diff options
| author |   guenther <guenther@openbsd.org> | 2020-03-11 07:27:08 +0000 |
|---|---|---|
| committer | guenther <guenther@openbsd.org> | 2020-03-11 07:27:08 +0000 |
| commit | 67ca69ecacf46c8d970d09c75497d3681d2aa2b8 (patch) | |
| tree | 3f65a018d29966bfa55ee56789628a85df164053 /lib/libc | |
| parent | properly limit indexing into the aggr_periodic_times array. (diff) | |
| download | wireguard-openbsd-67ca69ecacf46c8d970d09c75497d3681d2aa2b8.tar.xz wireguard-openbsd-67ca69ecacf46c8d970d09c75497d3681d2aa2b8.zip | |
Take a swing at blocking Load-Value-Injection attacks against the
kernel by using lfence in place of stac/clac on pre-SMAP CPUs.
To quote from https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection
"If the OS makes use of Supervisor Mode Access Prevention (SMAP)
on processors with SMAP enabled, then LVI on kernel load from
user pages will be mitigated. This is because the CLAC and STAC
instructions have LFENCE semantics on processors affected by LVI,
and this serves as a speculation fence around kernel loads from
user pages."
ok deraadt@
Diffstat (limited to 'lib/libc')
0 files changed, 0 insertions, 0 deletions