A Linux 6.2 kernel vulnerability (CVE-2023-1998) has been identified, which disables protection against Spectre v2 class attacks, allowing access to the memory of other processes running in different SMT or Hyper-Threading threads on the same physical CPU core. This vulnerability, among other things, could be exploited to facilitate data leakage between virtual machines in cloud systems. The issue affects only the Linux 6.2 kernel and is caused by improper implementation of optimizations aimed at reducing significant overhead when applying Spectre v2 protection. The vulnerability has been addressed in the experimental branch of the Linux 6.3 kernel.
In user space, to protect against Spectre class attacks, processes can selectively disable speculative execution of instructions using prctl PR_SET_SPECULATION_CTRL or utilize syscall filtering based on the seccomp mechanism. According to the researchers who uncovered the issue, the incorrect optimization in kernel 6.2 left at least one major cloud provider unprotected despite enabling the spectre-BTI attack blocking mode through prctl. virtuális gépek The vulnerability also manifests on regular systems szervereken with kernel 6.2, which utilize the configuration "spectre_v2=ibrs."
The essence of the vulnerability is that when selecting the IBRS or eIBRS protection modes, the applied optimizations disabled the use of the STIBP (Single Thread Indirect Branch Predictors) mechanism, which is necessary for blocking leaks when using simultaneous multithreading (SMT or Hyper-Threading). In this case, only the eIBRS mode provides protection against leakage between threads, not the IBRS mode, since under it, the IBRS bit, which protects against leakage between logical cores, is cleared upon returning control to user space for performance reasons, leaving threads in user space unprotected against Spectre v2 class attacks.
Forrás: opennet.ru
