Bug 2187257 (CVE-2023-1998) - CVE-2023-1998 kernel: Spectre v2 SMT mitigations problem
Summary: CVE-2023-1998 kernel: Spectre v2 SMT mitigations problem
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-1998
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2187266 2187267 2187268 2187269 2214849 2215056 2187260 2215014 2215108
Blocks: 2187222
TreeView+ depends on / blocked
 
Reported: 2023-04-17 09:19 UTC by Mauro Matteo Cascella
Modified: 2023-08-01 17:02 UTC (History)
48 users (show)

Fixed In Version: kernel 6.3
Doc Type: If docs needed, set a value
Doc Text:
It was found that the Linux Kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes running on the same physical core in another hyperthread.
Clone Of:
Environment:
Last Closed: 2023-08-01 17:02:32 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4377 0 None None None 2023-08-01 09:17:34 UTC
Red Hat Product Errata RHSA-2023:4378 0 None None None 2023-08-01 08:59:21 UTC

Description Mauro Matteo Cascella 2023-04-17 09:19:55 UTC 
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp [..] The kernel failed to protect applications that attempted to protect against Spectre v2 leaving them open to attack from other processes running on the same physical core in another hyperthread.

Reference:
https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx

Upstream fix:
https://github.com/torvalds/linux/commit/6921ed9049bc7457f66c1596c5b78aec0dae4a9d
Comment 1 Mauro Matteo Cascella 2023-04-17 09:30:29 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2187260]
Comment 6 Justin M. Forbes 2023-04-19 11:48:09 UTC 
This was fixed for Fedora with the 6.1.16 stable kernel updates.
Comment 16 errata-xmlrpc 2023-08-01 08:59:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4378 https://access.redhat.com/errata/RHSA-2023:4378
Comment 17 errata-xmlrpc 2023-08-01 09:17:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4377 https://access.redhat.com/errata/RHSA-2023:4377
Comment 18 Product Security DevOps Team 2023-08-01 17:02:29 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1998
Note You need to log in before you can comment on or make changes to this bug.