Intel SA-00145: Lazy FP State Restore

#1

Post by lkurusa » Wed, Jun 13, 2018, 9:30 PM UTC

Intel SA-00145: Lazy FP State Restore
intel.com

Re: Intel SA-00145: Lazy FP State Restore

#2

Post by 0x0 » Wed, Jun 13, 2018, 10:11 PM UTC

Status in Debian: https://security-tracker.debian.org/tracker/CVE-2018-3665

Re: Intel SA-00145: Lazy FP State Restore

#3

Post by cperciva » Wed, Jun 13, 2018, 10:13 PM UTC

I posted some details about this to Twitter: https://twitter.com/cperciva/status/1007010583244230656

Re: Intel SA-00145: Lazy FP State Restore

#4

Post by andreiw » Wed, Jun 13, 2018, 10:20 PM UTC

What are we calling this Spectre variant?

Re: Intel SA-00145: Lazy FP State Restore

#5

Post by andreiw » Wed, Jun 13, 2018, 10:22 PM UTC

Do we have PoC code? Has anyone tried attacking FP/SIMD state on other ISAs like Power or AArch64?

Re: Intel SA-00145: Lazy FP State Restore

#6

Post by cperciva » Wed, Jun 13, 2018, 10:22 PM UTC

andreiw wrote: post #4

What are we calling this Spectre variant?

Either "LazyFP" or "Lazy FPU".

Re: Intel SA-00145: Lazy FP State Restore

#7

Post by andreiw » Wed, Jun 13, 2018, 10:23 PM UTC

cperciva wrote: post #6

andreiw wrote: post #4

What are we calling this Spectre variant?

Either "LazyFP" or "Lazy FPU".

Not numerating it? Variant 6 is as good as anything...

Re: Intel SA-00145: Lazy FP State Restore

#8

Post by sctb » Wed, Jun 13, 2018, 10:27 PM UTC

We'll let this thread take the frontpage spot now that the announcement is official. Previous one: https://news.ycombinator.com/item?id=17304233.

Re: Intel SA-00145: Lazy FP State Restore

#9

Post by cperciva » Wed, Jun 13, 2018, 10:28 PM UTC

andreiw wrote: post #5

Do we have PoC code? Has anyone tried attacking FP/SIMD state on other ISAs like Power or AArch64?

I have exploit code -- took me about 5 hours to write after Theo announced all the important details of the vulnerability. I'm not going to publish it yet, though.

AFAIK other systems aren't affected -- is lazy context switching even a thing on them? The fundamental issue here is that one process' data is still in registers when another process is running and we've been relying on getting a trap to tell us when we need to restore the correct FP state.

Re: Intel SA-00145: Lazy FP State Restore

#10

Post by kentonv » Wed, Jun 13, 2018, 10:37 PM UTC

Andy Lutomirski noted on another thread that he unintentionally fixed this two years ago in Linux:

https://news.ycombinator.com/item?id=17304947

(He switched it to eager FP because it's faster on modern hardware.)

But a lot of people running old LTS kernels may be affected.

EDIT: Looks like Luto's change landed in kernel version 4.6. https://kernelnewbies.org/Linux_4.6#List_of_merges https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...