lkml.org 
[lkml]   [2018]   [Jan]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 00/18] prevent bounds-check bypass via speculative execution

* Alan Cox <gnomes@lxorguk.ukuu.org.uk> wrote:

> On Mon, 8 Jan 2018 11:08:36 +0100
> Peter Zijlstra <peterz@infradead.org> wrote:
>
> > On Fri, Jan 05, 2018 at 10:30:16PM -0800, Dan Williams wrote:
> > > On Fri, Jan 5, 2018 at 6:22 PM, Eric W. Biederman <ebiederm@xmission.com> wrote:
> > > > In at least one place (mpls) you are patching a fast path. Compile out
> > > > or don't load mpls by all means. But it is not acceptable to change the
> > > > fast path without even considering performance.
> > >
> > > Performance matters greatly, but I need help to identify a workload
> > > that is representative for this fast path to see what, if any, impact
> > > is incurred. Even better is a review that says "nope, 'index' is not
> > > subject to arbitrary userspace control at this point, drop the patch."
> >
> > I think we're focussing a little too much on pure userspace. That is, we
> > should be saying under the attackers control. Inbound network packets
> > could equally be under the attackers control.
>
> Inbound network packets don't come with a facility to read back and do
> cache timimg. [...]

But the reply packets can be measured on the sending side, and the total delay
timing would thus carry the timing information.

Yes, a lot of noise gets added that way if we think 'packet goes through the
Internet' - but with gigabit local network access or even through localhost
access a lot of noise can be removed as well.

It's not as dangerous as a near instantaneous local attack, but 'needs a day of
runtime to brute-force through localhost or 10GigE' is still worrying in many
real-world security contexts.

So I concur with Peter that we should generally consider making all of our
responses to external data (maybe with the exception of pigeon post messages)
Spectre-safe.

Thanks,

Ingo

\
 
 \ /
  Last update: 2018-01-14 23:18    [W:0.121 / U:4.784 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site