Bug 1888433 (CVE-2020-4788) - CVE-2020-4788 kernel: speculation on incompletely validated data on IBM Power9
Summary: CVE-2020-4788 kernel: speculation on incompletely validated data on IBM Power9
Keywords:
Status: NEW
Alias: CVE-2020-4788
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1894804 1896200 1894805 1896201 1900437
Blocks: 1888435
TreeView+ depends on / blocked
 
Reported: 2020-10-14 20:37 UTC by Guilherme de Almeida Suckevicz
Modified: 2020-11-26 15:34 UTC (History)
48 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The IBM Power9 processors can speculatively operate on data stored in the L1 cache before it has been completely validated. Unlike other attacks, the attack has limited access to memory and is only able to access memory normally permissible to the execution context. Other speculative execution gadgets may draw valid memory into the processes address space to be inferred by an attacker.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-10-14 20:37:11 UTC
The  IBM Power9 processors can speculatively operate on data stored in the L1 cache before it has been completely validated.  Unlike other attacks, the attack has limited access to memory and is only able to access memory normally permissable to the execution context. The Power9 systems implement hardware and microcode measures to mitigate unprotected data leakage.  An attacker may however induce a condition where the operating system speculative execute instructions using data that the attacker controls.   Measuring the timing access of the execution can allow an attacker with a local account to be able to infer memory contents.

Comment 7 Wade Mealing 2020-11-09 06:17:48 UTC
Acknowledgments:

Name: Anthony Steinhauser (Google's Safeside Project)

Comment 11 Wade Mealing 2020-11-23 01:38:32 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1900437]

Comment 14 Petr Matousek 2020-11-26 15:33:23 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.


Note You need to log in before you can comment on or make changes to this bug.