Bug 2141026 (CVE-2023-3006) - CVE-2023-3006 RHEL: Add Spectre-BHB mitigation for AmpereOne
Summary: CVE-2023-3006 RHEL: Add Spectre-BHB mitigation for AmpereOne
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-3006
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2211357
Blocks: 2140724 2140727 2141027
TreeView+ depends on / blocked
 
Reported: 2022-11-08 14:05 UTC by Sage McTaggart
Modified: 2024-06-05 16:11 UTC (History)
46 users (show)

Fixed In Version: Linux Kernel 6.1-rc1
Doc Type: If docs needed, set a value
Doc Text:
A known cache speculation vulnerability, the Branch History Injection (BHI) or Spectre-BHB, was found in new hw (that are cores Cortex: A57, A72, A76, A77, A78, A78AE, A78C, A710, X1, X2; Neoverse: N1, N2, V1; Ampere1). Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to information disclosure.
Clone Of:
Environment:
Last Closed: 2023-05-16 20:48:25 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:3462 0 None None None 2024-05-29 08:16:12 UTC

Description Sage McTaggart 2022-11-08 14:05:38 UTC
Description of problem:
Need Spectre-BHB mitigation added for new HW: Cortex: A57, A72, A76, A77, A78, A78AE, A78C, A710, X1, X2; Neoverse: N1, N2, V1; Ampere1.

https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=0e5d5ae837c8

Per AmpereOne erratum AC03_CPU_12, "Branch history may allow control of
speculative execution across software contexts," the AMPERE1 core needs the
bhb clearing loop to mitigate Spectre-BHB, with a loop iteration count of
11."
And for the other listed hardware the fix is the same like for the AMPERE1 core.

For more information, read previous CVE-2022-23960 that is about Spectre-BHB too.

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=0e5d5ae837c8

Comment 9 Alex 2023-05-31 08:31:51 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2211357]

Comment 12 Justin M. Forbes 2023-06-05 12:24:36 UTC
This was fixed for Fedora with the 6.0.7 stable kernel updates.

Comment 15 errata-xmlrpc 2024-05-29 08:16:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:3462 https://access.redhat.com/errata/RHSA-2024:3462


Note You need to log in before you can comment on or make changes to this bug.