Bug 1561794 (CVE-2018-9056)
| Summary: | CVE-2018-9056 hw: cpu: speculative execution branch predictor side-channel attack | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED CANTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | airlied, ajax, aquini, bhu, blc, bskeggs, dhoward, esammons, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, john.j5live, jonathan, josef, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, lwang, matt, mchehab, mcressma, mguzik, mjg59, mlangsdo, nmurray, plougher, ppandit, qguo, rt-maint, rvrbovsk, skozina, steved, williams, yoguma, yozone |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
BranchScope is a new class of attack which leverages functioning of the Branch Prediction Unit (BPU) of a processor to infer/leak sensitive process information, which is involved in the branch decision making (if (x) { x ^ y; } else {x & y;}). In this, BranchScope side-channel could help to infer 'x', by observing prediction patterns of the Branch Prediction Unit (BPU).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-18 06:08:29 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1561040 | ||
BranchScope isn't a kernel issue. It presents a new side-channel attack vector to infer/leak sensitive information from a process. There are numerous side-channels which can be used to leak sensitive information(ex. cryptographic keys). Ex. Cache-timing, Flush-reload, Branch Prediction side channel et. el. There are also instances wherein acoustic sounds produced during cryptographic operations or power consumption patterns of a machine performing such operations have been studied to leak/infer sensitive information. BranchScope is yet another method. Countermeasure against BranchScope side channel is for software to avoid branching(if..else) instructions. And any changes/tweaks that can be made into hardware function which is leveraged to infer/leak sensitive data bits. In BranchScope's case that would Branch Prediction Unit(BPU). It is not something to be fixed in the kernel. Mitigation: This is a hardware processor issue, not a Linux kernel flaw. The flaw specifically targets software which uses sensitive information in branching expressions. A software mitigation could be for the target software to avoid the use of sensitive data bits in (if..else) branching decisions or to avoid (if..else) branching altogether. |
BranchScope is a new class of attack which leverages functioning of the Branch Prediction Unit (BPU) of a processor to infer/leak sensitive process information, which is involved in the branch decision making. ex. if (x) { x ^ y; } else {x & y;}. In this, BranchScope side-channel could help to infer 'x', by observing prediction patterns of the Branch Prediction Unit(BPU). This is a h/w processor issue; Not really a Linux kernel one. It is specific to a target software which uses sensitive information in branching expressions. A software mitigation could be for target software to avoid use of sensitive data bits in (if..else) branching decisions or to avoid (if..else) branching altogether. It could not be fixed generically in the Linux kernel for all applications. External References: http://www.cs.ucr.edu/~nael/pubs/asplos18.pdf https://arstechnica.com/gadgets/2018/03/its-not-just-spectre-researchers-reveal-more-branch-prediction-attacks/