[MODERATED] Re: LVI

On Tue, Nov 19, 2019 at 03:00:07PM -0600, speck for Josh Poimboeuf wrote:
> On Tue, Nov 19, 2019 at 06:39:34PM +0000, speck for Andrew Cooper wrote:
> > On 19/11/2019 18:27, speck for Josh Poimboeuf wrote:
> > >>> To protect the kernel, we'd presumably need to look for places where
> > >>> users can trigger a faulting/assisting load.  For example,
> > >>> copy_from_user().
> > >>>
> > >>> copy_from_user() has an LFENCE between the access_ok() check and the
> > >>> actual copy to protect against Spectre v1.  What if we move that LFENCE
> > >>> to *after* the copy?  I think that would protect against both Spectre v1
> > >>> and LVI.
> > >>>
> > >>> Thoughts?
> > >> The lfence before protects from speculating into copy_from_user() with a
> > >> bad pointer.  This protection is still necessary.
> > > What's the harm of speculating the copy with a bad pointer if we can
> > > confirm there are no gadgets between the copy and the LFENCE?
> > 
> > Because the other hyperthread can read the data directly out of the
> > cache using L1TF/MDS/other as applicable.
> > 
> > True - this is applicable to any speculative OoB read on the first
> > thread so isn't unique to copy_from_user(), but copy_from_user() is very
> > easy for an attacker to control.
> 
> Ok, I guess had just assumed we didn't care about SMT at this point, we
> should at least try to do a best effort there.
> 
> Does this match your thinking?
> 
> if (SMT && (BUG_L1TF || BUG_MDS || BUG_TAA))
> 	lfence();
> 	
> ... do the copy ...
> 
> if (BUG_LVI)
> 	lfence();

Or, taking SMAP and Spectre v1 into account...

if (!SMAP && SMT && (BUG_L1TF || BUG_MDS || BUG_TAA))
 	lfence();
 	
... do the copy ...
 
if (!SMAP && (BUG_SPECTRE_V1 || BUG_LVI))
	lfence();


-- 
Josh