CVE-2017-5753

A program that receives an array index from an untrusted caller compares it with the array’s length and branches. The processor predicts that branch, and when the attacker has trained the predictor to expect an index in range, it goes on to load from the array with an index that is out of range, before the compare is done. The load reads memory that the program never meant to expose; a second load whose address depends on that value brings a line into the cache that the attacker can find by timing.

The same applies to any conditional branch, not only to bounds checks: Linux treats every test of untrusted input on its entry paths as a possible target. Linux reports variant 1 on every processor that speculates; among x86-64 processors, it lists only the Bonnell and Saltwell Atoms as not affected.

Affected processors

61 of the 63 microarchitectures listed are affected in all or some of their models.

Mitigations

• Kernel: Linux marks the places where untrusted values index arrays or form pointers and clamps them with its nospec accessors, which keep an out-of-range index in range even while the branch is mispredicted, and puts an LFENCE barrier in the code that copies data from user space, after the check of the user pointer. The boot option nospectre_v1 turns these barriers off. Instructions: LFENCE. Source.
• Programs: Programs mitigate it the same way, with an LFENCE after the check or by clamping the index ("bounds clipping"); the vendors' guidance describes both. Instructions: LFENCE. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v1 holds one of these lines:

• Not affected
• Mitigation: usercopy/swapgs barriers and __user pointer sanitization
• Vulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers

Source.

Related CVEs

• CVE-2018-3693 Bounds Check Bypass Store
• CVE-2019-1125 Spectre v1 swapgs