{"id":112,"date":"2018-01-13T23:19:58","date_gmt":"2018-01-13T23:19:58","guid":{"rendered":"http:\/\/malwrforensics.com\/en\/?p=112"},"modified":"2018-01-14T04:40:08","modified_gmt":"2018-01-14T04:40:08","slug":"spectre-cve-2017-5753-kernel-updates","status":"publish","type":"post","link":"https:\/\/malwrforensics.com\/en\/2018\/01\/13\/spectre-cve-2017-5753-kernel-updates\/","title":{"rendered":"Spectre (CVE-2017-5753) kernel updates"},"content":{"rendered":"

As suggested by Intel in their\u00a0Intel Analysis of Speculative Execution Side Channels\u00a0 <\/a>whitepaper, the recommended mitigation for Spectre<\/a> (CVE-2017-5753<\/a>) is to use the LFENCE<\/a> instruction (“LFENCE does not execute until all prior instructions have completed locally, and no later instruction begins execution until LFENCE completes”). This will stop the bounds check bypass method that relies on instructions being executed after a conditional branch instruction. As sometimes the CPU is executing instructions in advance (to save time), this method takes advantage of this feature to execute instructions while the CPU is trying to determine if an input is in bounds.<\/p>\n

Intel states that “[…]the use of an LFENCE instruction is recommended for this purpose. Serializing instructions, as well as the LFENCE instruction, will stop younger instructions from executing, even speculatively, before older instructions have retired but LFENCE is a better performance solution than other serializing instructions. An LFENCE instruction inserted after a bounds check will prevent younger operations from executing before the bound check retires.[…]”.<\/p>\n

Let’s see an example from the Linux kernel patches\/updates:<\/p>\n

\"\"
linux kernel diff<\/figcaption><\/figure>\n

Similarly, on the Windows kernel side:<\/p>\n

\"\"
windows kernel diff<\/figcaption><\/figure>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

As suggested by Intel in their\u00a0Intel Analysis of Speculative Execution Side Channels\u00a0 whitepaper, the recommended mitigation for Spectre (CVE-2017-5753) is to use the LFENCE instruction (“LFENCE does not execute until all prior instructions have completed locally, and no later instruction begins execution until LFENCE completes”). This will stop the bounds check bypass method that relies […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[29,5,11,28,4],"class_list":["post-112","post","type-post","status-publish","format-standard","hentry","category-security","tag-cve-2017-5753","tag-exploit","tag-linux","tag-spectre","tag-windows"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[]}},"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":""},"post_excerpt_stackable_v2":"

As suggested by Intel in their\u00a0Intel Analysis of Speculative Execution Side Channels\u00a0 whitepaper, the recommended mitigation for Spectre (CVE-2017-5753) is to use the LFENCE instruction (“LFENCE does not execute until all prior instructions have completed locally, and no later instruction begins execution until LFENCE completes”). This will stop the bounds check bypass method that relies on instructions being executed after a conditional branch instruction. As sometimes the CPU is executing instructions in advance (to save time), this method takes advantage of this feature to execute instructions while the CPU is trying to determine if an input is in bounds. Intel…<\/p>\n","category_list_v2":"Security<\/a>","author_info_v2":{"name":"malwrforensics","url":"https:\/\/malwrforensics.com\/en\/author\/u_malwrforensics\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/comments?post=112"}],"version-history":[{"count":1,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/112\/revisions"}],"predecessor-version":[{"id":119,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/112\/revisions\/119"}],"wp:attachment":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/media?parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/categories?post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/tags?post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}