Xen Security Advisory 312 v1 - arm: a CPU may speculate past the ERET instruction
Xen.org security team <[email protected]>
| Newsgroups | gmane.comp.emulators.xen.announce |
|---|---|
| Message-ID | <E1irN46-0005Hs-GO__43812.5764647097$1579011880$gmane$org@xenbits.xenproject.org> |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory XSA-312
arm: a CPU may speculate past the ERET instruction
ISSUE DESCRIPTION
=================
Some CPUs can speculate past an ERET instruction and potentially perform
speculative accesses to memory before processing the exception return.
Since the register state is often controlled by lower privilege level
(i.e guest kernel/userspace) at the point of the ERET, this could
potentially be used as part of a side-channel attack.
IMPACT
======
An attacker, which could include a malicious untrusted user process on
a trusted guest, or an untrusted guest, may be able to use it as part of
side-channel attack to read host memory.
VULNERABLE SYSTEMS
==================
System running all version of Xen are affected.
Whether an individual Arm-based CPU is vulnerable depends on its
speculation properties. Consult your CPU vendor.
x86 systems are not vulnerable.
MITIGATION
==========
There is no mitigation available.
NOTE REGARDING LACK OF EMBARGO
==============================
This was reported publicly, as affecting other Open Source projects,
before the Xen Project Security Team was made aware.
RESOLUTION
==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa312.patch xen-unstable, Xen 4.13 - 4.12
xsa312-4.11.patch Xen 4.11 - 4.10
xsa312-4.9.patch Xen 4.9
$ sha256sum xsa312*
112c9d77f964174db5709c758626a2bd5fec9bfdacc89fbc96f1ddd44aca6bbf xsa312.meta
9b2078d448e4815c9ddc6554bf869d64412dc787b1b94830a24e47df6a9f30e7 xsa312.patch
29b95d6ea0295e124c3cfd5b1611ae341bb195d1c441ee69976e2f74cde652a8 xsa312-4.9.patch
8d64b3039c570f4b5c82abbbcf2714ec3b60db55fe3e1b3bb838df7dfaf627e9 xsa312-4.11.patch
$
-----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAl4dzjAMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZOx4H/2nt+377yBhbqNqUO2nCbqUWBkCB/OHQQ3uyjytp
PEDW9epevCJHOvQ3w24gh9SplWupHvrzS2PbqCWwEMPZXfkYB6Ye2kr7hbJHMOxB
bP6qm71plWG/RGmKSTVeVbOqAtiwdXkIvE8PIETGSuQ3Ip8exIkWvXnkY3v7KQne
WIg+vcadAqvv9oZj8UAv+V6oihUr1MyOMaddsW0QczF1yhs7EErpSBrLT1G2+nm/
MxY8nE40rAzZBs+G1puODC8uK/LSmGlvms+200FOPHnyyIKmznmAtGLE7pziPj7F
Qdy4GOWLAE1oQcrglmdk6SOCK7CRJSSZ0RminYNNPSX6EqM=
=FnmX
-----END PGP SIGNATURE-----
_______________________________________________
Xen-announce mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-announce
xsa312.meta
(application/octet-stream, 1.5 KB) - not displayed
xsa312.patch
(application/octet-stream, 2.7 KB)
From 9f807cf84a9a7a011cf1df7895c54d6031a7596d Mon Sep 17 00:00:00 2001 From: Julien Grall <[email protected]> Date: Thu, 19 Dec 2019 08:12:21 +0000 Subject: [PATCH] xen/arm: Place a speculation barrier sequence following an eret instruction Some CPUs can speculate past an ERET instruction and potentially perform speculative accesses to memory before processing the exception return. Since the register state is often controlled by lower privilege level at the point of an ERET, this could potentially be used as part of a side-channel attack. Newer CPUs may implement a new SB barrier instruction which acts as an architected speculation barrier. For current CPUs, the sequence DSB; ISB is known to prevent speculation. The latter sequence is heavier than SB but it would never be executed (this is speculation after all!). Introduce a new macro 'sb' that