Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution

Laurent Pinchart
2018-01-08T11:14:47Z

H Peter,

On Monday, 8 January 2018 12:08:36 EET Peter Zijlstra wrote:
> On Fri, Jan 05, 2018 at 10:30:16PM -0800, Dan Williams wrote:
> > On Fri, Jan 5, 2018 at 6:22 PM, Eric W. Biederman wrote:
> >> In at least one place (mpls) you are patching a fast path. Compile out
> >> or don't load mpls by all means. But it is not acceptable to change the
> >> fast path without even considering performance.
> >
> > Performance matters greatly, but I need help to identify a workload
> > that is representative for this fast path to see what, if any, impact
> > is incurred. Even better is a review that says "nope, 'index' is not
> > subject to arbitrary userspace control at this point, drop the patch."
>
> I think we're focussing a little too much on pure userspace. That is, we
> should be saying under the attackers control. Inbound network packets
> could equally be under the attackers control.

I was thinking about that as well. It would then require a way to observe
cache hits from the network. While not easy I'm pretty sure it could be
doable, opening the door to remote attacks. With my paranoid security hat on
(paranoid just means cautious when dealing with security issues, doesn't it ?)
I'm more concerned about that than by some of the local attack vectors.

> Sure, userspace is the most direct and highest bandwidth one, but I
> think we should treat all (kernel) external values with the same
> paranoia.

--
Regards,

Laurent Pinchart