lkml.org 
[lkml]   [2018]   [Jan]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRE: [PATCH 0/7] IBRS patch series
    Date
    > On Thu, Jan 4, 2018 at 11:19 AM, David Woodhouse <dwmw2@infradead.org>
    > wrote:
    > >
    > > On Skylake the target for a 'ret' instruction may also come from the
    > > BTB. So if you ever let the RSB (which remembers where the 'call's came
    > > from get empty, you end up vulnerable.
    >
    > That sounds like it could cause mispredicts, but it doesn't sound _exploitable_.
    >
    > Sure, interrupts in between the call instruction and the 'ret' could
    > overflow the return stack. And we could migrate to another CPU. And so
    > apparently SMM clears the return stack too.
    >
    > ... but again, none of them sound even remotely _exploitable_.
    >

    this is about a level of paranoia you are comfortable with.

    Retpoline on Skylake raises the bar for the issue enormously, but there are a set of corner cases that exist and that are not trivial to prove you dealt with them.

    personally I am comfortable with retpoline on Skylake, but I would like to have IBRS as an opt in for the paranoid.


    \
     
     \ /
      Last update: 2018-01-04 22:23    [W:2.783 / U:0.824 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site