Variant4
Speculative Store Bypass (CVE-2018-3639 aka GPZ Variant 4)
Ken Johnson of the Microsoft Security Response Center (MSRC) and Jann Horn of Google Project Zero (GPZ) independently discovered another variant of a cache speculation timing side channel attack, similar to the issues previously disclosed under the names Spectre and Meltdown.
With this variant, currently known as Variant 4, systems with microprocessors utilizing speculative execution and speculative execution of a memory read, before the addresses of all prior memory writes are known, may allow unauthorized disclosure of information to an attacker with local user access via a side channel analysis. More colloquially, in one example, Variant 4 can reveal the value of stored data when a load following a store speculatively retrieves the earlier value.
Some mitigations for Spectre v2 also help to mitigate some of the effects of this vulnerability, for example, the reduction in timer precision in browsers renders this variant much more difficult to exploit.
The Speculative Store Bypass vulnerability can be mitigated by setting the newly defined Speculative Store Bypass Disable (SSBD) bit in the IA32_SPEC_CTRL Model-Specific Register (MSR) of x86 processors. Support for this mitigation requires updated microcode for Intel processors.
In Ubuntu, SSBD is OFF by default because it is not needed by most programs and carries a notable performance impact. A prctl() has been added (PR_SPEC_STORE_BYPASS) that enables developers to opt into the mitigation on a per process basis. Applications using a seccomp filter will be implicitly opted into the mitigations. This means that strict and devmode snaps, processes inside of LXD containers, sandboxed processes of the Firefox and Chromium browsers, among some other processes running in a default Ubuntu install on x86 processors, will have the SSBD mitigation enabled out of the box.
Users can explicitly opt-in to SSBD mitigations, on a system-wide basis, by booting with the spec_store_bypass_disable=on boot parameter.
Ubuntu users are recommended to update to the latest kernel, qemu, and intel-microcode packages. Ubuntu 18.04 LTS, 17.10, 16.04 LTS, and 14.04 LTS were affected. 12.04 ESM remains affected but updates are in progress.
To address the issues, the majority of users should ensure that linux-image-4.15.0-22-generic 4.15.0-22.24 and qemu 1:2.11+dfsg-1ubuntu7.2 (Ubuntu 18.04 LTS), linux-image-4.13.0-43-generic 4.13.0-43.48 and qemu 1:2.10+dfsg-0ubuntu3.7 (Ubuntu 17.10), linux-image-4.4.0-127-generic 4.4.0-127.153 and 1:2.5+dfsg-5ubuntu10.29 (Ubuntu 16.04 LTS), or linux-image-3.13.0-149-generic 3.13.0-149.199 and qemu 2.0.0+dfsg-2ubuntu1.42 (Ubuntu 14.04 LTS) are installed. Users of non-generic Ubuntu kernels should consult the published Ubuntu Security Notices for version information.
The required intel-microcode updates are not available at this time. They'll be published after Intel releases them to the public.
For more information on these issues, please see the following reference documents:
Timeline
- 2018 May 21 at 21:00 UTC: the issue is made public