From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966135AbbDWPLA (ORCPT ); Thu, 23 Apr 2015 11:11:00 -0400 Received: from mail.skyhub.de ([78.46.96.112]:50243 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965475AbbDWPK6 (ORCPT ); Thu, 23 Apr 2015 11:10:58 -0400 Date: Thu, 23 Apr 2015 17:10:47 +0200 From: Borislav Petkov To: Andy Lutomirski Cc: Denys Vlasenko , Ingo Molnar , Linus Torvalds , Steven Rostedt , "H. Peter Anvin" , Oleg Nesterov , Frederic Weisbecker , Alexei Starovoitov , Will Drewry , Kees Cook , X86 ML , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] x86/asm/entry/64: better check for canonical address Message-ID: <20150423151047.GJ28327@pd.tnic> References: <1429633649-20169-1-git-send-email-dvlasenk@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 21, 2015 at 11:08:42AM -0700, Andy Lutomirski wrote: > I'll take a full implementation of what Intel says over probably > unmeasurable performance. If anyone in the AMD camp really cared, we > could add X86_BUG_SYSRET_NEEDS_CANONICAL_RCX and use alternatives to > patch this out on AMD. I doubt this would buy us much. Err, why do we care if RCX is canonical when executing SYSRET? The RIP canonicalness test is being done anyway and we read RIP from RCX. What am I missing? Oh, and then there's this: http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html and more specifically: "AMD have issued the following statement: AMD processors' SYSRET behavior is such that a non-canonical address in RCX does not generate a #GP while in CPL0. We have verified this with our architecture team, with our design team, and have performed tests that verified this on silicon. Therefore, this privilege escalation exposure is not applicable to any AMD processor. " oh, and look at one of the xen fixes, hahaha! (at the end). Intel faults in ring0 due to non-canonical RCX but with user RSP. Lovely. --- x86_64: Do not execute sysret with a non-canonical return address Check for non-canonical guest RIP before attempting to execute sysret. If sysret is executed with a non-canonical value in RCX, Intel CPUs take the fault in ring0, but we will necessarily already have switched to the the user's stack pointer. This is a security vulnerability, XSA-7 / CVE-2012-0217. Signed-off-by: Jan Beulich Signed-off-by: Ian Campbell Signed-off-by: Ian Jackson Tested-by: Ian Campbell Acked-by: Keir Fraser Committed-by: Ian Jackson diff -r 340062faf298 -r ad87903fdca1 xen/arch/x86/x86_64/entry.S --- a/xen/arch/x86/x86_64/entry.S Wed May 23 11:06:49 2012 +0100 +++ b/xen/arch/x86/x86_64/entry.S Thu May 24 11:02:35 2012 +0100 @@ -40,6 +40,13 @@ restore_all_guest: testw $TRAP_syscall,4(%rsp) jz iret_exit_to_guest + /* Don't use SYSRET path if the return address is not canonical. */ + movq 8(%rsp),%rcx + sarq $47,%rcx + incl %ecx + cmpl $1,%ecx + ja .Lforce_iret + addq $8,%rsp popq %rcx # RIP popq %r11 # CS @@ -50,6 +57,10 @@ restore_all_guest: sysretq 1: sysretl +.Lforce_iret: + /* Mimic SYSRET behavior. */ + movq 8(%rsp),%rcx # RIP + movq 24(%rsp),%r11 # RFLAGS ALIGN /* No special register assumptions. */ iret_exit_to_guest: --- Thanks. -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. --