hypervisor and Agents for RHEL-7 ELS Via RHSA-2018:0046 https://access.redhat.com/errata/RHSA-2018:0046 This issue has been addressed in the following products: RHEV 4.X RHEV-H and Agents for RHEL-7 Via RHSA-2018:0047 https://access.redhat.com/errata/RHSA-2018:0047 This issue has been addressed in the following products: RHEV 4.X RHEV-H and Agents for RHEL-7 Via RHSA-2018:0050 https://access.redhat.com/errata/RHSA-2018:0050 This issue has been addressed in the following products: RHEV 3.X Hypervisor and Agents for RHEL-7 Via RHSA-2018:0044 https://access.redhat.com/errata/RHSA-2018:0044 This issue has been addressed in the following products: RHEV 4.X RHEV-H and Agents for RHEL-7 Via RHSA-2018:0049 https://access.redhat.com/errata/RHSA-2018:0049 This issue has been addressed in the following products: RHEV Manager version 3.6 Via RHSA-2018:0052 https://access.redhat.com/errata/RHSA-2018:0052 This issue has been addressed in the following products: RHEV Engine version 4.1 Via RHSA-2018:0051 https://access.redhat.com/errata/RHSA-2018:0051 This issue has been addressed in the following products: RHEV 4.X RHEV-H and Agents for RHEL-7 Via RHSA-2018:0045 https://access.redhat.com/errata/RHSA-2018:0045 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.2 Telco Extended Update Support Via RHSA-2018:0053 https://access.redhat.com/errata/RHSA-2018:0053 This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 (Liberty) Via RHSA-2018:0056 https://access.redhat.com/errata/RHSA-2018:0056 This issue has been addressed in the following products: Red Hat OpenStack Platform 11.0 (Ocata) Via RHSA-2018:0059 https://access.redhat.com/errata/RHSA-2018:0059 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2018:0058 https://access.redhat.com/errata/RHSA-2018:0058 This issue has been addressed in the following products: Red Hat OpenStack Platform 9.0 (Mitaka) Via RHSA-2018:0057 https://access.redhat.com/errata/RHSA-2018:0057 This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2018:0055 https://access.redhat.com/errata/RHSA-2018:0055 This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Via RHSA-2018:0054 https://access.redhat.com/errata/RHSA-2018:0054 This issue has been addressed in the following products: Red Hat OpenStack Platform 12.0 (Pike) Via RHSA-2018:0060 https://access.redhat.com/errata/RHSA-2018:0060 Added affects for arm-trusted-firmware based on this advisory: https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-6 Created arm-trusted-firmware tracking bugs for this issue: Affects: fedora-all [bug 1532143] According to https://access.redhat.com/errata/RHSA-2018:0012 this should be fixed on RHEL7 when upgrading microcode_ctl to microcode_ctl-2.1-22.2.el7.x86_64. This can be mitigated by doing the following: * Hardware (CPU microcode) support for mitigation * Kernel support for IBRS * IBRS enabled for Kernel space * IBRS enabled for User space When I check this, it does have Hardware (CPU microcode) support for mitigation and Kernel support for IBRS. Yet IBRS is still not enabled for kernel or user space by default. Which means you remain vulnerable to the attack. I validated the above through: [root@vds-jordyzomer ~]# cat /sys/kernel/debug/x86/ibrs_enabled 0 This variable needs to be set to 2 for the patch to take effect. On my systems, I get a 1 in this file: # cat /sys/kernel/debug/x86/ibrs_enabled 1 It passes the test found here: https://github.com/speed47/spectre-meltdown-checker Are you running on bare metal? I get a 0 on virtualized guests (VMware) On my dedicated server(SuperMicro MB X11SSL-F, Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz, OS CentOS 7 ) # cat /sys/kernel/debug/x86/ibrs_enabled 0 # cat /var/log/yum.log|grep "kernel\|micro" Jan 09 10:42:56 Updated: kernel-tools-libs-3.10.0-693.11.6.el7.x86_64 Jan 09 10:43:07 Installed: kernel-3.10.0-693.11.6.el7.x86_64 Jan 09 10:43:18 Updated: kernel-tools-3.10.0-693.11.6.el7.x86_64 Jan 09 10:43:23 Updated: 2:microcode_ctl-2.1-22.2.el7.x86_64 # It is indeed a virtualized guest. I believe it appears the Processors are too old. I believe there's no patch available yet for older hardware. Only newer processors. @vvm7ua Your processor is from 2015. The defaults for older processors are: pti - 1 ibpb - 0 ibrs - 0 Looks like we will have to wait :) The microcode update microcode_ctl-2.1-22.2.el7.x86_64 only includes updates for certain cpus, what you need is a bios update by your server vendor or a microcode update for your cpu. If the microcode/bios update is working your cpu will show show with new flags in lscpu: spec_ctrl and ibpb_support if those are in place ibpb and ibrs default to 1 on boot. (see https://access.redhat.com/articles/3311301). Hi, Can I know where the fix for libvirt is as I can't find it in libvirt's upstream or maillist? Thanks! Did you check https://access.redhat.com/security/vulnerabilities/speculativeexecution, resolve