Intel DOWNFALL: vulnerability affecting AVX2 / AVX-512 with big performance implications

[keybreak]

Intel DOWNFALL: New Vulnerability Affecting AVX2/AVX-512 With Big Performance...

[keybreak]

Intel 20230808 Microcode Published For DOWNFALL, Other Security &...

[Canoe]

I’m running a Skylake i7-6700k 4Ghz processor from 2015, at some point I’d like to build one last rig next year before arthritis completely takes dexterity from my hands. Having switched to an 6700XT GPU, here’s hoping AMD has something that’s relatively resilient to modern vulnerabilities in the CPU space.

[keybreak]

AMD "INCEPTION" vulnerability on EPYC and Ryzen CPU ( Zen 3, Zen 4)

AMD has received an external report titled ‘INCEPTION’, describing a new speculative side channel attack. AMD believes ‘Inception’ is only potentially exploitable locally, such as via downloaded malware, and recommends customers employ security best practices, including running up-to-date software and malware detection tools. AMD is not aware of any exploit of ‘Inception’ outside the research environment, at this time. AMD recommends customers apply a µcode patch or BIOS update as applicable f…

[keybreak]

Six New Stable Linux Kernel Updates For Intel DOWNFALL & AMD INCEPTION

[Schlaefer]

@Canoe

here’s hoping AMD has something that’s relatively resilient to modern vulnerabilities in the CPU space

Earlier in today’s news: AMD “INCEPTION” CPU Vulnerability Disclosed

[anon49550872]

POC:

Inception: leaking the root hash from /etc/shadow on AMD Zen 4

[vazicebon]

My CPU is old enough it doesn’t use AVX2 or AVX512 instructions.

[keybreak]

Initial Benchmarks Of The Intel Downfall Mitigation Performance Impact

[anon49550872]

Things changed with this kernel ?

$ grep . -r /sys/devices/system/cpu/vulnerabilities/

/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Retpolines, IBPB: conditional, IBRS_FW, STIBP: always-on, RSB filling, PBRSB-eIBRS: Not affected
/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
/sys/devices/system/cpu/vulnerabilities/mmio_stale_data:Not affected
/sys/devices/system/cpu/vulnerabilities/mds:Not affected
/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/gather_data_sampling:Not affected
/sys/devices/system/cpu/vulnerabilities/retbleed:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow:Mitigation: safe RET, no microcode
/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected

Linux eos 6.4.9-arch1-1 #1 SMP PREEMPT_DYNAMIC Tue, 08 Aug 2023 22:14:05 +0000 x86_64 GNU/Linux

commit acdc883eb61efbe01b954e782e1124790bd391a8
Author: Borislav Petkov (AMD) bp@alien8.de
Date: Wed Jun 28 11:02:39 2023 +0200

x86/srso: Add a Speculative RAS Overflow mitigation

Upstream commit: fb3bd914b3ec28f5fb697ac55c4846ac2d542855

Add a mitigation for the speculative return address stack overflow
vulnerability found on AMD processors.

The mitigation works by ensuring all RET instructions speculate to
a controlled location, similar to how speculation is controlled in the
retpoline sequence.  To accomplish this, the __x86_return_thunk forces
the CPU to mispredict every function return using a 'safe return'
sequence.

To ensure the safety of this mitigation, the kernel must ensure that the
safe return sequence is itself free from attacker interference.  In Zen3
and Zen4, this is accomplished by creating a BTB alias between the
untraining function srso_untrain_ret_alias() and the safe return
function srso_safe_ret_alias() which results in evicting a potentially
poisoned BTB entry and using that safe one for all function returns.

In older Zen1 and Zen2, this is accomplished using a reinterpretation
technique similar to Retbleed one: srso_untrain_ret() and
srso_safe_ret().

Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.9

It seems that they applied a patch to Inception vulnerability already ?