[MODERATED] Re: [PATCH v3 06/10] [PATCH v3 6/9] Linux Patch #6

[Borislav Petkov <bp@suse.de>]

On Mon, Apr 23, 2018 at 01:11:30PM -0400, speck for konrad.wilk_at_oracle.com wrote:
> x86/spec_store_bypass_disable: Provide boot parameters for the mitigation
> 
> Contemporary high performance processors use a common industry-wide
> optimization known as "Speculative Store Bypass" in which loads from
> addresses to which a recent store has occurred may (speculatively)
> see an older value. Intel refers to this feature as "Memory
> Disambiguation", which is part of their "Smart Memory Access"
> capability in Nehalem and later generation processors.
> 
> Some processors have an implementation bug that enables a cache
> side-channel attack against such speculatively read values. An
> attacker can create exploit code that allows them to read memory
> outside of a sandbox environment (for example, malicious JavaScript
> in a web page), or to perform more complex attacks against code
> running within the same privilege level, e.g. via the stack.
> 
> We provide two command line control knobs:
> 
>  nospec_store_bypass_disable
>  spec_store_bypass_disable=[off,auto,on]

Something's still fishy with this patch. I'm booting a guest with

spec_store_bypass_disable=on

but dmesg still says:

[    0.044001] Speculative Store Bypass: Vulnerable

and sysfs:

$ grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Vulnerable

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--