could be used when a speculation barrier is required. For now it is using dsb; isb but this could easily be updated to cater SB in the future. This is XSA-312. Signed-off-by: Julien Grall <[email protected]> --- xen/arch/arm/arm32/entry.S | 1 + xen/arch/arm/arm64/entry.S | 3 +++ xen/include/asm-arm/macros.h | 9 +++++++++ 3 files changed, 13 insertions(+) diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S index 31ccfb2631..b228d44b19 100644 --- a/xen/arch/arm/arm32/entry.S +++ b/xen/arch/arm/arm32/entry.S @@ -426,6 +426,7 @@ return_to_hypervisor: add sp, #(UREGS_SP_usr - UREGS_sp); /* SP, LR, SPSR, PC */ clrex eret + sb /* * struct vcpu *__context_switch(struct vcpu *prev, struct vcpu *next) diff --git a/xen/arch/arm/arm64/entry.S b/xen/arch/arm/arm64/entry.S index d35855af96..175ea2981e 100644 --- a/xen/arch/arm/arm64/entry.S +++ b/xen/arch/arm/arm64/entry.S @@ -354,6 +354,7 @@ guest_sync: */ mov x1, xzr eret + sb check_wa2: /* ARM_SMCCC_ARCH_WORKAROUND_2 handling */ @@ -393,6 +394,7 @@ wa2_end: #endif /* !CONFIG_ARM_SSBD */ mov x0, xzr eret + sb guest_sync_slowpath: /* * x0/x1 may have been scratch by the fast path above, so avoid @@ -457,6 +459,7 @@ return_from_trap: ldr lr, [sp], #(UREGS_SPSR_el1 - UREGS_LR) /* CPSR, PC, SP, LR */ eret + sb /* * Consume pending SError generated by the guest if any. diff --git a/xen/include/asm-arm/macros.h b/xen/include/asm-arm/macros.h index 91ea3505e4..4833671f4c 100644 --- a/xen/include/asm-arm/macros.h +++ b/xen/include/asm-arm/macros.h @@ -20,4 +20,13 @@ .endr .endm + /* + * Speculative barrier + * XXX: Add support for the 'sb' instruction + */ + .macro sb + dsb nsh + isb + .endm + #endif /* __ASM_ARM_MACROS_H */ -- 2.17.1
xsa312-4.9.patch
(application/octet-stream, 2.7 KB)
From 5f2a2ab4323f8a08518f6069b26360987885c4bd Mon Sep 17 00:00:00 2001 From: Julien Grall <[email protected]> Date: Thu, 19 Dec 2019 08:12:21 +0000 Subject: [PATCH] xen/arm: Place a speculation barrier sequence following an eret instruction Some CPUs can speculate past an ERET instruction and potentially perform speculative accesses to memory before processing the exception return. Since the register state is often controlled by lower privilege level at the point of an ERET, this could potentially be used as part of a side-channel attack. Newer CPUs may implement a new SB barrier instruction which acts as an architected speculation barrier. For current CPUs, the sequence DSB; ISB is known to prevent speculation. The latter sequence is heavier than SB but it would never be executed (this is speculation after all!). Introduce a new macro 'sb' that could be used when a speculation barrier is required. For now it is using dsb; isb but this could easily be updated to cater SB in the future. This is XSA-312. Signed-off-by: Julien Grall <[email protected]> --- xen/arch/arm/arm32/entry.S | 2 ++ xen/arch/arm/arm64/entry.S | 2 ++ xen/include/asm-arm/macros.h | 9 +++++++++ 3 files changed, 13 insertions(+) diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S index 16d9f93653..464c8b8645 100644 --- a/xen/arch/arm/arm32/entry.S +++ b/xen/arch/arm/arm32/entry.S @@ -1,4 +1,5 @@ #include <asm/asm_defns.h> +#include <asm/macros.h> #include <asm/regs.h> #include <asm/alternative.h> #include <public/xen.h> @@ -379,6 +380,7 @@ return_to_hypervisor: add sp, #(UREGS_SP_usr - UREGS_sp); /* SP, LR, SPSR, PC */ clrex eret + sb /* * struct vcpu *__context_switch(struct vcpu *prev, struct vcpu *next) diff --git a/xen/arch/arm/arm64/entry.S b/xen/arch/arm/arm64/entry.S index 