Bug 1848279 (CVE-2020-13844)

Summary:	CVE-2020-13844 kernel: ARM straight-line speculation vulnerability
Product:	[Other] Security Response	Reporter:	Wade Mealing <wmealing>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, asavkov, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jpoimboe, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mjg59, mlangsdo, mpolacek, nmurray, ptalbert, qzhao, rt-maint, rvrbovsk, steved, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A new speculative side-channel vulnerability was found that affects the ARM processor's code, 'Straight-line speculation.' This flaw allows a local attacker to infer cache contents through measuring timing access. The highest threat from this vulnerability is to confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-08 01:18:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1848390, 1848392, 1848393, 1911197
Bug Blocks:	1846301

Description Wade Mealing 2020-06-18 07:01:49 UTC

A new novel spectulative side channel vulnerability that affects ARM processors code named "Straight line speculation" has been discovered.  

Some versions of the ARM processors may speculative execute instructions after a branch in control flow (such as RET, BR, BLR assembly instructions).  If the codepath contains a "Speculative Revelation" style gadget which can affect internal core cache states which lead to the ability to infer cache contents similar to previous spectre attacks through analysing instruction execution time.

Comment 1 Wade Mealing 2020-06-18 07:02:01 UTC

External References:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13844
http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html

Comment 5 Wade Mealing 2020-06-18 09:35:59 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1848390]

Comment 8 Wade Mealing 2020-06-22 03:54:53 UTC

This is an ARM specific flaw, which means only affects RHEL-8 and kernel-alt only.

Comment 9 Petr Matousek 2020-06-23 15:43:39 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.