Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2416
L1 Terminal Fault (L1TF) Kernel Information Disclosure
17 August 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: kernel
Publisher: FreeBSD
Operating System: FreeBSD
Impact/Access: Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-3646 CVE-2018-3620
Reference: ESB-2018.2404
ESB-2018.2398
ESB-2018.2348.2
ESB-2018.2343
Original Bulletin:
https://security.freebsd.org/advisories/FreeBSD-SA-18:09.l1tf.asc
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-18:09.l1tf Security Advisory
The FreeBSD Project
Topic: L1 Terminal Fault (L1TF) Kernel Information Disclosure
Category: core
Module: Kernel
Announced: 2018-08-14
Affects: All supported versions of FreeBSD.
Corrected: 2018-08-14 17:51:12 UTC (stable/11, 11.1-STABLE)
2018-08-15 02:30:11 UTC (releng/11.2, 11.2-RELEASE-p2)
2018-08-15 02:30:11 UTC (releng/11.1, 11.1-RELEASE-p13)
CVE Name: CVE-2018-3620, CVE-2018-3646
Special Note: Speculative execution vulnerability mitigation remains a work
in progress. This advisory addresses the issue in FreeBSD
11.1 and later. We expect to update this advisory to include
10.4 at a later time.
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
When a program accesses data in memory via a logical address it is translated
to a physical address in RAM by the CPU. Accessing an unmapped logical
address results in what is known as a terminal fault.
II. Problem Description
On certain Intel 64-bit x86 systems there is a period of time during terminal
fault handling where the CPU may use speculative execution to try to load
data. The CPU may speculatively access the level 1 data cache (L1D). Data
which would otherwise be protected may then be determined by using side
channel methods.
This issue affects bhyve on FreeBSD/amd64 systems.
III. Impact
An attacker executing user code, or kernel code inside of a virtual machine,
may be able to read secret data from the kernel or from another virtual
machine.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +30 "Rebooting for security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 11.2]
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.2.patch
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.2.patch.asc
# gpg --verify l1tf-11.2.patch.asc
[FreeBSD 11.1]
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.1.patch
# fetch https://security.FreeBSD.org/patches/SA-18:09/l1tf-11.1.patch.asc
# gpg --verify l1tf-11.1.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
CVE-2018-3620 (L1 Terminal Fault-OS)
- - ------------------------------------
FreeBSD reserves the the memory page at physical address 0, so it will not
contain secret data. FreeBSD zeros the paging data structures for unmapped
addresses, so that speculatively executed L1 Terminal Faults will access only
the reserved, unused page.
CVE-2018-3646 (L1 Terminal Fault-VMM)
- - -------------------------------------
Patched systems flush the L1 data cache prior to guest entry, so that there
is no secret data in cache for a terminal fault (from the the guest) to
access.
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- - -------------------------------------------------------------------------
stable/11/ r337794
releng/11.1/ r337828
releng/11.2/ r337828
- - -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
More information on L1 Terminal Fault is available at:
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3620>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3646>
<URL:https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault>
<URL:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html>
The FreeBSD Security Team thanks Intel for disclosing the issue.
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-18:09.l1tf.asc>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.2.9 (FreeBSD)
iQIzBAEBCgAdFiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAltztc8ACgkQ05eS9J6n
5cLwEhAAos2Bnilthrbd+uQr1IGASD96aZZ5iXvn1Ibls03Vtd0kG9EcU30gFVG0
HSg47qT7r5qJQUdhuSYxspgS9ZxXpRez1vnAz7cSGHL9FdecyfHWmHvGor5tz84/
CgX4jCCAZfqDBquYD+ioqiLX7p1ZTRKfHBQOHcGgMfMq8UQUsg1YriXabEqnavU6
W0h/eCGBo/Dbvl7004Gx0hKmDO2YQxt9aPWfInXWx1VOMf+wNWpcrvU6rJ4kOnL9
7BXi+c5+vwlVXDvjrTwP9X+9DDa0MJcMoy2JCyCa/0W7lQ9nADLfUiXLsTvLDo6V
6/sooFbqlO+Qz37XHlXOXaoVGZGw+NtJRcnD+w8ueP9ts02SsECoxofN8tPOzGsT
T285qAwv8D8uuBLU3dc9y+assEe3j/4Aqb1Eil6Eh1MsHypEvyN5z9+PIpbN2tWK
qqCtzgqx037Jvjo6DwjwMUd+DikObGjZyK4pwP8KIeccOIBrUAA1Xel7Xr74xuwq
LwqtcHb2MWeFD0Mw+oW9viuJKrxyu6aiQfU6FsuGVmHjtXGxi+aWyGQqed+q8FcU
w/J6fq4kmBVVqNNrAMc/bWKU3IXAj4c48H0CSiCoX4dE4waRQ+cEetKkSWVGYnXj
3QdoyPsiqo8Goo34Cn0Ipf9GWDeNVv32iz0fXtr4LtoVZKCx9oc=
=G5SD
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW3ZkOGaOgq3Tt24GAQhxSA//XRIHPLPWKQU0ebXbtySyHwa/YVdCTctr
wUKyhVWIrUkSw2TheUqTqtn5mX4DMvDBlR+Kn67pMmUM9iHBpckqstvpgaHJ9dTJ
LBSxpkeQ1sTNVhgeWYZ7ASmkwWsIy/XasRrikp/aJvRPVCuESHW1zP/Nh42qgNhv
Za3c+kMEqQ1RldO2xwHsX6Kkhau841k45wrM1REI/aWHJeENfg/4mZ5t5TFt0bf/
XaC2bsNPEUqGMQufnrV8xYHBxLaoDORqK/As/rTQU6BYr/SKHq8yZfv6CzO2QcEx
rRWHMJRXbeoUBnugGrP7Ig//1Um3+nJzsgXJAlcImD6o6fKmcIZNgPdL3tmhKzay
w7lRfyJrLjJ5PaPc+pvOmElnwzLc9Jn9QirVdHjZBGwIOCLFMXBSs3ndAdYj2Y8x
JJNAjcdz3aiOFMcfS33lC+XtmgtcP4wo85gQHqQKd1jhaX5wLL9O1DLDMjbNpBuO
RGCT94mrSNW1GpPkCnIOWVqS2Qdr2LpBfbqyv4PjGLNsWt4scS21X39xQvoDxnGU
3Zj6A7092L2+EIe+yQnNun1uagEpFmeZQGMCpnaRXEBRPBClsW4a/pIbhdhouJ+A
9eWysgyKK7XjsIz/lq30JOY5S9NDy4CsvzFupYmcLv+yPhsR8yGhfcgrhV++N0I6
CnbJEaNutFk=
=WM8Y
-----END PGP SIGNATURE-----