|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Xen Security Advisory 471 v1 (CVE-2024-36350,CVE-2024-36357) - x86: Transitive Scheduler Attacks
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory CVE-2024-36350,CVE-2024-36357 / XSA-471
x86: Transitive Scheduler Attacks
ISSUE DESCRIPTION
=================
Researchers from Microsoft and ETH Zurich have discovered several new
speculative sidechannel attacks which bypass current protections. They
are detailed in a paper titled "Enter, Exit, Page Fault, Leak: Testing
Isolation Boundaries for Microarchitectural Leaks".
Two issues, which AMD have named Transitive Scheduler Attacks, utilise
timing information from instruction execution. These are:
* CVE-2024-36350: TSA-SQ (TSA in the Store Queues)
* CVE-2024-36357: TSA-L1 (TSA in the L1 data cache)
For more information, see:
https://www.amd.com/content/dam/amd/en/documents/resources/bulletin/technical-guidance-for-mitigating-transient-scheduler-attacks.pdf
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
https://aka.ms/enter-exit-leak
The paper also details other speculative attacks. See below.
IMPACT
======
An attacker might be able to infer data belonging to other contexts,
including data belonging to other guests.
VULNERABLE SYSTEMS
==================
Systems running all versions of Xen are affected.
Only AMD Fam19h CPUs (Zen3/4 microarchitectures) are believed to be
vulnerable. Other AMD CPUs, and CPUs from other manufacturers are not
known to be affected.
MITIGATION
==========
There are no mitigations.
RESOLUTION
==========
AMD are producing microcode to address TSA, which adds scrubbing side
effects to the VERW instruction. This was included in the firmware
fixes for the Entrysign signature vulnerability from ~December 2024, but
are also available in an OS-loadable form on older firmware. Consult
your dom0 OS vendor and/or hardware vendor for updated microcode.
In addition to the microcode, changes are requires to Xen to make use of
VERW scrubbing at suitable points.
Applying the appropriate set of attached patches resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa471/xsa471-??.patch xen-unstable
xsa471/xsa471-4.20-??.patch Xen 4.20.x
xsa471/xsa471-4.19-??.patch Xen 4.19.x
xsa471/xsa471-4.18-??.patch Xen 4.18.x
xsa471/xsa471-4.17-??.patch Xen 4.17.x
$ sha256sum xsa471*/*
4cc8b54d3cae4864053c4d608061675564cc322c6cd362e33ac59ac4c9371358
xsa471/xsa471-01.patch
9bdfd0ad8d34114e69bb0e264ffdcb176e54211753cc1eed247e73cd3fe752e9
xsa471/xsa471-02.patch
62706c1593cb64bfd053f5ee2e8fa26f5414835c6ef5f694c52a61e18017aa1d
xsa471/xsa471-03.patch
