Is Qubes effected by the Intel kernel memory leaking bug?

[stephen...@gmail.com]

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-of-the-linux-page-table

It seems as if Linux countermeasures will involve a significant rewrite aka. FUCKWIT.

Is this perhaps why there is no final 4.0 release?

[awokd]

On Wed, January 3, 2018 11:55 am, stephen...@gmail.com wrote:
> https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
>
>
> http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious-case-o
> f-the-linux-page-table

>
> It seems as if Linux countermeasures will involve a significant rewrite
> aka. FUCKWIT.
>
> Is this perhaps why there is no final 4.0 release?

Believe PCI passthrough had been the major holdup for 4.0 release but I
could be wrong. I'm curious to see if Xen/Qubes is impacted as well. One
article says there was a rumor Xen was, another says there are comments in
the code that Xen PV/HVM is not. Embargo lifts on the 4th, so there should
be more facts then. Wouldn't want to engage in making speculative
assumptions (cough).

[rysiek]

Dnia Wednesday, January 3, 2018 1:27:38 PM CET 'awokd' via qubes-users pisze:

And here we are:
https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
https://googleprojectzero.blogspot.pt/2018/01/reading-privileged-memory-with-side.html
https://meltdownattack.com/meltdown.pdf
https://spectreattack.com/spectre.pdf

" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
During the course of our research, we developed the following proofs of
concept (PoCs):

A PoC that demonstrates the basic principles behind variant 1 in userspace
on the tested Intel Haswell Xeon CPU, the AMD FX CPU, the AMD PRO CPU and an
ARM Cortex A57 [2]. This PoC only tests for the ability to read data inside
mis-speculated execution within the same process, without crossing any
privilege boundaries.

A PoC for variant 1 that, when running with normal user privileges under a
modern Linux kernel with a distro-standard config, can perform arbitrary reads
in a 4GiB range [3] in kernel virtual memory on the Intel Haswell Xeon CPU. If
the kernel's BPF JIT is enabled (non-default configuration), it also works on
the AMD PRO CPU. On the Intel Haswell Xeon CPU, kernel virtual memory can be
read at a rate of around 2000 bytes per second after around 4 seconds of
startup time. [4]

A PoC for variant 2 that, when running with root privileges inside a KVM
guest created using virt-manager on the Intel Haswell Xeon CPU, with a
specific (now outdated) version of Debian's distro kernel [5] running on the
host, can read host kernel memory at a rate of around 1500 bytes/second, with
room for optimization. Before the attack can be performed, some initialization
has to be performed that takes roughly between 10 and 30 minutes for a machine
with 64GiB of RAM; the needed time should scale roughly linearly with the
amount of host RAM. (If 2MB hugepages are available to the guest, the
initialization should be much faster, but that hasn't been tested.)

A PoC for variant 3 that, when running with normal user privileges, can
read kernel memory on the Intel Haswell Xeon CPU under some precondition. We
believe that this precondition is that the targeted kernel memory is present
in the L1D cache.
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "

--
Pozdrawiam,
Michał "rysiek" Woźniak

Zmieniam klucz GPG :: http://rys.io/pl/147
GPG Key Transition :: http://rys.io/en/147

[awokd]

On Thu, January 4, 2018 12:03 am, rysiek wrote:

> And here we are:
> https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-
> need.html
> https://googleprojectzero.blogspot.pt/2018/01/reading-privileged-memory-w
> ith-side.html https://meltdownattack.com/meltdown.pdf
> https://spectreattack.com/spectre.pdf

Xen Security Advisory (not Qubes)
https://xenbits.xen.org/xsa/advisory-254.html

[stephen...@gmail.com]

There is a Xen fix available here, at least to the Meltdown manifestation to the chip-makers SNAFU:

https://xenbits.xen.org/xsa/advisory-254.html

This I assume will be in the 4.0 release version of Qubes.

The best explanation of the field that I can find is here: https://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/

Oder?

[stephen...@gmail.com]

Or at least the Meltdown (= SP3?) parts thereof. Against Spectre there is no known defence, which generally seems to break VM isolation against an attack.