tab? (In reply to Robin from comment #91) > Can I know where the fix for libvirt is as I can't find it in libvirt's > upstream or maillist? https://www.redhat.com/archives/libvir-list/2018-January/msg00282.html (In reply to Jiri Denemark from comment #93) > (In reply to Robin from comment #91) > > Can I know where the fix for libvirt is as I can't find it in libvirt's > > upstream or maillist? > > https://www.redhat.com/archives/libvir-list/2018-January/msg00282.html Thanks a lot Jiri! The code is really helpful which is what I want! This issue has been addressed in the following products: CloudForms Management Engine 4.1 Via RHSA-2018:0089 https://access.redhat.com/errata/RHSA-2018:0089 This issue has been addressed in the following products: CloudForms Management Engine 4.2 Via RHSA-2018:0090 https://access.redhat.com/errata/RHSA-2018:0090 This issue has been addressed in the following products: CloudForms Management Engine 4.5 Via RHSA-2018:0091 https://access.redhat.com/errata/RHSA-2018:0091 This issue has been addressed in the following products: CloudForms Management Engine 5.5 Via RHSA-2018:0092 https://access.redhat.com/errata/RHSA-2018:0092 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Telco Extended Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0094 https://access.redhat.com/errata/RHSA-2018:0094 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.2 Advanced Update Support Red Hat Enterprise Linux 6.4 Advanced Update Support Red Hat Enterprise Linux 6.5 Advanced Update Support Red Hat Enterprise Linux 6.6 Advanced Update Support Red Hat Enterprise Linux 6.6 Telco Extended Update Support Red Hat Enterprise Linux 6.7 Extended Update Support Red Hat Enterprise Linux 7.2 Advanced Update Support Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions Red Hat Enterprise Linux 7.2 Telco Extended Update Support Red Hat Enterprise Linux 7.3 Extended Update Support Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2018:0093 https://access.redhat.com/errata/RHSA-2018:0093 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.4 Advanced Update Support Via RHSA-2018:0106 https://access.redhat.com/errata/RHSA-2018:0106 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.2 Advanced Update Support Via RHSA-2018:0107 https://access.redhat.com/errata/RHSA-2018:0107 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.5 Advanced Update Support Via RHSA-2018:0105 https://access.redhat.com/errata/RHSA-2018:0105 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2018:0103 https://access.redhat.com/errata/RHSA-2018:0103 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.2 Advanced Update Support Via RHSA-2018:0112 https://access.redhat.com/errata/RHSA-2018:0112 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.4 Advanced Update Support Via RHSA-2018:0111 https://access.redhat.com/errata/RHSA-2018:0111 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.5 Advanced Update Support Via RHSA-2018:0110 https://access.redhat.com/errata/RHSA-2018:0110 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 Advanced Update Support Red Hat Enterprise Linux 6.6 Telco Extended Update Support Via RHSA-2018:0104 https://access.redhat.com/errata/RHSA-2018:0104 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 Advanced Update Support Red Hat Enterprise Linux 6.6 Telco Extended Update Support Via RHSA-2018:0109 https://access.redhat.com/errata/RHSA-2018:0109 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2018:0108 https://access.redhat.com/errata/RHSA-2018:0108 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0151 https://access.redhat.com/errata/RHSA-2018:0151 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Extended Update Support Via RHSA-2018:0182 https://access.redhat.com/errata/RHSA-2018:0182 This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Extended Lifecycle Support Via RHSA-2018:0292 https://access.redhat.com/errata/RHSA-2018:0292 This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2018:0496 https://access.redhat.com/errata/RHSA-2018:0496 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0512 https://access.redhat.com/errata/RHSA-2018:0512 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0654 https://access.redhat.com/errata/RHSA-2018:0654 This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Extended Lifecycle Support Via RHSA-2018:1196 https://access.redhat.com/errata/RHSA-2018:1196 This issue has been addressed in the following products: Red Hat Enterprise Linux 5.9 Long Life Via RHSA-2018:1252 https://access.redhat.com/errata/RHSA-2018:1252 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:1967 https://access.redhat.com/errata/RHSA-2018:1967 Statement: Please see the Vulnerability Response article for the full list of updates available and a detailed discussion of this issue. |