Re: [PATCH 0/7] IBRS patch series

[David Woodhouse]

On Thu, 2018-01-04 at 11:33 -0800, Linus Torvalds wrote:
> On Thu, Jan 4, 2018 at 11:19 AM, David Woodhouse <dwmw2@xxxxxxxxxxxxx> wrote:
> >
> > On Skylake the target for a 'ret' instruction may also come from the
> > BTB. So if you ever let the RSB (which remembers where the 'call's came
> > from get empty, you end up vulnerable.
> 
> That sounds like it could cause mispredicts, but it doesn't sound _exploitable_.
> 
> Sure, interrupts in between the call instruction and the 'ret' could
> overflow the return stack. And we could migrate to another CPU. And so
> apparently SMM clears the return stack too.
> 
> ... but again, none of them sound even remotely _exploitable_.

The concern is that the attacker could poison the BTB for a 'ret'
insteruction, as in the general case of the SP2 (conditional branch
misprediction) attack, so that it predicts a branch to an address of
the attacker's choice.

Now *most* of the time, one might expect the target for that 'ret' to
come from the RSB. But if there is a way to force the RSB to empty, or
the attacker is just happy to keep trying, and wait for things like SMI
to make it work every now and then, then it *might* be exploitable.

It's quite possible that a proof exists that all the above is *so*
hypothetical and unlikely, that we might as well use retpoline on
Skylake too. So far, nobody's proved it sufficiently; that's all.
So we're erring on the side of caution there.

Attachment: smime.p7s
Description: S/MIME cryptographic signature