Bug 1845868 (CVE-2020-10768) - CVE-2020-10768 kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.
Summary: CVE-2020-10768 kernel: Indirect branch speculation can be enabled after it wa...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10768
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1846029 1847396 1847398 1847400 1847392 1847393 1847394 1847395 1847397 1847399 1847401 1847402
Blocks: 1845835
TreeView+ depends on / blocked
 
Reported: 2020-06-10 09:52 UTC by Wade Mealing
Modified: 2020-09-14 11:42 UTC (History)
55 users (show)

Fixed In Version: Linux kernel 5.8-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.
Clone Of:
Environment:
Last Closed: 2020-07-21 13:28:26 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:3086 None None None 2020-07-22 01:04:42 UTC
Red Hat Product Errata RHSA-2020:3010 None None None 2020-07-21 11:06:05 UTC
Red Hat Product Errata RHSA-2020:3016 None None None 2020-07-21 11:24:03 UTC
Red Hat Product Errata RHSA-2020:3041 None None None 2020-07-21 14:32:51 UTC
Red Hat Product Errata RHSA-2020:3073 None None None 2020-07-21 16:24:22 UTC
Red Hat Product Errata RHSA-2020:3222 None None None 2020-07-29 19:37:38 UTC
Red Hat Product Errata RHSA-2020:3297 None None None 2020-08-04 07:38:12 UTC

Description Wade Mealing 2020-06-10 09:52:30 UTC
The prctl() function can be used to enable indirect branch speculation even after it has been disabled.  This same call will incorrectly report it being 'force disabled' when it is not.

Comment 1 Wade Mealing 2020-06-10 10:56:22 UTC
That makes the CPU vulnerable to Spectre v2.

Comment 5 Wade Mealing 2020-06-16 10:12:13 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1847392]

Comment 8 Wade Mealing 2020-06-16 10:24:29 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 9 Fedora Update System 2020-06-19 01:04:46 UTC
FEDORA-2020-125ccdc871 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2020-06-23 01:13:46 UTC
FEDORA-2020-1b2dae6219 has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Petr Matousek 2020-06-23 15:33:54 UTC
Statement:

This flaw is rated as having Important impact, because it enables exploitation of the previous Spectre v2 attack, which has a rating of Important.

Comment 15 errata-xmlrpc 2020-07-21 11:05:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3010 https://access.redhat.com/errata/RHSA-2020:3010

Comment 16 errata-xmlrpc 2020-07-21 11:23:57 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3016 https://access.redhat.com/errata/RHSA-2020:3016

Comment 17 Product Security DevOps Team 2020-07-21 13:28:26 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10768

Comment 18 errata-xmlrpc 2020-07-21 14:32:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:3041 https://access.redhat.com/errata/RHSA-2020:3041

Comment 19 errata-xmlrpc 2020-07-21 16:24:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3073 https://access.redhat.com/errata/RHSA-2020:3073

Comment 20 errata-xmlrpc 2020-07-29 19:37:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3222 https://access.redhat.com/errata/RHSA-2020:3222

Comment 21 errata-xmlrpc 2020-08-04 07:38:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:3297 https://access.redhat.com/errata/RHSA-2020:3297


Note You need to log in before you can comment on or make changes to this bug.