[lkml]   [2014]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectAMD errata 793 (CVE-2013-6885) needs a workaround in Linux?
I just got this assigned to amd64-microcode in Debian, but it is something
that needs to be worked around by the EFI/BIOS and/or the kernel.

Since we all know just how well it pans out to depend on BIOS/EFI updates
for *anything*, I'm raising the issue here. IMHO looks like it would be
worthwhile to either set the relevant MSR in the kernel if the BIOS didn't
do it, or at least warn the user of the need for a BIOS/EFI update...

It is the usual hangs-core type of CPU errata (therefore, the best type
since it won't cause silent data corruption). gcc-produced code managed to
trigger it (in DragonFly BSD).

A quick search under arch/x86 did not locate any existing workaround for
this issue.

Date: Wed, 27 Nov 2013 21:23:37 -0500 (EST)
Subject: CVE-2013-6885 AMD Publ. 51810 Errata 793 system hang

The person who requested CVE-2013-6885 asked that we send the CVE
assignment here because various open-source software will probably be
adding code to prevent this denial of service attack.

793 Specific Combination of Writes to Write Combined Memory
Types and Locked Instructions May Cause Core Hang

Under a highly specific and detailed set of internal timing
conditions, a locked instruction may trigger a timing sequence whereby
the write to a write combined memory type is not flushed, causing the
locked instruction to stall indefinitely.

Potential Effect on System
Processor core hang.

Suggested Workaround
BIOS should set MSRC001_1020[15] = 1b.

No fix planned

- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA

"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh

 \ /
  Last update: 2014-01-14 13:21    [W:0.106 / U:1.748 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site