Re: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Tyler Hicks &lt;tyhicks () canonical com&gt;

Date: Tue, 10 Dec 2019 12:09:22 -0600

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On 2019-12-10 17:10:40, P J P wrote:
  Hello,

Hello!

Transaction Asynchronous Abort (TAA) h/w issue, which affects Intel CPUs, is
mitigated in two ways. One is by disabling Transactional Synchronisation
Extensions (TSX) feature of the CPU. And second is by clearing the affected
Store/Fill/Load port architectural buffers, which may hold sensitive
information bits.

It was found that the current kernel fixes don't completely fix TAA issue
for guest VMs. When a guest is running on a host CPU affected by TAA (ie.
TAA_NO=0) but not affected by MDS issue (ie MDS_NO=1), to mitigate TAA
issue, guest was to clear the affected buffers by using VERW instruction
mechanism. But when MDS_NO=1 bit was exported to the guests, it did not
quite use the VERW mechanism to clear the affected buffers.

This issue affects guests running on Cascade Lake CPUs, which are affected
by the TAA (ie. TAA_NO=0) issue, but are not affected by the MDS (ie.
MDS_NO=1) issue.

It requires that host has 'TSX' enabled.

Upstream patches:
-----------------
  -&gt; https://git.kernel.org/linus/cbbaa2727aa3ae9e0a844803da7cef7fd3b94f2b
  -&gt; https://git.kernel.org/linus/c11f83e0626bdc2b6c550fc8b9b6eeefbd8cefaa
  -&gt; https://git.kernel.org/linus/b07a5c53d42a8c87b208614129e947dd2338ff9c

Another option: Export MDS_NO=0 to guests when TSX is enabled
  -&gt; https://git.kernel.org/linus/e1d38b63acd843cfdd4222bf19a26700fd5c699e

If this commit, which was part of the initial set of mitigation patches
for TAA, is a valid option then I'm not understanding how there was an
incomplete fix.

Is the CVE assignment specifically for a distro kernel that didn't
include commit e1d38b63acd8 ("kvm/x86: Export MDS_NO=0 to guests when
TSX is enabled")?

Tyler

'CVE-2019-19338' is assigned by Red Hat Inc.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) P J P (Dec 10)

Re: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) Tyler Hicks (Dec 10)

Re: CVE-2019-19338 Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) P J P (Dec 10)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->