DragonFlyBSD Finishes Up Spectre Mitigation, Fix For Mysterious CVE-2018-8897

Written by Michael Larabel in Linux Security on 8 May 2018 at 01:32 PM EDT. 1 Comment
LINUX SECURITY
DragonFlyBSD lead developer Matthew Dillon has just pushed out DragonFly's Spectre mitigation code as well as fixing "CVE-2018-8897" which is what might be the recently rumored "Spectre-NG" vulnerabilities.

Matthew Dillon was very quick to be the first major BSD player pushing out patches for Spectre and Meltdown back in January, beating the other BSDs by a significant amount of time to getting mitigated for these CPU vulnerabilities.

Today he fleshed out the rest of their Spectre mitigation code. The rest of this work includes Spectre support for AMD CPUs, adjustments to the Intel CPU handling, enabling IBRS and STIBP automatically on by default for affected CPUs, and changes to the machdep.spectre_mitigation sysctl. DragonFlyBSD isn't enabling IBPB by default due to significant performance overhead.

He also pushed out some kernel optimizations, hopefully helping to offset some of the overhead from the Spectre/Meltdown mitigation techniques.

As part of this slew of Spectre commits, Matthew Dillon also landed a fix for CVE-2018-8897 for what he sums up as a debug register issue on Intel/AMD CPUs and "Fix by giving #DB its own trampoline stack and a way to load a deterministic %gs and %cr3 independent of the normal CS check. This is CVE-2018-8897."

CVE-2018-8897 isn't yet public and given it was part of this other Spectre activity makes us wonder if this is part of what was recently rumored as "Spectre-NG" for a new class of CPU vulnerabilities. The patch in question does credit Microsoft for coordinating the vendor response (a.k.a. just not a DragonFly kernel security issue) and that the original reporter to this CPU issue was an Everdox Tech LLC. But beyond that I haven't been able to find out much yet on this latest CVE; there aren't any references to CVE-2018-8897 yet by the Linux kernel nor any other relevant information have I found yet.

Update: The embargo around CVE-2018-8897 has now been lifted. Details via Mitre and oss-sec. It's unrelated to Spectre/Spectre-NG but could cause the kernel to crash. Fortunately, the issue is already resolved in recent releases of the mainline Linux kernel.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week