{"uuid": "e91e4f97-619c-4352-840d-1baf2469a295", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2018-3665", "type": "seen", "source": "https://t.me/QubesOS/212", "content": "QSB #41: Speculative register leakage from lazy FPU context switching (XSA-267)\nhttps://www.qubes-os.org/news/2018/06/13/qsb-41/\n\nDear Qubes Community,\n\nWe have just published Qubes Security Bulletin (QSB) #41: Speculative\nregister leakage from lazy FPU context switching (XSA-267). The text of\nthis QSB is reproduced below. This QSB and its accompanying signatures\nwill always be available in the Qubes Security Pack (qubes-secpack).\n\nView QSB #41 in the qubes-secpack:\n\nhttps://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-041-2018.txt\n\nLearn about the qubes-secpack, including how to obtain, verify, and read\nit:\n\nhttps://www.qubes-os.org/security/pack/\n\nView all past QSBs:\n\nhttps://www.qubes-os.org/security/bulletins/\n\nView XSA-267 in the XSA Tracker:\n\nhttps://www.qubes-os.org/security/xsa/#267\n\n             ---===[ Qubes Security Bulletin #41 ]===---\n\n                             2018-06-13\n\n\n  Speculative register leakage from lazy FPU context switching (XSA-267)\n\nSummary\n========\n\nOn 2018-06-13, the Xen Security Team published Xen Security Advisory\n267 (CVE-2018-3665 / XSA-267) [1] with the following description:\n\n| x86 has a hardware mechanism for lazy FPU context switching.  On a\n| task switch, %cr0.ts (Task Switched) gets set, and the next\n| instruction to touch floating point state raises an #NM (No Math,\n| later known as Device Not Available) exception.\n| \n| Traditionally, FPU state has been large in comparison to available\n| bandwidth (and therefore slow to switch) and not used as frequently as\n| cpu tasks tend to switch.  This mechanism allows the OS to only switch\n| FPU when necessary, which in turn increases performance.\n| \n| Some CPUs however speculate past an #NM exception, allowing register\n| content to be leaked by a side-channel.\n| \n| An attacker can read x87/MMX/SSE/AVX/AVX-512 register state belonging\n| to another vCPU previously scheduled on the same processor.  This can\n| be state belonging a different guest, or state belonging to a\n| different thread inside the same guest.\n\nThis is yet another CPU hardware bug related to speculative execution.\n\nPatching\n=========\n\nTo resolve this issue, the Xen Project has provided patches disabling\nlazy FPU context switching on affected systems.\n\nThe specific packages that resolve the problems discussed in this\nbulletin are as follows:\n\n  For Qubes 3.2:\n  - Xen packages, version 4.6.6-42\n\n  For Qubes 4.0:\n  - Xen packages, version 4.8.3-9\n\nThe packages are to be installed in dom0 via the Qubes VM Manager or via\nthe qubes-dom0-update command as follows:\n\n  For updates from the stable repository (not immediately available):\n  $ sudo qubes-dom0-update\n\n  For updates from the security-testing repository:\n  $ sudo qubes-dom0-update --enablerepo=qubes-dom0-security-testing\n\nA system restart will be required afterwards.\n\nThese packages will migrate from the security-testing repository to the\ncurrent (stable) repository over the next two weeks after being tested\nby the community.\n\nIf you use Anti Evil Maid, you will need to reseal your secret\npassphrase to new PCR values, as PCR18+19 will change due to the new\nXen binaries.\n\nCredits\n========\n\nSee the original Xen Security Advisory.\n\nReferences\n===========\n\n[1] https://xenbits.xen.org/xsa/advisory-267.html\n\n--\nThe Qubes Security Team\nhttps://www.qubes-os.org/security/", "creation_timestamp": "2018-06-14T06:29:23.000000Z"}