Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed

[Demi Marie Obenour <demi () invisiblethingslab com>]

On Tue, Aug 08, 2023 at 08:00:09PM +0200, Solar Designer wrote:
> On Mon, Jul 31, 2023 at 05:00:35PM +0000, Xen. org security team wrote:
> > The patch provided with earlier versions was buggy.  It unintentionally
> > disable more bits than expected in the control register.  The contents of this
> > register is not generally known, so the effects on the system are unknown.
> >
> > A patch correcting this error has been committed and backported to all stable
> > trees which got the XSA-433 fix originally.  Additionally, it is attached to
> > this advisory as xsa433-bugfix.patch, and applicable to all branches in this
> > form.
>
> where xsa433-bugfix.patch includes this description:
>
> > This line:
> >
> >     val &= ~chickenbit;
> >
> > ends up truncating val to 32 bits, and turning off various errata workarounds
> > in Zen2 systems.
>
> and that patch then corrects the truncation by changing the type of the
> chickenbit variable to 64-bit.  The context is:
>
> +     /*
> +      * Microcode is the preferred mitigation, in terms of performance.
> +      * However, without microcode, this chickenbit (specific to the Zen2
> +      * uarch) disables Floating Point Mov-Elimination to mitigate the
> +      * issue.
> +      */
> +     val &= ~chickenbit;
> +     if (sig->rev < good_rev)
> +             val |= chickenbit;
>
> This leaves me wondering: why have this line at all?  I understand Xen
> wanting to enable the chicken bit on vulnerable CPUs, but why disable it
> on other AMD CPUs?  If someone or something had enabled the bit, that's
> probably intentional, and even if not it probably shouldn't be Xen's
> business to alter CPU behavior beyond what's necessary for Xen itself to
> work reliably and securely.
>
> Am I missing something?
>
> Alexander

The microcode is effective when late-loaded, and this code might run
after a microcode update and/or kexec.  Not sure if this is the actual
explanation.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

Attachment: signature.asc
Description: