| Subject | Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution | From | QingFeng Hao <> | Date | Sat, 13 Jan 2018 19:33:41 +0800 |
| |
在 2018/1/6 9:09, Dan Williams 写道: > Quoting Mark's original RFC: > > "Recently, Google Project Zero discovered several classes of attack > against speculative execution. One of these, known as variant-1, allows > explicit bounds checks to be bypassed under speculation, providing an > arbitrary read gadget. Further details can be found on the GPZ blog [1] > and the Documentation patch in this series." > > This series incorporates Mark Rutland's latest api and adds the x86 > specific implementation of nospec_barrier. The > nospec_{array_ptr,ptr,barrier} helpers are then combined with a kernel > wide analysis performed by Elena Reshetova to address static analysis > reports where speculative execution on a userspace controlled value @Elena, can I know how did you do this analysis? I mean manually or with tool. Thanks! > could bypass a bounds check. The patches address a precondition for the > attack discussed in the Spectre paper [2]. > > A consideration worth noting for reviewing these patches is to weigh the > dramatic cost of being wrong about whether a given report is exploitable > vs the overhead nospec_{array_ptr,ptr} may introduce. In other words, > lets make the bar for applying these patches be "can you prove that the > bounds check bypass is *not* exploitable". Consider that the Spectre > paper reports one example of a speculation window being ~180 cycles. [snip] > >
-- Regards QingFeng Hao
|