The IBM Power9 processors can speculatively operate on data stored in the L1 cache before it has been completely validated. Unlike other attacks, the attack has limited access to memory and is only able to access memory normally permissable to the execution context. The Power9 systems implement hardware and microcode measures to mitigate unprotected data leakage. An attacker may however induce a condition where the operating system speculative execute instructions using data that the attacker controls. Measuring the timing access of the execution can allow an attacker with a local account to be able to infer memory contents.
Acknowledgments: Name: Anthony Steinhauser (Google's Safeside Project)
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1900437]
External References: https://lore.kernel.org/linuxppc-dev/20201119231333.361771-1-dja@axtens.net/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc https://www.openwall.com/lists/oss-security/2020/11/20/3 https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-4788