[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <3b58a85a-ecda-4d22-8794-f81db4d2c6aa@intel.com>
Date: Tue, 14 Nov 2023 11:24:30 -0800
From: Antonio Gomez Iglesias <antonio.gomez.iglesias@...el.com>
To: HW42 <hw42@...umj.de>, <oss-security@...ts.openwall.com>, Solar Designer
<solar@...nwall.com>
CC: Tavis Ormandy <taviso@...il.com>
Subject: Re: CVE-2023-23583: Intel - Denial of Service -
Privilege Escalation (Reptar)
On 11/14/23 11:19 AM, HW42 wrote:
> Solar Designer:
>> On Tue, Nov 14, 2023 at 10:31:51AM -0800, Antonio Gomez Iglesias wrote:
>>> Name of the issue: Redundant Prefix Issue
>>>
>>> Description of the issue
>>> Under certain microarchitectural conditions, Intel has identified cases
>>> where execution of an instruction (REP MOVSB) encoded with a redundant
>>> REX prefix may result in unpredictable system behavior resulting in a
>>> system crash/hang, or, in some limited scenarios, may allow escalation
>>> of privilege from CPL3 to CPL0.
>>> This Redundant Prefix Issue is assigned CVE-2023-23583 with a CVSS Base
>>> Score of 8.8 High CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
>>>
>>> Mitigation
>>> Intel is providing a microcode update to mitigate this issue: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20231114
>> Thank you, Antonio!
>>
>> Here's a writeup and reproducer tool by Tavis Ormandy:
>>
>> https://lock.cmpxchg8b.com/reptar.html
>>
>> The GitHub release page above links to Intel security advisory:
>>
>> https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html
>>
>> which specifies what CPU generations are affected (from 10th generation
>> Intel Core or 3rd generation Xeon Scalable to current), and links to a
>> table with "an exhaustive list of processors" matched against this issue
>> and previously disclosed issues:
>>
>> https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
>>
>> It also says "Please refer to the technical paper here for additional
>> information", where "here" is a link supposedly to "the technical
>> paper", but it's a non-existent page currently, so I'm not posting the
>> URL yet (not sure if it'll stay the same when the page is published).
> I think that link should point to
>
> https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/redundant-prefix-issue.html
>
> This one can be found in the affected processors table.
The SA
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html
should now link to the correct page. Thanks for the feedback!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
