Messages in this thread | | | Subject | Re: [RFC 09/10] x86/enter: Create macros to restrict/unrestrict Indirect Branch Speculation | From | David Woodhouse <> | Date | Fri, 26 Jan 2018 09:11:26 +0000 |
| |
On Thu, 2018-01-25 at 18:23 -0800, Dave Hansen wrote: > On 01/25/2018 06:11 PM, Liran Alon wrote: > > > > It is true that attacker cannot speculate to a kernel-address, but it > > doesn't mean it cannot use the leaked kernel-address together with > > another unrelated vulnerability to build a reliable exploit. > > The address doesn't leak if you can't execute there. It's the same > reason that we don't worry about speculation to user addresses from the > kernel when SMEP is in play.
If both tags and target in the BTB are only 31 bits, then surely a user-learned prediction of a branch from
0x01234567 → 0x07654321
would be equivalent to a kernel-mode branch from
0xffffffff81234567 → 0xffffffff87654321
... and interpreted in kernel mode as the latter? So I'm not sure why SMEP saves us there?
Likewise if the RSB only stores the low 31 bits of the target, SMEP isn't much help there either.
Do we need to look again at the fact that we've disabled the RSB- stuffing for SMEP?[unhandled content-type:application/x-pkcs7-signature] | |