In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack.
However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel.
To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small.
The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation:
[...] // r6 = 0 or 1 (skalar, unknown user input) // r7 = accessible ptr for side channel // r10 = frame pointer (fp), to be leaked // r9 = r10 # fp alias to encourage ssb *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked // lfence added here because of pointer spill to stack. // // Ommitted: Dummy bpfringbufoutput() here to train alias predictor // for no r9-r10 dependency. // *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB // // fix: also add an lfence when the slot contained a ptr // r8 = *(u64 *)(r9 - 8) // r8 = architecturally a scalar, speculatively a ptr // // leak ptr using branch-based cache side channel: r8 &= 1 // choose bit to leak if r8 == 0 goto SLOW // no mispredict // architecturally dead code if input r6 is 0, // only executes speculatively iff ptr bit is 1 r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) SLOW: [...]
After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64.
In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details.
Do not make the mitigation depend on !env->allow{uninitstack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes.
{ "vanir_signatures": [ { "signature_type": "Function", "id": "CVE-2023-53024-21352059", "digest": { "length": 2169.0, "function_hash": "174808967770129640543208494414189280821" }, "deprecated": false, "target": { "function": "check_stack_write_fixed_off", "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528" }, { "signature_type": "Function", "id": "CVE-2023-53024-2a1b0c3e", "digest": { "length": 1958.0, "function_hash": "62413484187081595156001315270490596830" }, "deprecated": false, "target": { "function": "check_stack_write", "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aae109414a57ab4164218f36e2e4a17f027fcaaa" }, { "signature_type": "Line", "id": "CVE-2023-53024-333c9f6c", "digest": { "threshold": 0.9, "line_hashes": [ "16031329080279237851779676742811455559", "155195573128082175480875547190669924334", "129526963904096166097393693486407360949", "46656436390294231328564487971782315488" ] }, "deprecated": false, "target": { "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528" }, { "signature_type": "Line", "id": "CVE-2023-53024-38d750ef", "digest": { "threshold": 0.9, "line_hashes": [ "216036139810543644610536250573915895800", "155195573128082175480875547190669924334", "129526963904096166097393693486407360949", "46656436390294231328564487971782315488" ] }, "deprecated": false, "target": { "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81b3374944d201872cfcf82730a7860f8e7c31dd" }, { "signature_type": "Function", "id": "CVE-2023-53024-9d430e71", "digest": { "length": 2224.0, "function_hash": "109493309936548805809138507616919044574" }, "deprecated": false, "target": { "function": "check_stack_write", "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81b3374944d201872cfcf82730a7860f8e7c31dd" }, { "signature_type": "Function", "id": "CVE-2023-53024-9e8eaa5f", "digest": { "length": 2219.0, "function_hash": "129901450407222086872032121666926769726" }, "deprecated": false, "target": { "function": "check_stack_write_fixed_off", "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f4db47794c9f474b184ee1418f42e6a07412b6" }, { "signature_type": "Line", "id": "CVE-2023-53024-b28c4d4d", "digest": { "threshold": 0.9, "line_hashes": [ "16031329080279237851779676742811455559", "155195573128082175480875547190669924334", "129526963904096166097393693486407360949", "46656436390294231328564487971782315488" ] }, "deprecated": false, "target": { "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da75dec7c6617bddad418159ffebcb133f008262" }, { "signature_type": "Function", "id": "CVE-2023-53024-bb87ca77", "digest": { "length": 2219.0, "function_hash": "129901450407222086872032121666926769726" }, "deprecated": false, "target": { "function": "check_stack_write_fixed_off", "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0c89ef025562161242a7c19b213bd6b272e93df" }, { "signature_type": "Line", "id": "CVE-2023-53024-dbb2fff9", "digest": { "threshold": 0.9, "line_hashes": [ "16031329080279237851779676742811455559", "155195573128082175480875547190669924334", "129526963904096166097393693486407360949", "46656436390294231328564487971782315488" ] }, "deprecated": false, "target": { "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4f4db47794c9f474b184ee1418f42e6a07412b6" }, { "signature_type": "Function", "id": "CVE-2023-53024-e1cea082", "digest": { "length": 2201.0, "function_hash": "232350739728548250083071292590543974563" }, "deprecated": false, "target": { "function": "check_stack_write_fixed_off", "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da75dec7c6617bddad418159ffebcb133f008262" }, { "signature_type": "Line", "id": "CVE-2023-53024-e6c2eb28", "digest": { "threshold": 0.9, "line_hashes": [ "16031329080279237851779676742811455559", "155195573128082175480875547190669924334", "129526963904096166097393693486407360949", "46656436390294231328564487971782315488" ] }, "deprecated": false, "target": { "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0c89ef025562161242a7c19b213bd6b272e93df" }, { "signature_type": "Line", "id": "CVE-2023-53024-f732b23c", "digest": { "threshold": 0.9, "line_hashes": [ "216036139810543644610536250573915895800", "155195573128082175480875547190669924334", "129526963904096166097393693486407360949", "46656436390294231328564487971782315488" ] }, "deprecated": false, "target": { "file": "kernel/bpf/verifier.c" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aae109414a57ab4164218f36e2e4a17f027fcaaa" } ] }