bpf: Fix pointer-leak due to insufficient speculative store… (CVE-2023-53024)

Résumé

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to
insufficient speculative store bypass mitigation") inserts lfence
instructions after 1) initializing a stack slot and 2) spilling a
pointer to the stack.

However, this does not cover cases where a stack slot is first
initialized with a pointer (subject to sanitization) but then
overwritten with a scalar (not subject to sanitization because
the slot was already initialized). In this case, the second write
may be subject to speculative store bypass (SSB) creating a
speculative pointer-as-scalar type confusion. This allows the
program to subsequently leak the numerical pointer value using,
for example, a branch-based cache side channel.

To fix this, also sanitize scalars if they write a stack slot
that previously contained a pointer. Assuming that pointer-spills
are only generated by LLVM on register-pressure, the performance
impact on most real-world BPF programs should be small.

The following unprivileged BPF bytecode drafts a minimal exploit
and the mitigation:

[...]
// r6 = 0 or 1 (skalar, unknown user input)
// r7 = accessible ptr for side channel
// r10 = frame pointer (fp), to be leaked
//
r9 = r10 # fp alias to encourage ssb
*(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked
// lfence added here because of pointer spill to stack.
//
// Om…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.272"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.231"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.166"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.91"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.14.0"},{"fixed":"6.1.9"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-53024 linux Corrigé dans: 5.10.178-1
Ubuntu UBUNTU-CVE-2023-53024 linux-hwe-edge

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références