165 lines
6.2 KiB
Text
165 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-18:09.l1tf Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: L1 Terminal Fault (L1TF) Kernel Information Disclosure
|
|
|
|
Category: core
|
|
Module: Kernel
|
|
Announced: 2018-08-14
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2018-08-14 17:51:12 UTC (stable/11, 11.1-STABLE)
|
|
2018-08-15 02:30:11 UTC (releng/11.2, 11.2-RELEASE-p2)
|
|
2018-08-15 02:30:11 UTC (releng/11.1, 11.1-RELEASE-p13)
|
|
CVE Name: CVE-2018-3620, CVE-2018-3646
|
|
|
|
Special Note: Speculative execution vulnerability mitigation remains a work
|
|
in progress. This advisory addresses the issue in FreeBSD
|
|
11.1 and later. We expect to update this advisory to include
|
|
10.4 at a later time.
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
When a program accesses data in memory via a logical address it is translated
|
|
to a physical address in RAM by the CPU. Accessing an unmapped logical
|
|
address results in what is known as a terminal fault.
|
|
|
|
II. Problem Description
|
|
|
|
On certain Intel 64-bit x86 systems there is a period of time during terminal
|
|
fault handling where the CPU may use speculative execution to try to load
|
|
data. The CPU may speculatively access the level 1 data cache (L1D). Data
|
|
which would otherwise be protected may then be determined by using side
|
|
channel methods.
|
|
|
|
This issue affects bhyve on FreeBSD/amd64 systems.
|
|
|
|
III. Impact
|
|
|
|
An attacker executing user code, or kernel code inside of a virtual machine,
|
|
may be able to read secret data from the kernel or from another virtual
|
|
machine.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date,
|
|
and reboot.
|
|
|
|
Perform one of the following:
|
|
|
|
1) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
# shutdown -r +30 "Rebooting for security update"
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 11.2]
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.2.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.2.patch.asc
|
|
# gpg --verify l1tf-11.2.patch.asc
|
|
|
|
[FreeBSD 11.1]
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.1.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.1.patch.asc
|
|
# gpg --verify l1tf-11.1.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile your kernel as described in
|
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
|
system.
|
|
|
|
VI. Correction details
|
|
|
|
CVE-2018-3620 (L1 Terminal Fault-OS)
|
|
- ------------------------------------
|
|
FreeBSD reserves the the memory page at physical address 0, so it will not
|
|
contain secret data. FreeBSD zeros the paging data structures for unmapped
|
|
addresses, so that speculatively executed L1 Terminal Faults will access only
|
|
the reserved, unused page.
|
|
|
|
CVE-2018-3646 (L1 Terminal Fault-VMM)
|
|
- -------------------------------------
|
|
Patched systems flush the L1 data cache prior to guest entry, so that there
|
|
is no secret data in cache for a terminal fault (from the the guest) to
|
|
access.
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/11/ r337794
|
|
releng/11.1/ r337828
|
|
releng/11.2/ r337828
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
More information on L1 Terminal Fault is available at:
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3620>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3646>
|
|
|
|
<URL:https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault>
|
|
|
|
<URL:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html>
|
|
|
|
The FreeBSD Security Team thanks Intel for disclosing the issue.
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:09.l1tf.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.2.9 (FreeBSD)
|
|
|
|
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAltztc8ACgkQ05eS9J6n
|
|
5cLwEhAAos2Bnilthrbd+uQr1IGASD96aZZ5iXvn1Ibls03Vtd0kG9EcU30gFVG0
|
|
HSg47qT7r5qJQUdhuSYxspgS9ZxXpRez1vnAz7cSGHL9FdecyfHWmHvGor5tz84/
|
|
CgX4jCCAZfqDBquYD+ioqiLX7p1ZTRKfHBQOHcGgMfMq8UQUsg1YriXabEqnavU6
|
|
W0h/eCGBo/Dbvl7004Gx0hKmDO2YQxt9aPWfInXWx1VOMf+wNWpcrvU6rJ4kOnL9
|
|
7BXi+c5+vwlVXDvjrTwP9X+9DDa0MJcMoy2JCyCa/0W7lQ9nADLfUiXLsTvLDo6V
|
|
6/sooFbqlO+Qz37XHlXOXaoVGZGw+NtJRcnD+w8ueP9ts02SsECoxofN8tPOzGsT
|
|
T285qAwv8D8uuBLU3dc9y+assEe3j/4Aqb1Eil6Eh1MsHypEvyN5z9+PIpbN2tWK
|
|
qqCtzgqx037Jvjo6DwjwMUd+DikObGjZyK4pwP8KIeccOIBrUAA1Xel7Xr74xuwq
|
|
LwqtcHb2MWeFD0Mw+oW9viuJKrxyu6aiQfU6FsuGVmHjtXGxi+aWyGQqed+q8FcU
|
|
w/J6fq4kmBVVqNNrAMc/bWKU3IXAj4c48H0CSiCoX4dE4waRQ+cEetKkSWVGYnXj
|
|
3QdoyPsiqo8Goo34Cn0Ipf9GWDeNVv32iz0fXtr4LtoVZKCx9oc=
|
|
=G5SD
|
|
-----END PGP SIGNATURE-----
|