4 ms·

Xen Advisory – x86 CMPXCHG8B emulation fails to ignore operand size override

30 points by based2 10y ago

based2 10y ago
http://faydoc.tripod.com/cpu/cmpxchg8b.htm http://faydoc.tripod.com/cpu/cmpxchg8b.htm
tptacek 10y ago
Amusingly, not the first CMPXCHG8B-related bug.
based2 10y ago
https://en.wikipedia.org/wiki/Pentium_F00F_bug https://en.wikipedia.org/wiki/Pentium_F00F_bug
- wolfgke 10y ago
  Quote from https://en.wikipedia.org/w/index.php?title=Pentium_F00F_bug&oldid=744308327 https://en.wikipedia.org/w/index.php?title=Pentium_F00F_bug&...: "The Intel Quark series processors are also affected by this bug. [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738575]" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738575]"
unwind 10y ago
Note that this is a bug in Xen (https://en.wikipedia.org/wiki/Xen https://en.wikipedia.org/wiki/Xen, the hypervisor), not in any actual x86 hardware. It accidentally failed to ignore operand size information from the instruction stream, which could lead to leaks of 32 or 96 bits of hypervisor memory contents to a guest. The patch is pretty straight-forward: if ( op_bytes == 8 ) + { host_and_vcpu_must_have(cx16); - op_bytes *= 2; + op_bytes = 16; + } + else + op_bytes = 8; I assume (didn't read the full code) that op_bytes came from the instruction stream.
JoachimSchipper 10y ago
Note that this is a Xen bug, not an Intel bug. That said, those who believe the x86 instruction set is too complex do have one more argument now.
Sintendo 10y ago
Why does Xen need x86 emulation code anyway?
- unwind 10y ago
  To run x86 code on non-x86 machines would be my first guess. But I know nothing.
  - Sintendo 10y ago
    I thought so too at first, but I'd expect non-x86 host systems running x86 guests to be vulnerable if that were the case. The advisory seems to indicate otherwise. Anyway, I've done some digging and found an explanation here: https://insinuator.net/2015/02/the-dangers-of-x86-emulation-xen-xsa-110-and-105/ https://insinuator.net/2015/02/the-dangers-of-x86-emulation-... tl;dr: it falls back to emulation for very specific cases that cannot be handled by hardware-assisted virtualization
- Cyph0n 10y ago
  There are some instructions that are not privileged but may leak information about the host environment to the VM. Such instructions are referred to as sensitive instructions. To prevent sensitive instructions from being misused inside the VM, they are emulated. Another explanation is that some older x86 processors may not have full hardware virtualization support, so Xen emulates the instructions to support a wider number of host configurations. I may be completely wrong though.
- crest 10y ago
  The x86 instruction set wasn't designed with hardware virtualisation in mind. Some of its instructions are defined to leak state from higher privileged levels into lower privileged levels. As hypervisor Xen must preserve these semantics. One way to achieve this is to trap all possible leaks and emulate the leak in the hypervisor. This is what Xen tried and failed to implement correctly. An other possible solution to similar problems is to complicate the CPU even further and have it virtualise the corner cases in hardware or microcode.

30 points by based2 10y ago

based2 10y ago

http://faydoc.tripod.com/cpu/cmpxchg8b.htm http://faydoc.tripod.com/cpu/cmpxchg8b.htm

tptacek 10y ago

Amusingly, not the first CMPXCHG8B-related bug.

based2 10y ago

https://en.wikipedia.org/wiki/Pentium_F00F_bug https://en.wikipedia.org/wiki/Pentium_F00F_bug

wolfgke 10y ago
Quote from https://en.wikipedia.org/w/index.php?title=Pentium_F00F_bug&oldid=744308327 https://en.wikipedia.org/w/index.php?title=Pentium_F00F_bug&...: "The Intel Quark series processors are also affected by this bug. [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738575]" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738575]"

unwind 10y ago

Note that this is a bug in Xen (https://en.wikipedia.org/wiki/Xen https://en.wikipedia.org/wiki/Xen, the hypervisor), not in any actual x86 hardware. It accidentally failed to ignore operand size information from the instruction stream, which could lead to leaks of 32 or 96 bits of hypervisor memory contents to a guest. The patch is pretty straight-forward: if ( op_bytes == 8 ) + { host_and_vcpu_must_have(cx16); - op_bytes *= 2; + op_bytes = 16; + } + else + op_bytes = 8; I assume (didn't read the full code) that op_bytes came from the instruction stream.

JoachimSchipper 10y ago

Note that this is a Xen bug, not an Intel bug. That said, those who believe the x86 instruction set is too complex do have one more argument now.

Sintendo 10y ago

Why does Xen need x86 emulation code anyway?

unwind 10y ago
To run x86 code on non-x86 machines would be my first guess. But I know nothing.
- Sintendo 10y ago
  I thought so too at first, but I'd expect non-x86 host systems running x86 guests to be vulnerable if that were the case. The advisory seems to indicate otherwise. Anyway, I've done some digging and found an explanation here: https://insinuator.net/2015/02/the-dangers-of-x86-emulation-xen-xsa-110-and-105/ https://insinuator.net/2015/02/the-dangers-of-x86-emulation-... tl;dr: it falls back to emulation for very specific cases that cannot be handled by hardware-assisted virtualization
Cyph0n 10y ago
There are some instructions that are not privileged but may leak information about the host environment to the VM. Such instructions are referred to as sensitive instructions. To prevent sensitive instructions from being misused inside the VM, they are emulated. Another explanation is that some older x86 processors may not have full hardware virtualization support, so Xen emulates the instructions to support a wider number of host configurations. I may be completely wrong though.
crest 10y ago
The x86 instruction set wasn't designed with hardware virtualisation in mind. Some of its instructions are defined to leak state from higher privileged levels into lower privileged levels. As hypervisor Xen must preserve these semantics. One way to achieve this is to trap all possible leaks and emulate the leak in the hypervisor. This is what Xen tried and failed to implement correctly. An other possible solution to similar problems is to complicate the CPU even further and have it virtualise the corner cases in hardware or microcode.