8ebce1e9c9..86ada42655 100644 --- a/xen/arch/arm/arm64/entry.S +++ b/xen/arch/arm/arm64/entry.S @@ -1,6 +1,7 @@ #include <asm/asm_defns.h> #include <asm/regs.h> #include <asm/alternative.h> +#include <asm/macros.h> #include <public/xen.h> /* @@ -358,6 +359,7 @@ return_from_trap: ldr lr, [sp], #(UREGS_SPSR_el1 - UREGS_LR) /* CPSR, PC, SP, LR */ eret + sb /* * This function is used to check pending virtual SError in the gap of diff --git a/xen/include/asm-arm/macros.h b/xen/include/asm-arm/macros.h index 5d837cb38b..539f613ee5 100644 --- a/xen/include/asm-arm/macros.h +++ b/xen/include/asm-arm/macros.h @@ -13,4 +13,13 @@ # error "unknown ARM variant" #endif + /* + * Speculative barrier + * XXX: Add support for the 'sb' instruction + */ + .macro sb + dsb nsh + isb + .endm + #endif /* __ASM_ARM_MACROS_H */ -- 2.17.1
xsa312-4.11.patch
(application/octet-stream, 2.8 KB)
From 35cb81a9967a061df7d0eb8c387395f1c1984454 Mon Sep 17 00:00:00 2001 From: Julien Grall <[email protected]> Date: Thu, 19 Dec 2019 08:12:21 +0000 Subject: [PATCH] xen/arm: Place a speculation barrier sequence following an eret instruction Some CPUs can speculate past an ERET instruction and potentially perform speculative accesses to memory before processing the exception return. Since the register state is often controlled by lower privilege level at the point of an ERET, this could potentially be used as part of a side-channel attack. Newer CPUs may implement a new SB barrier instruction which acts as an architected speculation barrier. For current CPUs, the sequence DSB; ISB is known to prevent speculation. The latter sequence is heavier than SB but it would never be executed (this is speculation after all!). Introduce a new macro 'sb' that could be used when a speculation barrier is required. For now it is using dsb; isb but this could easily be updated to cater SB in the future. This is XSA-312. Signed-off-by: Julien Grall <[email protected]> --- xen/arch/arm/arm32/entry.S | 2 ++ xen/arch/arm/arm64/entry.S | 3 +++ xen/include/asm-arm/macros.h | 9 +++++++++ 3 files changed, 14 insertions(+) diff --git a/xen/arch/arm/arm32/entry.S b/xen/arch/arm/arm32/entry.S index 16d9f93653..464c8b8645 100644 --- a/xen/arch/arm/arm32/entry.S +++ b/xen/arch/arm/arm32/entry.S @@ -1,4 +1,5 @@ #include <asm/asm_defns.h> +#include <asm/macros.h> #include <asm/regs.h> #include <asm/alternative.h> #include <public/xen.h> @@ -379,6 +380,7 @@ return_to_hypervisor: add sp, #(UREGS_SP_usr - UREGS_sp); /* SP, LR, SPSR, PC */ clrex eret + sb /* * struct vcpu *__context_switch(struct vcpu *prev, struct vcpu *next) diff --git a/xen/arch/arm/arm64/entry.S b/xen/arch/arm/arm64/entry.S index 12df95e901..a42c51e489 100644 --- a/xen/arch/arm/arm64/entry.S +++ b/xen/arch/arm/arm64/entry.S @@ -2,6 +2,7 @@ #include <asm/regs.h> #include <asm/alternative.h> #include <asm/smccc.h> +#include <asm/macros.h> #include <public/xen.h> /* @@ -288,6 +289,7 @@ guest_sync: */ mov x1, xzr eret + sb 1: /* @@ -413,6 +415,7 @@ return_from_trap: ldr lr, [sp], #(UREGS_SPSR_el1 - UREGS_LR) /* CPSR, PC, SP, LR */ eret + sb /* * This function is used to check pending virtual SError in the gap of diff --git a/xen/include/asm-arm/macros.h b/xen/include/asm-arm/macros.h index 5d837cb38b..539f613ee5 100644 --- a/xen/include/asm-arm/macros.h +++ b/xen/include/asm-arm/macros.h @@ -13,4 +13,13 @@ # error "unknown ARM variant" #endif + /* + * Speculative barrier + * XXX: Add support for the 'sb' instruction + */ + .macro sb + dsb nsh + isb + .endm + #endif /* __ASM_ARM_MACROS_H */ -- 2.17.1