A vulnerability (CVE-2023-1998) has been identified in the Linux kernel 6.2, leading to a disablement of protection against Spectre v2 attacks, which allow access to the memory of other processes running in different SMT or Hyper-Threading threads but on the same physical CPU core. This vulnerability can, among other things, be used to facilitate data leakage between virtual machines in cloud systems. The issue affects only the Linux kernel 6.2, caused by incorrect implementation of optimizations aimed at reducing significant overhead when applying protection against Spectre v2. The vulnerability has been addressed in the experimental branch of the Linux kernel 6.3.
In user space, to protect against Spectre attacks, processes can selectively disable speculative execution of instructions using prctl PR_SET_SPECULATION_CTRL or utilize system call filtering based on the seccomp mechanism. According to the researchers who discovered the issue, the incorrect optimization in kernel 6.2 left at least one major cloud provider inadequately protected. virtual machines despite the activation of attack blocking mode spectre-BTI via prctl. The vulnerability also manifests in standard servers configurations with kernel 6.2, where the setting 'spectre_v2=ibrs' is used.
The essence of the vulnerability is that when choosing between the IBRS or eIBRS protection modes, the introduced optimizations disabled the use of the STIBP (Single Thread Indirect Branch Predictors) mechanism, which is necessary for blocking leaks when using simultaneous multithreading (SMT or Hyper-Threading). Here, only the eIBRS mode provides leak protection between threads, not the IBRS mode, because in the latter case, the IBRS bit, which ensures protection against leaks between logical cores, is cleared for performance reasons when control returns to user space, leaving user-space threads unprotected against Spectre v2 attacks.
Source: opennet.ru
