• Anthony Steinhauser's avatar
    x86/speculation: Prevent rogue cross-process SSBD shutdown · f3698875
    Anthony Steinhauser authored
    BugLink: https://bugs.launchpad.net/bugs/1884564
    
    commit dbbe2ad0 upstream.
    
    On context switch the change of TIF_SSBD and TIF_SPEC_IB are evaluated
    to adjust the mitigations accordingly. This is optimized to avoid the
    expensive MSR write if not needed.
    
    This optimization is buggy and allows an attacker to shutdown the SSBD
    protection of a victim process.
    
    The update logic reads the cached base value for the speculation control
    MSR which has neither the SSBD nor the STIBP bit set. It then OR's the
    SSBD bit only when TIF_SSBD is different and requests the MSR update.
    
    That means if TIF_SSBD of the previous and next task are the same, then
    the base value is not updated, even if TIF_SSBD is set. The MSR write is
    not requested.
    
    Subsequently if the TIF_STIBP bit differs then the STIBP bit is updated
    in the base value and the MSR is written with a wrong SSBD value.
    
    This was introduced when the per task/process conditional STIPB
    switching was added on top of the existing SSBD switching.
    
    It is exploitable if the attacker creates a process which enforces SSBD
    and has the contrary value of STIBP than the victim process (i.e. if the
    victim process enforces STIBP, the attacker process must not enforce it;
    if the victim process does not enforce STIBP, the attacker process must
    enforce it) and schedule it on the same core as the victim process. If
    the victim runs after the attacker the victim becomes vulnerable to
    Spectre V4.
    
    To fix this, update the MSR value independent of the TIF_SSBD difference
    and dependent on the SSBD mitigation method available. This ensures that
    a subsequent STIPB initiated MSR write has the correct state of SSBD.
    
    [ tglx: Handle X86_FEATURE_VIRT_SSBD & X86_FEATURE_VIRT_SSBD correctly
            and massaged changelog ]
    
    Fixes: 5bfbe3ad ("x86/speculation: Prepare for per task indirect branch speculation control")
    Signed-off-by: default avatarAnthony Steinhauser <asteinhauser@google.com>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: default avatarKamal Mostafa <kamal@canonical.com>
    Signed-off-by: default avatarKhalid Elmously <khalid.elmously@canonical.com>
    f3698875
process.c 18.5 KB