Bugzilla – Bug 1214083
VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435)
Last modified: 2024-07-16 16:30:09 UTC
+++ This bug was initially created as a clone of Bug #1206418 +++ Xen Security Advisory CVE-2022-40982 / XSA-435 x86/Intel: Gather Data Sampling ISSUE DESCRIPTION ================= A researcher has discovered Gather Data Sampling, a transient execution side-channel whereby the AVX GATHER instructions can forward the content of stale vector registers to dependent instructions. The physical register file is a structure competitively shared between sibling threads. Therefore an attacker can infer data from the sibling thread, or from a more privileged context. For more details, see: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/gather-data-sampling.html IMPACT ====== An attacker can infer data from different contexts on the same core. Examples of such data includes key material, cipher and plaintext from the AES-NI instructions, or the contents of REP-MOVS instructions, commonly used to implement memcpy(). VULNERABLE SYSTEMS ================== Systems running all versions of Xen are affected. See the Intel documentation for a list of affected processors. CPUs from other hardware vendors are not believed to be affected. MITIGATION ========== This issue can be mitigated by disabling AVX, either by booting Xen with `cpuid=no-avx` on the command line, or by specifying `cpuid="host:avx=0"` in the vm.cfg file of all untrusted VMs. However, this may come with a significant performance impact on the system and is not recommended for anyone able to deploy the microcode and patch described below. RESOLUTION ========== Intel are producing microcode updates to address the issue for most affected CPUs. Consult your dom0 OS vendor. This microcode is effective when late-loaded, which can be performed on a live system without reboot. Without microcode, disabling AVX is the only mitigation. This is implemented by the patches to Xen on hardware believed to be vulnerable. In addition, to indicate safety to guest kernels, Xen needs to synthesise new bits for guests to see, which depends on MSR_ARCH_CAPS being visible to guests. The work to support MSR_ARCH_CAPS is extensive and has been going on in public in earnest since March. The backports to security trees are more-extensive still. Therefore, we have decided to produce new releases on all stable trees. Please find fixes in the respective branches under the following release tags: RELEASE-4.17.2 RELEASE-4.16.5 RELEASE-4.15.5 RELEASE-4.14.6 Other release activities (tarballs, announcements, etc) will happen in due course.
(In reply to Carlos López from comment #0) > MITIGATION > ========== > > This issue can be mitigated by disabling AVX, either by booting Xen with > `cpuid=no-avx` on the command line, or by specifying `cpuid="host:avx=0"` > in the vm.cfg file of all untrusted VMs. However, this may come with a > significant performance impact on the system and is not recommended for > anyone able to deploy the microcode and patch described below. Just to not forget mentioning it (in case any of this is used to communicate to our customers, in particular LTSS ones): On older Xen no such "cpuid=" workaround exists. I think there xsave would need disabling altogether instead.
SUSE-SU-2023:3395-1: An update that solves three vulnerabilities and has one fix can now be installed. Category: security (moderate) Bug References: 1027519, 1213616, 1214082, 1214083 CVE References: CVE-2022-40982, CVE-2023-20569, CVE-2023-20593 Sources used: openSUSE Leap 15.4 (src): xen-4.16.5_02-150400.4.31.1 openSUSE Leap Micro 5.3 (src): xen-4.16.5_02-150400.4.31.1 openSUSE Leap Micro 5.4 (src): xen-4.16.5_02-150400.4.31.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): xen-4.16.5_02-150400.4.31.1 SUSE Linux Enterprise Micro 5.3 (src): xen-4.16.5_02-150400.4.31.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): xen-4.16.5_02-150400.4.31.1 SUSE Linux Enterprise Micro 5.4 (src): xen-4.16.5_02-150400.4.31.1 Basesystem Module 15-SP4 (src): xen-4.16.5_02-150400.4.31.1 Server Applications Module 15-SP4 (src): xen-4.16.5_02-150400.4.31.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3447-1: An update that solves three vulnerabilities and has two fixes can now be installed. Category: security (moderate) Bug References: 1027519, 1212684, 1213616, 1214082, 1214083 CVE References: CVE-2022-40982, CVE-2023-20569, CVE-2023-20593 Sources used: Server Applications Module 15-SP5 (src): xen-4.17.2_02-150500.3.6.1 openSUSE Leap 15.5 (src): xen-4.17.2_02-150500.3.6.1 Basesystem Module 15-SP5 (src): xen-4.17.2_02-150500.