lkml.org 
[lkml]   [2017]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [kernel-hardening] [RFC, PATCH] x86_64: KAISER - do not map kernel in user mode
From
Date
On 2017-05-06 06:02, David Gens wrote:
> Assuming that their patch indeed leaks per-cpu addresses.. it might not
> necessarily
> be required to change it.

I think we're not leaking them (unless we still have some bug in our
code). The basic idea is that any part that is required for the context
switch is at a fixed location (unrelated to the location of code / data
/ per-cpu data / ...) and thus does not reveal any randomized offsets.
Then the attacker cannot gain any knowledge through the side channel
anymore.
For any attack the attacker could then only use the few KBs of memory
that cannot be unmapped because of the way x86 works. Hardening these
few KBs seems like an easier task than doing the same for the entire kernel.

(The best solution would of course be Intel introducing CR3A and CR3B
just like ARM has TTBR0 and TTBR1 - on ARM this entirely prevents any
prefetch / double-fault side-channel attacks.)

\
 
 \ /
  Last update: 2017-05-06 10:39    [W:0.119 / U:0.312 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site