[stephen...@gmail.com]

On Wednesday, 3 January 2018 12:55:54 UTC+1, stephen...@gmail.com wrote:

I guess the good news is that this debacle is going to force hardware designers and OS developers (including Qubes) to work together on minimising the chances chip-level bugs like this.

Also Intel, AMD, ARM & Co. will be 'motivated' to pay attention to hardware virtualisation security issues.

[eva...@openmailbox.org]

3.2 affected? When patch will be available? :(

[stephen...@gmail.com]

On Thursday, 4 January 2018 13:39:46 UTC+1, eva...@openmailbox.org wrote:
> 3.2 affected? When patch will be available? :(

My impression is that 3.2 isn't being patched pending 4.0, but I could be wrong there.

[stephen...@gmail.com]

On Wednesday, 3 January 2018 12:55:54 UTC+1, stephen...@gmail.com wrote:

Redhat has now posted speculative execution mitigation patches. I've no idea to what extent they fix all possible Spectre-like side-channel attacks.

[Holger Levsen]

you are wrong.

3.2 will be supported for one more year after the release of 4.0.
(Normally it's just for half a year.)


--
cheers,
Holger

[awokd]

This part is interesting, but might not be a lot of good if it doesn't
include PCI passthrough:

"For guests with legacy PV kernels which cannot be run in HVM mode, we
have developed a "shim" hypervisor that allows PV guests to run in PVH
mode. Unfortunately, due to the accelerated schedule, this is not yet
ready to release. We expect to have it ready for 4.10, as well as PVH
backports to 4.9 and 4.8, available over the next few days."

[stephen...@gmail.com]

On Wednesday, 3 January 2018 12:55:54 UTC+1, stephen...@gmail.com wrote:

Some news from rootkovska via Twatter:

Re the #Meltdown/#Spectre attacks:
1. Practical impact on Qubes is unclear to us ATM,
2. No advanced info has been shared with us on Xen predisclosure list, so we've had no time to evaluate yet,
3. Xen published XSA 254 unexpectedly last night,
4. Xen offers no patches ATM...

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

We've just published an announcement about this:

https://www.qubes-os.org/news/2018/01/04/xsa-254-meltdown-spectre/

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAlpOSSkACgkQ203TvDlQ
MDCm1A/8CB9dT3qUWt3KkrjRSd0kYBLnHyEHUVs828gHIT8J+QrIvWAkw1hKyVR9
mMas3QIKPCZiWh7/d69OES0YBFZLA8P79u1jJHaMGOh5j1JkQiqyMQ9dM9fH7pK7
cr1UKIbkhM9Yicp8F73FVuwQZe4zwOreUBW0PkPFtS5yNm9mYVqeGMvgFBdq+m+7
/e2R5uVk8WKtNxuIxqYm/fZAec8hNi9B+YxCrnO7w3a2VWLMu99yCTM7BaCvZcUe
igoocDJ1Y3He/3TaV9dGcjmrOkih7iBTWS4jXr9B6XYSAhp4VyAqyldy9QQM3Icz
CWKMxfuJzUaw+UYF3O85o8PAEKgzWxDqqGzR+1VVDJbDwzixolqWgpcl80PkLPRf
Wdu9HZVXYeG0g0JA/Ys+KifKKRzFOaIHezTagJpxCt+qGct9wKjbyjdL/6bsi2dP
P1AHQzcDJiHEQ9Uz91jqnRV0Ri2/+Dz+luiSbAlock7HjaQ7j9GvbRcGk72RU/lK
qizFfPPLvHhR8OiSPPtl8sLNMMgxM+sC5lTJOzJtRkszKGpT8+DXonYviNjGbbSO
qkLxoga1FMqDQlKb2sNPOqRs1/CtEqKsqSNuejDen5fl9STHoZKsuBr7/Ko6R3Gn
Ty8l7AKg4fWyN9flc3LOUo2WAHACRhkQ4yCYR5hx3Xwc62lshis=
=p5v8
-----END PGP SIGNATURE-----

[rysiek]

Dnia Thursday, January 4, 2018 9:33:04 AM CET Andrew David Wong pisze:

> We've just published an announcement about this:
>
> https://www.qubes-os.org/news/2018/01/04/xsa-254-meltdown-spectre/

Thank you, much appreciated. Good luck to the whole team in dealing with this.