oss-sec mailing list archives
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak
From: Solar Designer <solar () openwall com>
Date: Wed, 4 Oct 2023 16:05:26 +0200
On Wed, Oct 04, 2023 at 02:10:59AM +0100, Andrew Cooper wrote:
On 03/10/2023 9:58 pm, Solar Designer wrote:However, this may be another reason to actually look into whether the remainder also leaked, and whether the byte-sized form prevents that leak despite of it not touching the architectural register where the remainder would be stored by a preceding larger DIV. I expect that we're fine here - it's the divider unit's internal register and not the architectural register that should matter - but worth making sure. It could also theoretically be e.g. some buffer registers in the middle, where the byte-sized form wouldn't overwrite the full contents.I've spent a while trying to reason about this... I'm not sure I'm any the wiser, but here goes.
Thank you! This is helpful, but unfortunately doesn't appear (or at least not to me) to address the case of the remainder in its own register being overwritten or not by a smaller DIV that doesn't produce it in that register. Of course, under the hood it's at least a rename register rather than the RDX that programs see, and it's supposedly getting a value copied from a DIV unit's internal register. So the question is probably about the latter register being overwritten or not. The USENIX Security paper you referenced includes this:
The source code, experiments, and executable leakage models are available at https://github.com/microsoft/sca-fuzzer
I think ideally one of us should come up with a single-process reproducer (using code from that repo or otherwise), see if it "leaks" the remainder, introduce a byte-sized DIV "mitigation" in it, and see if that mitigation fully works or maybe not. Alternatively, maybe the paper authors (CC'ed) have comments on this? Alexander
Current thread:
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Solar Designer (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Andrew Cooper (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Jeremy Stanley (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Jean Luc Picard (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Solar Designer (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Jean Luc Picard (Oct 04)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Solar Designer (Oct 04)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Jeremy Stanley (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Andrew Cooper (Oct 03)
- <Possible follow-ups>
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Solar Designer (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Andrew Cooper (Oct 03)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Solar Designer (Oct 04)
- Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak Andrew Cooper (Oct 03)