[Qemu-devel] Virtio-net drivers immune to Nethammer?

[Qemu-devel] Virtio-net drivers immune to Nethammer?

[procmem]

Hi I'm a privacy distro maintainer investigating the implications of the
newly published nethammer attack [0] on KVM guests particularly the
virtio-net drivers. The summary of the paper is that rowhammer can be
remotely triggered by feeding susceptible* network driver crafted
traffic. This attack can do all kinds of nasty things such as modifying
SSL certs on the victim system.

* Susceptible drivers are those relying on Intel CAT, uncached memory or
the clflush instruction.

My question is, do virtio-net drivers do any of these things?

***

[0] https://arxiv.org/abs/1805.04956

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 770 bytes --]

On Mon, May 21, 2018 at 11:24:43PM +0000, procmem wrote:
> Hi I'm a privacy distro maintainer investigating the implications of the
> newly published nethammer attack [0] on KVM guests particularly the
> virtio-net drivers. The summary of the paper is that rowhammer can be
> remotely triggered by feeding susceptible* network driver crafted
> traffic. This attack can do all kinds of nasty things such as modifying
> SSL certs on the victim system.
> 
> * Susceptible drivers are those relying on Intel CAT, uncached memory or
> the clflush instruction.
> 
> My question is, do virtio-net drivers do any of these things?

I have CCed Michael Tsirkin and Jason Wang, the virtio maintainers.

> ***
> 
> [0] https://arxiv.org/abs/1805.04956
> 
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[procmem]

Stefan Hajnoczi:
> On Mon, May 21, 2018 at 11:24:43PM +0000, procmem wrote:
>> Hi I'm a privacy distro maintainer investigating the implications of the
>> newly published nethammer attack [0] on KVM guests particularly the
>> virtio-net drivers. The summary of the paper is that rowhammer can be
>> remotely triggered by feeding susceptible* network driver crafted
>> traffic. This attack can do all kinds of nasty things such as modifying
>> SSL certs on the victim system.
>>
>> * Susceptible drivers are those relying on Intel CAT, uncached memory or
>> the clflush instruction.
>>
>> My question is, do virtio-net drivers do any of these things?
> I have CCed Michael Tsirkin and Jason Wang, the virtio maintainers.
> 
>> ***
>>
>> [0] https://arxiv.org/abs/1805.04956
>>
>>
>>

Thanks :) I thought my message was forgotten

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[Michael S. Tsirkin]

On Fri, Jun 01, 2018 at 01:15:44PM +0000, procmem wrote:
> 
> 
> Stefan Hajnoczi:
> > On Mon, May 21, 2018 at 11:24:43PM +0000, procmem wrote:
> >> Hi I'm a privacy distro maintainer investigating the implications of the
> >> newly published nethammer attack [0] on KVM guests particularly the
> >> virtio-net drivers. The summary of the paper is that rowhammer can be
> >> remotely triggered by feeding susceptible* network driver crafted
> >> traffic. This attack can do all kinds of nasty things such as modifying
> >> SSL certs on the victim system.
> >>
> >> * Susceptible drivers are those relying on Intel CAT, uncached memory or
> >> the clflush instruction.
> >>
> >> My question is, do virtio-net drivers do any of these things?
> > I have CCed Michael Tsirkin and Jason Wang, the virtio maintainers.
> > 
> >> ***
> >>
> >> [0] https://arxiv.org/abs/1805.04956
> >>
> >>
> >>
> 
> Thanks :) I thought my message was forgotten


I don't think virtio is using either of these.

Linux does support CAT AFAIK but it has nothing to do with virtio.

-- 
MST

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[Dr. David Alan Gilbert]

* Michael S. Tsirkin (mst@redhat.com) wrote:
> On Fri, Jun 01, 2018 at 01:15:44PM +0000, procmem wrote:
> > 
> > 
> > Stefan Hajnoczi:
> > > On Mon, May 21, 2018 at 11:24:43PM +0000, procmem wrote:
> > >> Hi I'm a privacy distro maintainer investigating the implications of the
> > >> newly published nethammer attack [0] on KVM guests particularly the
> > >> virtio-net drivers. The summary of the paper is that rowhammer can be
> > >> remotely triggered by feeding susceptible* network driver crafted
> > >> traffic. This attack can do all kinds of nasty things such as modifying
> > >> SSL certs on the victim system.
> > >>
> > >> * Susceptible drivers are those relying on Intel CAT, uncached memory or
> > >> the clflush instruction.
> > >>
> > >> My question is, do virtio-net drivers do any of these things?
> > > I have CCed Michael Tsirkin and Jason Wang, the virtio maintainers.
> > > 
> > >> ***
> > >>
> > >> [0] https://arxiv.org/abs/1805.04956
> > >>
> > >>
> > >>
> > 
> > Thanks :) I thought my message was forgotten
> 
> 
> I don't think virtio is using either of these.
> 
> Linux does support CAT AFAIK but it has nothing to do with virtio.

Isn't the idea to misuse CAT to detect something about access patterns;
so it's not about it actually being related?

Dave

> -- 
> MST
> 
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[procmem]

Dr. David Alan Gilbert:
> Isn't the idea to misuse CAT to detect something about access patterns;
> so it's not about it actually being related?

AFAICT, CAT is directly responsible since the way it interacts with the
cache allows it to introduce predictable bit flips that can wreak all
kinds of havoc.

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[procmem]

Michael S. Tsirkin:
> On Fri, Jun 01, 2018 at 01:15:44PM +0000, procmem wrote:
>>
>>
>> Stefan Hajnoczi:
>>> On Mon, May 21, 2018 at 11:24:43PM +0000, procmem wrote:
>>>> Hi I'm a privacy distro maintainer investigating the implications of the
>>>> newly published nethammer attack [0] on KVM guests particularly the
>>>> virtio-net drivers. The summary of the paper is that rowhammer can be
>>>> remotely triggered by feeding susceptible* network driver crafted
>>>> traffic. This attack can do all kinds of nasty things such as modifying
>>>> SSL certs on the victim system.
>>>>
>>>> * Susceptible drivers are those relying on Intel CAT, uncached memory or
>>>> the clflush instruction.
>>>>
>>>> My question is, do virtio-net drivers do any of these things?
>>> I have CCed Michael Tsirkin and Jason Wang, the virtio maintainers.
>>>
>>>> ***
>>>>
>>>> [0] https://arxiv.org/abs/1805.04956
>>>>
>>>>
>>>>
>>
>> Thanks :) I thought my message was forgotten
> 
> 
> I don't think virtio is using either of these.
> 
> Linux does support CAT AFAIK but it has nothing to do with virtio.
> 

Thanks for confirming. This is good news indeed. I am considering
posting about this to kernel-hardening so it's on the sec team's radar
when considering upstream network drivers. What do you think?

Re: [Qemu-devel] Virtio-net drivers immune to Nethammer?

[Michael S. Tsirkin]

On Sat, Jun 02, 2018 at 03:08:54AM +0000, procmem wrote:
> 
> 
> Michael S. Tsirkin:
> > On Fri, Jun 01, 2018 at 01:15:44PM +0000, procmem wrote:
> >>
> >>
> >> Stefan Hajnoczi:
> >>> On Mon, May 21, 2018 at 11:24:43PM +0000, procmem wrote:
> >>>> Hi I'm a privacy distro maintainer investigating the implications of the
> >>>> newly published nethammer attack [0] on KVM guests particularly the
> >>>> virtio-net drivers. The summary of the paper is that rowhammer can be
> >>>> remotely triggered by feeding susceptible* network driver crafted
> >>>> traffic. This attack can do all kinds of nasty things such as modifying
> >>>> SSL certs on the victim system.
> >>>>
> >>>> * Susceptible drivers are those relying on Intel CAT, uncached memory or
> >>>> the clflush instruction.
> >>>>
> >>>> My question is, do virtio-net drivers do any of these things?
> >>> I have CCed Michael Tsirkin and Jason Wang, the virtio maintainers.
> >>>
> >>>> ***
> >>>>
> >>>> [0] https://arxiv.org/abs/1805.04956
> >>>>
> >>>>
> >>>>
> >>
> >> Thanks :) I thought my message was forgotten
> > 
> > 
> > I don't think virtio is using either of these.
> > 
> > Linux does support CAT AFAIK but it has nothing to do with virtio.
> > 
> 
> Thanks for confirming. This is good news indeed. I am considering
> posting about this to kernel-hardening so it's on the sec team's radar
> when considering upstream network drivers. What do you think?

It's up to you but the usefulness of reposting like that will be limited IMHO,
unless you have something specific to add.

I think everyone saw the nethammer paper by now, and kernel hardening
team doesn't review network driver patches.

-- 
MST