e06162c55de0b3ca79302ea47c8169079b0f2cd65a48d3e0509677452c9887da
xsa471/xsa471-4.17-01.patch
742c59d776c73993c44e72ceada2b83b61fa77a988f5c2c593b6594b4f4078de
xsa471/xsa471-4.17-02.patch
a8ed5e90e405273115d6a06199de3190319ba12aac33bea17495db42b6a9becc
xsa471/xsa471-4.17-03.patch
855c9528d93109a1a673dd8f4feb87a688457908c9dd821d0e1a3326efb19257
xsa471/xsa471-4.17-04.patch
f8dbe5c8dbdf921c7f9b4bc7d8234b9bb291df6a4a8cef604284bf4f36947d4e
xsa471/xsa471-4.17-05.patch
fa2682955663e0966cf285bf79770fe76b387fbf449e1ac64206a6ae4bf79bc4
xsa471/xsa471-4.17-06.patch
dc4695aced6ba65e8b16088aefe817e8e4d965cd94e9e3340bd48d77c1369902
xsa471/xsa471-4.17-07.patch
0393a8711805f40eeb936dcca56f5bea174ff94098ffaee7064cd6801eb55099
xsa471/xsa471-4.17-08.patch
346493cc12d9a0fa4154968bc0c8dca9d87e583a25ae9ecd22b8ae2c7bdeae19
xsa471/xsa471-4.17-09.patch
0d652e9a6bb89782036b39160f2db9c1fd1dfc0e659fb4e351f04eb66ffbdba8
xsa471/xsa471-4.17-10.patch
ff3ae74f6cfccfaee55f007b2410813068928d20a23729ae2766ddcc65d2e82b
xsa471/xsa471-4.17-11.patch
5c6d133f626fdcbc148b596bf3cee1c46260d73fd833aeb6c59cf7c1b315f2b8
xsa471/xsa471-4.17-12.patch
acbdca53d713122545ba210a795c4185e842d4cca71802775adc1a4ce971bf3a
xsa471/xsa471-4.17-13.patch
4a7fa23b7f501cb88100b55fab13b7315a01fc1e4a3eff46b5d0c867fcc03ca8
xsa471/xsa471-4.17-14.patch
164d626a2f446ad7692bd70ab7e109f8b6259aaea34bfb9f51df68def98a2e62
xsa471/xsa471-4.17-15.patch
35699b19590ccf1872c8da8731b4c47e95cc38d119510e182d196427ea4455f8
xsa471/xsa471-4.17-16.patch
296c95410b6dbf55fa092d15e0eee66125a87b012095f84c550eea54078d0490
xsa471/xsa471-4.17-17.patch
0212aec278afe0dcc6479b756a0c1821d2bfba646fa9ec56f1b9b37ff51756f4
xsa471/xsa471-4.17-18.patch
4e05073bc960b7f43dd383356d1b56fa9c55dc021205678bd8ac456f3a1d00f0
xsa471/xsa471-4.17-19.patch
0d4166420a9e69afe3303d6d3232ee43cf27e88e5bbd8a52a17521934455ed65
xsa471/xsa471-4.18-01.patch
3ff24a622a8ef97af7dddf480dd8c6c12efb8a2dc74ae8d68836543a6cdb8329
xsa471/xsa471-4.18-02.patch
fe69ab8c1d45e0d23f58126b22e9914d2269d416cd802619000dc3933c49129e
xsa471/xsa471-4.18-03.patch
60b563119ed38a052ed6e6a261b56db5e7b8b40befacd4904d5ce50b2d75d280
xsa471/xsa471-4.18-04.patch
864643c643cfe1f03d28bb36aadcd5bdd1dc7276c30357ea8be1cd1d20ef6f69
xsa471/xsa471-4.18-05.patch
9d5c58339aea8afbeea0bdf34c34cbeb4178ac0a475a32e688317b9810d0f148
xsa471/xsa471-4.18-06.patch
38347e4d096a880cc6d91f09d60277914ad6aa8a6b588913f211097574714ab0
xsa471/xsa471-4.18-07.patch
f0db078f811b5c06170f0016fec84a4bbd958b9f8a8d999567c5680d90141c2c
xsa471/xsa471-4.18-08.patch
6d2f9de12d113790bbc74327cf94ae08234bec95d88468767462d3a11d0c40d4
