Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak

[Solar Designer <solar () openwall com>]

On Wed, Oct 04, 2023 at 02:10:59AM +0100, Andrew Cooper wrote:
> On 03/10/2023 9:58 pm, Solar Designer wrote:
> > However, this may be another reason to actually look into whether the
> > remainder also leaked, and whether the byte-sized form prevents that
> > leak despite of it not touching the architectural register where the
> > remainder would be stored by a preceding larger DIV.  I expect that
> > we're fine here - it's the divider unit's internal register and not the
> > architectural register that should matter - but worth making sure.  It
> > could also theoretically be e.g. some buffer registers in the middle,
> > where the byte-sized form wouldn't overwrite the full contents.
>
> I've spent a while trying to reason about this...  I'm not sure I'm any
> the wiser, but here goes.

Thank you!  This is helpful, but unfortunately doesn't appear (or at
least not to me) to address the case of the remainder in its own
register being overwritten or not by a smaller DIV that doesn't produce
it in that register.  Of course, under the hood it's at least a rename
register rather than the RDX that programs see, and it's supposedly
getting a value copied from a DIV unit's internal register.  So the
question is probably about the latter register being overwritten or not.

The USENIX Security paper you referenced includes this:

> The source code, experiments, and executable leakage models are
> available at https://github.com/microsoft/sca-fuzzer

I think ideally one of us should come up with a single-process
reproducer (using code from that repo or otherwise), see if it "leaks"
the remainder, introduce a byte-sized DIV "mitigation" in it, and see if
that mitigation fully works or maybe not.

Alternatively, maybe the paper authors (CC'ed) have comments on this?

Alexander