Variant4

Speculative Store Bypass (CVE-2018-3639 aka GPZ Variant 4)

Ken Johnson of the Microsoft Security Response Center (MSRC) and Jann Horn of Google Project Zero (GPZ) independently discovered another variant of a cache speculation timing side channel attack, similar to the issues previously disclosed under the names Spectre and Meltdown.

With this variant, currently known as Variant 4, systems with microprocessors utilizing speculative execution and speculative execution of a memory read, before the addresses of all prior memory writes are known, may allow unauthorized disclosure of information to an attacker with local user access via a side channel analysis. More colloquially, in one example, Variant 4 can reveal the value of stored data when a load following a store speculatively retrieves the earlier value.

Mitigations

Some mitigations for Spectre v2 also help to mitigate some of the effects of this vulnerability, for example, the reduction in timer precision in browsers renders this variant much more difficult to exploit.

The Speculative Store Bypass vulnerability can be mitigated by setting the newly defined Speculative Store Bypass Disable (SSBD) bit in the IA32_SPEC_CTRL Model-Specific Register (MSR) of x86 processors. Support for this mitigation requires updated microcode for Intel processors. New microcode is not needed for AMD processors.

In Ubuntu, SSBD is OFF by default because it is not needed by most programs and carries a notable performance impact. A prctl() has been added (PR_SPEC_STORE_BYPASS) that enables developers to opt into the mitigation on a per process basis. Applications using a seccomp filter will be implicitly opted into the mitigations. This means that strict and devmode snaps, processes inside of LXD containers, sandboxed processes of the Firefox and Chromium browsers, among some other processes running in a default Ubuntu install on x86 processors, will have the SSBD mitigation enabled out of the box.

Users can explicitly opt-in to SSBD mitigations, on a system-wide basis, by booting with the spec_store_bypass_disable=on boot parameter. See the Mitigation Controls page for details on available boot options.

Update Status

Ubuntu users are recommended to update to the latest kernel, qemu, libvirt, and intel-microcode packages. Ubuntu 18.04 LTS, 17.10, 16.04 LTS, and 14.04 LTS were affected. 12.04 ESM remains affected but updates are in progress.

Bare Metal and Virtual Machines with Intel Processors

QEMU and kernel updates were released to allow bare metal Ubuntu systems to make use of SSBD. Additionally, these updates allow virtualized Ubuntu systems to make use of SSBD with x86 Intel processors. Consult the following table for version information:

Package

USN

Linux Kernel (18.04 LTS)

USN-3652-1

Linux Kernel (17.10)

USN-3653-1

Linux Kernel (16.04 LTS)

USN-3654-1, USN-3653-2

Linux Kernel (14.04 LTS)

USN-3655-1, USN-3654-2

QEMU

USN-3651-1

intel-microcode

Not available


The required intel-microcode updates are not available at this time. Canonical will continue to work with Intel and release intel-microcode updates once they're production ready. In the meantime, you may be able to access updated microcode for your processor in the form of OEM firmware updates.

Virtual Machines with AMD Processors

Additional QEMU, libvirt, and kernel updates were released to allow virtual machines to make use of SSBD support with x86 AMD processors. Consult the following table for version information:

Package

USN

Linux Kernel (18.04 LTS)

USN-3678-1, USN-3678-3

Linux Kernel (17.10)

USN-3677-1

Linux Kernel (16.04 LTS)

USN-3676-1, USN-3677-2, USN-3678-2

Linux Kernel (14.04 LTS)

USN-3674-1, USN-3676-2

QEMU

USN-3679-1

libvirt

USN-3680-1

Verifying Your System

To check if your system is protected against CVE-2018-3639, you can run the following command and compare the output:

  $ cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
  Mitigation: Speculative Store Bypass disabled via prctl and seccomp

The example above shows a system that is mitigated against CVE-2018-3639.

A system that is not running an updated kernel will not have the file indicating the vulnerability status and the system should be considered vulnerable:

  $ cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
  cat: /sys/devices/system/cpu/vulnerabilities/spec_store_bypass: No such file or directory

If the file exists but the system does not have updated microcode, or an updated hypervisor in the case of a virtual machine, the output will indicate that the system is vulnerable:

  $ cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypass
  Vulnerable

References

For more information on these issues, please see the following reference documents:

Timeline

  • 2018 May 21 at 21:00 UTC: the issue is made public
  • 2018 May 21: Linux kernel updates are released
  • 2018 May 21: QEMU updates are released
  • 2018 Jun 11: Linux kernel updates are released that allow SSBD to be used in KVM based virtual machines when using an AMD processor
  • 2018 Jun 12: QEMU and libvirt updates are released that allow SSBD to be used in KVM based virtual machines when using an AMD processor

SecurityTeam/KnowledgeBase/Variant4 (last edited 2018-06-12 20:40:44 by tyhicks)