xsa471/xsa471-4.18-09.patch
04f63468fca093f8fb5716c0ecafd1ef0be14dd5a464cddc20e719e0c2979980
xsa471/xsa471-4.18-10.patch
5c6e030d1258ce703ddf27fb48ee7b33ca0dbb09657cb38fc7d5b432d215322e
xsa471/xsa471-4.18-11.patch
18b17089aa643ae2d6d9d394137a7fe21bf6b8f9743f2237481b68920f3f8f06
xsa471/xsa471-4.18-12.patch
d2c35d0a93e9a98fa04623c024a6e152f4d4d6568e6b603ee0cf7f4e4c9dca82
xsa471/xsa471-4.18-13.patch
f5b3f0aa8a59033bad4f221709eb4f6f14c82f75ab229ff53ef52b917d0f4021
xsa471/xsa471-4.18-14.patch
dc5c0da74f4a6faba0b2af5539cb38a44525379a2f9cafdff18f71cda5280d42
xsa471/xsa471-4.18-15.patch
296c95410b6dbf55fa092d15e0eee66125a87b012095f84c550eea54078d0490
xsa471/xsa471-4.18-16.patch
04c5587d19749a261ca9edc5212d606f2bf577e890c8f4474c55a9c5fe9605d7
xsa471/xsa471-4.18-17.patch
1b10f901d218bafc35d21366e57be89191c0b7c3bcc9def4da5c79bcf93a2e9d
xsa471/xsa471-4.18-18.patch
d8b010138f5a2773a07902617c65f5d419bae6445410251c9dc1a777b6bf3378
xsa471/xsa471-4.19-01.patch
d72ab177637179cccbd32d2dbedfbb399ff4ba59360391e898e3c5fc069803a9
xsa471/xsa471-4.19-02.patch
365ee7e6fb3da83e6238cd4f9138de2018fddb65c1604bbd968e73ce97451fe9
xsa471/xsa471-4.19-03.patch
690cbd2b4b5ce5a855e75cf44c098ca2e231a272d2ebdc1e68d267c5c4e50db0
xsa471/xsa471-4.19-04.patch
82ac6bbca376e33fe1e03569ed76f559f18066000aec6dc72f1722245f5e9a54
xsa471/xsa471-4.19-05.patch
06c475bbb74d86375c17e183bdf74e1ef145a49af2aa237ce69f6ca8e6f78a7c
xsa471/xsa471-4.19-06.patch
03bacbdb4cabb3e9eee079a847fa2eda3ff30c86bbfc5d5b1987ee028774a507
xsa471/xsa471-4.19-07.patch
b144cea707793e73d6dcbaa0e0ef268bb3cd389e12c080ec687a64a8a3e6ad61
xsa471/xsa471-4.19-08.patch
df35ded3dfe5ca84d459eda720699a35e3e49d4b4d461a3f834d05c30b0bcf59
xsa471/xsa471-4.19-09.patch
6719417c0ead056d83ef003cc3b08bf95a3430560fd8f27357c09ca55b6a3993
xsa471/xsa471-4.19-10.patch
b7c6ff2f529c6d6cc656b42142d06e5462e652ade57cc2ff5d90320af1234a27
xsa471/xsa471-4.19-11.patch
4b8a05edf04f5b43b1edcf44412ec4be734b011a7b8d2d739ffe0bdc04abce82
xsa471/xsa471-4.19-12.patch
e2bca0cd6f66465fdae9e3d251e67ba8a28a96a05201ac939a599dd95a0b3bc6
xsa471/xsa471-4.19-13.patch
8dc65ba84572a090d1bf8ffeb9b5871d9533e4da324fbcdfb1ab32ed83b10fad
xsa471/xsa471-4.19-14.patch
2cb102830a29c6c2a898f8f580a9d554c332d6c31dd1608af0fb22b7340f650b
xsa471/xsa471-4.19-15.patch
2a873ae56866b9986183e18ea9b70712a15f6df3af299b2d583cbda40a816f58
xsa471/xsa471-4.19-16.patch
77c7634a7d59056f92de619e034f31e63fd6ac6b26dc6e6af65e80fe3e4e5feb
xsa471/xsa471-4.20-01.patch
22db1def1859cc7c742b79fee78c994ac4c9cc63daa3663533f324e93e9ef9e0
xsa471/xsa471-4.20-02.patch
fb9a103c606552188c05c14092cce084b52b4df75659f4d8013aa30978708ee8