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3446-1: An update that solves three vulnerabilities and has two fixes can now be installed. Category: security (moderate) Bug References: 1027519, 1204489, 1213616, 1214082, 1214083 CVE References: CVE-2022-40982, CVE-2023-20569, CVE-2023-20593 Sources used: SUSE Manager Proxy 4.2 (src): xen-4.14.6_02-150300.3.51.1 SUSE Manager Retail Branch Server 4.2 (src): xen-4.14.6_02-150300.3.51.1 SUSE Manager Server 4.2 (src): xen-4.14.6_02-150300.3.51.1 SUSE Linux Enterprise Micro 5.1 (src): xen-4.14.6_02-150300.3.51.1 SUSE Linux Enterprise Micro 5.2 (src): xen-4.14.6_02-150300.3.51.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): xen-4.14.6_02-150300.3.51.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3496-1: An update that solves three vulnerabilities and has one fix can now be installed. Category: security (important) Bug References: 1027519, 1213616, 1214082, 1214083 CVE References: CVE-2022-40982, CVE-2023-20569, CVE-2023-20593 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xen-4.13.5_02-150200.3.74.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xen-4.13.5_02-150200.3.74.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xen-4.13.5_02-150200.3.74.1 SUSE Enterprise Storage 7 (src): xen-4.13.5_02-150200.3.74.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3495-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1213616, 1214082, 1214083 CVE References: CVE-2022-40982, CVE-2023-20569, CVE-2023-20593 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): xen-4.12.4_36-3.91.2 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): xen-4.12.4_36-3.91.2 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): xen-4.12.4_36-3.91.2 SUSE Linux Enterprise Server 12 SP5 (src): xen-4.12.4_36-3.91.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3494-1: An update that solves three vulnerabilities can now be installed. Category: security (important) Bug References: 1213616, 1214082, 1214083 CVE References: CVE-2022-40982, CVE-2023-20569, CVE-2023-20593 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): xen-4.12.4_36-150100.3.89.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): xen-4.12.4_36-150100.3.89.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): xen-4.12.4_36-150100.3.89.1 SUSE CaaS Platform 4.0 (src): xen-4.12.4_36-150100.3.89.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3895-1: An update that solves four vulnerabilities can now be installed. Category: security (important) Bug References: 1213616, 1214083, 1215145, 1215474 CVE References: CVE-2022-40982, CVE-2023-20588, CVE-2023-20593, CVE-2023-34322 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xen-4.13.5_04-150200.3.77.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xen-4.13.5_04-150200.3.77.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xen-4.13.5_04-150200.3.77.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3894-1: An update that solves four vulnerabilities can now be installed. Category: security (important) Bug References: 1213616, 1214083, 1215145, 1215474 CVE References: CVE-2022-40982, CVE-2023-20588, CVE-2023-20593, CVE-2023-34322 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): xen-4.12.4_38-3.94.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): xen-4.12.4_38-3.94.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): xen-4.12.4_38-3.94.1 SUSE Linux Enterprise Server 12 SP5 (src): xen-4.12.4_38-3.94.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3902-1: An update that solves four vulnerabilities can now be installed. Category: security (important) Bug References: 1213616, 1214083, 1215145, 1215474 CVE References: CVE-2022-40982, CVE-2023-20588, CVE-2023-20593, CVE-2023-34322 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): xen-4.12.4_38-150100.3.92.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): xen-4.12.4_38-150100.3.92.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): xen-4.12.4_38-150100.3.92.1 SUSE CaaS Platform 4.0 (src): xen-4.12.4_38-150100.3.92.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Submission done.
done, closing
SUSE-SU-2024:2535-1: An update that solves six vulnerabilities and has one security fix can now be installed. Category: security (important) Bug References: 1214083, 1221332, 1221334, 1221984, 1222302, 1222453, 1227355 CVE References: CVE-2023-28746, CVE-2023-46842, CVE-2024-2193, CVE-2024-2201, CVE-2024-31142, CVE-2024-31143 Maintenance Incident: [SUSE:Maintenance:33138](https://smelt.suse.de/incident/33138/) Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xen-4.13.5_12-150200.3.93.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xen-4.13.5_12-150200.3.93.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xen-4.13.5_12-150200.3.93.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.