Bug 1753065 - hw: VERW information leak - incomplete fix of buffer clearing for previous MDS fixes
Summary: hw: VERW information leak - incomplete fix of buffer clearing for previous MD...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1764961 1764962 1764963 1764964 1764965 1764966 1764967 1764968 1764969 1764970 1764971 1764972 1766928 1767755 1771652
Blocks: 1752312
TreeView+ depends on / blocked
 
Reported: 2019-09-18 01:56 UTC by Wade Mealing
Modified: 2021-10-25 22:11 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-25 22:11:33 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2019:3845 0 None None None 2019-11-12 21:37:09 UTC
Red Hat Product Errata RHEA-2019:3846 0 None None None 2019-11-12 22:38:10 UTC

Description Wade Mealing 2019-09-18 01:56:57 UTC
When creating the initial fix for previous MDS issues.  Intel created a firmware update that enabled buffer clearing on conditions which allowed the attack to take place.

- VERW instruction
- L1D_FLUSH instruction
- RSM (Return from System Management mode)
- SGX Enter and SGX Exit. (Secure Enclave Enter and Exit).

The VERW and L1D_FLUSH commands were used by operating system vendors to instruct the firmware running on the affected processors to overwrite buffer values that can be used in the various MDS attack set.

The particular flaw is that the L1D buffers were incorrectly cleared and not all bits of the buffer were set to zero.  Some parts (Bits 16-31 and 48-63) of the buffer were restored to their last known value prior to clearing.

This allows a partial view into shared data by the system but not to the same extent as previous MDS flaws.  

A local attacker would need to execute and MDS style attack on systems to gather intelligence on the system.  The attack reliability is expected to be considerably less than previous MDS style attacks.

A microcode update from Intel is forthcoming with no expected performance impact.

Comment 6 Wade Mealing 2019-11-12 08:23:47 UTC
Acknowledgements:

Red Hat thanks Intel for reporting this issue and collaborating on the mitigations for the same.

Comment 7 Prasad Pandit 2019-11-12 09:50:52 UTC
Statement:

Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/solutions/2019-microcode-nov

Comment 8 Prasad Pandit 2019-11-12 09:50:55 UTC
External References:

https://access.redhat.com/solutions/2019-microcode-nov

Comment 9 Prasad Pandit 2019-11-12 09:50:58 UTC
Mitigation:

As of this time there are no known mitigations. Please install relevant updated packages to address this flaw.

Comment 10 Prasad Pandit 2019-11-12 18:10:30 UTC
Created microcode_ctl tracking bugs for this issue:

Affects: fedora-all [bug 1771652]


Note You need to log in before you can comment on or make changes to this bug.