xsa471/xsa471-4.20-03.patch
6930b94a1997b118692a2e0bd5e32bba2e0269b66de4019e3e870304d695c315
xsa471/xsa471-4.20-04.patch
4a67ef27f84eced8fa9cf3ae42d9f79f74a16659ab004fd79a7ee09fce823cf6
xsa471/xsa471-4.20-05.patch
9c62b492be0f1961d5d8062b7d4ac95b9d120e44ca4bf7e009a499fad9c0fcc3
xsa471/xsa471-4.20-06.patch
511728ef65068fa8bda25c31e3fd578aebc8400597d117f31fd2ba436fbb3776
xsa471/xsa471-4.20-07.patch
9a66742ec752a9f58a02f170a4213a22d32bd487e49bfff799800851ba9650e1
xsa471/xsa471-4.20-08.patch
5a02afd655d29b7eba7ac24a8665d64db39994d84e5125a7511f3e5fb7cafacf
xsa471/xsa471-4.20-09.patch
f55ba571fa668a1ba9fb318c082e684780cc9b8d3c4e7f33db17bf7cc2afcdb3
xsa471/xsa471-4.20-10.patch
4cc8b54d3cae4864053c4d608061675564cc322c6cd362e33ac59ac4c9371358
xsa471/xsa471-4.20-11.patch
b180fec77659ce67d24c076301a3d10486afe0c1f224c30b5af7f22f678e8834
xsa471/xsa471-4.20-12.patch
60155cf04e25ad5c95f744dced34c530e0606150e1ca7617e38a9e3d8933eff3
xsa471/xsa471-4.20-13.patch
3d4eb5835d331581fd5c502ea77a0bf3f35c8e12ff9a95d38d32acfed735fefa
xsa471/xsa471-4.20-14.patch
bc8590f2187d52a727f2354fda9d006087eaae17c34899bec0257ed7e870e7b6
xsa471/xsa471-4.20-15.patch
91c9100a964b0ecaae5ed019e2c846ea0a8a1e5d734e01853be737bb1799d5dd
xsa471/xsa471-04.patch
5fce1dfbf084ccabbba9fcb7a8f758cffc1c8ca93a4f1d2a1c6ad49b4fe9e5da
xsa471/xsa471-05.patch
$
NOTE CONCERNING OTHER SPECULATIVE ATTACKS
=========================================
The paper describes two further attack:
* CVE-2024-36348: Rogue execution of SMSW
* CVE-2045-36349: Rogue read of MSR_TSC_AUX
which are both examples of Rogue System Register Read (sometimes called
Spectre-v3a). No fix is planned, because these registers do not
typically contain sensitive information.
-----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmhtJggMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZq+0H/0DAl85Esb0oZTu2VugMbZjxbaROEghLa+CaJPeK
5IJEn3E+gHPil9P88nktO8P3SipbXHYzuZeCKzg3FFPZskv+x294zdLCgndPcB1Q
Qfx9wKX8IA+hrgfafUORCjQbAeq+ahxTCG6jwrwaSOSuuU1aAM3RZL+haDlhJ8cH
Ib5pdfxZnX5BkJc/Fb/1qrwfW1nHSrvtWJkza79hAyi6d1GnhcSPA9QLfbl4KSSP
DBNHaWyAzKWQc3yjvekO+1h0XKnvcpGRMIa3jQOgemceXcRO2Vrp7gSB6BnG+CNh
ZODnfZM+2zbbXDscdckujoD/0vywEPhEq4RUv2BaDYKna3I=
=lnmx
-----END PGP SIGNATURE-----
Attachment:
xsa471/xsa471-01.patch Attachment:
xsa471/xsa471-02.patch Attachment:
xsa471/xsa471-03.patch Attachment:
xsa471/xsa471-4.17-01.patch Attachment:
xsa471/xsa471-4.17-02.patch Attachment:
xsa471/xsa471-4.17-03.patch Attachment:
xsa471/xsa471-4.17-04.patch Attachment:
xsa471/xsa471-4.17-05.patch Attachment:
xsa471/xsa471-4.17-06.patch Attachment:
xsa471/xsa471-4.17-07.patch Attachment:
xsa471/xsa471-4.17-08.patch Attachment:
xsa471/xsa471-4.17-09.patch Attachment:
xsa471/xsa471-4.17-10.patch Attachment:
xsa471/xsa471-4.17-11.patch Attachment:
xsa471/xsa471-4.17-12.patch Attachment:
xsa471/xsa471-4.17-13.patch Attachment:
xsa471/xsa471-4.17-14.patch Attachment:
xsa471/xsa471-4.17-15.patch Attachment:
xsa471/xsa471-4.17-16.patch Attachment:
xsa471/xsa471-4.17-17.patch Attachment:
xsa471/xsa471-4.17-18.patch Attachment:
xsa471/xsa471-4.17-19.patch Attachment:
xsa471/xsa471-4.18-01.patch Attachment:
xsa471/xsa471-4.18-02.patch Attachment:
xsa471/xsa471-4.18-03.patch Attachment:
xsa471/xsa471-4.18-04.patch Attachment:
xsa471/xsa471-4.18-05.patch Attachment:
xsa471/xsa471-4.18-06.patch Attachment:
xsa471/xsa471-4.18-07.patch Attachment:
xsa471/xsa471-4.18-08.patch Attachment:
xsa471/xsa471-4.18-09.patch Attachment:
xsa471/xsa471-4.18-10.patch Attachment:
xsa471/xsa471-4.18-11.patch Attachment:
xsa471/xsa471-4.18-12.patch Attachment:
xsa471/xsa471-4.18-13.patch Attachment:
xsa471/xsa471-4.18-14.patch Attachment:
xsa471/xsa471-4.18-15.patch Attachment:
xsa471/xsa471-4.18-16.patch Attachment:
xsa471/xsa471-4.18-17.patch Attachment:
xsa471/xsa471-4.18-18.patch Attachment:
xsa471/xsa471-4.19-01.patch Attachment:
xsa471/xsa471-4.19-02.patch Attachment:
xsa471/xsa471-4.19-03.patch Attachment:
xsa471/xsa471-4.19-04.patch Attachment:
xsa471/xsa471-4.19-05.patch Attachment:
xsa471/xsa471-4.19-06.patch Attachment:
xsa471/xsa471-4.19-07.patch Attachment:
xsa471/xsa471-4.19-08.patch Attachment:
xsa471/xsa471-4.19-09.patch Attachment:
xsa471/xsa471-4.19-10.patch Attachment:
xsa471/xsa471-4.19-11.patch Attachment:
xsa471/xsa471-4.19-12.patch Attachment:
xsa471/xsa471-4.19-13.patch Attachment:
xsa471/xsa471-4.19-14.patch Attachment:
xsa471/xsa471-4.19-15.patch Attachment:
xsa471/xsa471-4.19-16.patch Attachment:
xsa471/xsa471-4.20-01.patch Attachment:
xsa471/xsa471-4.20-02.patch Attachment:
xsa471/xsa471-4.20-03.patch Attachment:
xsa471/xsa471-4.20-04.patch Attachment:
xsa471/xsa471-4.20-05.patch Attachment:
xsa471/xsa471-4.20-06.patch Attachment:
xsa471/xsa471-4.20-07.patch Attachment:
xsa471/xsa471-4.20-08.patch Attachment:
xsa471/xsa471-4.20-09.patch Attachment:
xsa471/xsa471-4.20-10.patch Attachment:
xsa471/xsa471-4.20-11.patch Attachment:
xsa471/xsa471-4.20-12.patch Attachment:
xsa471/xsa471-4.20-13.patch Attachment:
xsa471/xsa471-4.20-14.patch Attachment:
xsa471/xsa471-4.20-15.patch Attachment:
xsa471/xsa471-04.patch Attachment:
xsa471/xsa471-05.patch |
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |