1 .. SPDX-License-Identifier: GPL-2.0 1 .. SPDX-License-Identifier: GPL-2.0
2 2
3 TAA - TSX Asynchronous Abort 3 TAA - TSX Asynchronous Abort
4 ====================================== 4 ======================================
5 5
6 TAA is a hardware vulnerability that allows un 6 TAA is a hardware vulnerability that allows unprivileged speculative access to
7 data which is available in various CPU interna 7 data which is available in various CPU internal buffers by using asynchronous
8 aborts within an Intel TSX transactional regio 8 aborts within an Intel TSX transactional region.
9 9
10 Affected processors 10 Affected processors
11 ------------------- 11 -------------------
12 12
13 This vulnerability only affects Intel processo 13 This vulnerability only affects Intel processors that support Intel
14 Transactional Synchronization Extensions (TSX) 14 Transactional Synchronization Extensions (TSX) when the TAA_NO bit (bit 8)
15 is 0 in the IA32_ARCH_CAPABILITIES MSR. On pr 15 is 0 in the IA32_ARCH_CAPABILITIES MSR. On processors where the MDS_NO bit
16 (bit 5) is 0 in the IA32_ARCH_CAPABILITIES MSR 16 (bit 5) is 0 in the IA32_ARCH_CAPABILITIES MSR, the existing MDS mitigations
17 also mitigate against TAA. 17 also mitigate against TAA.
18 18
19 Whether a processor is affected or not can be 19 Whether a processor is affected or not can be read out from the TAA
20 vulnerability file in sysfs. See :ref:`tsx_asy 20 vulnerability file in sysfs. See :ref:`tsx_async_abort_sys_info`.
21 21
22 Related CVEs 22 Related CVEs
23 ------------ 23 ------------
24 24
25 The following CVE entry is related to this TAA 25 The following CVE entry is related to this TAA issue:
26 26
27 ============== ===== ==================== 27 ============== ===== ===================================================
28 CVE-2019-11135 TAA TSX Asynchronous Abo 28 CVE-2019-11135 TAA TSX Asynchronous Abort (TAA) condition on some
29 microprocessors util 29 microprocessors utilizing speculative execution may
30 allow an authenticat 30 allow an authenticated user to potentially enable
31 information disclosu 31 information disclosure via a side channel with
32 local access. 32 local access.
33 ============== ===== ==================== 33 ============== ===== ===================================================
34 34
35 Problem 35 Problem
36 ------- 36 -------
37 37
38 When performing store, load or L1 refill opera 38 When performing store, load or L1 refill operations, processors write
39 data into temporary microarchitectural structu 39 data into temporary microarchitectural structures (buffers). The data in
40 those buffers can be forwarded to load operati 40 those buffers can be forwarded to load operations as an optimization.
41 41
42 Intel TSX is an extension to the x86 instructi 42 Intel TSX is an extension to the x86 instruction set architecture that adds
43 hardware transactional memory support to impro 43 hardware transactional memory support to improve performance of multi-threaded
44 software. TSX lets the processor expose and ex 44 software. TSX lets the processor expose and exploit concurrency hidden in an
45 application due to dynamically avoiding unnece 45 application due to dynamically avoiding unnecessary synchronization.
46 46
47 TSX supports atomic memory transactions that a 47 TSX supports atomic memory transactions that are either committed (success) or
48 aborted. During an abort, operations that happ 48 aborted. During an abort, operations that happened within the transactional region
49 are rolled back. An asynchronous abort takes p 49 are rolled back. An asynchronous abort takes place, among other options, when a
50 different thread accesses a cache line that is 50 different thread accesses a cache line that is also used within the transactional
51 region when that access might lead to a data r 51 region when that access might lead to a data race.
52 52
53 Immediately after an uncompleted asynchronous 53 Immediately after an uncompleted asynchronous abort, certain speculatively
54 executed loads may read data from those intern 54 executed loads may read data from those internal buffers and pass it to dependent
55 operations. This can be then used to infer the 55 operations. This can be then used to infer the value via a cache side channel
56 attack. 56 attack.
57 57
58 Because the buffers are potentially shared bet 58 Because the buffers are potentially shared between Hyper-Threads cross
59 Hyper-Thread attacks are possible. 59 Hyper-Thread attacks are possible.
60 60
61 The victim of a malicious actor does not need 61 The victim of a malicious actor does not need to make use of TSX. Only the
62 attacker needs to begin a TSX transaction and 62 attacker needs to begin a TSX transaction and raise an asynchronous abort
63 which in turn potentially leaks data stored in 63 which in turn potentially leaks data stored in the buffers.
64 64
65 More detailed technical information is availab 65 More detailed technical information is available in the TAA specific x86
66 architecture section: :ref:`Documentation/arch 66 architecture section: :ref:`Documentation/arch/x86/tsx_async_abort.rst <tsx_async_abort>`.
67 67
68 68
69 Attack scenarios 69 Attack scenarios
70 ---------------- 70 ----------------
71 71
72 Attacks against the TAA vulnerability can be i 72 Attacks against the TAA vulnerability can be implemented from unprivileged
73 applications running on hosts or guests. 73 applications running on hosts or guests.
74 74
75 As for MDS, the attacker has no control over t 75 As for MDS, the attacker has no control over the memory addresses that can
76 be leaked. Only the victim is responsible for 76 be leaked. Only the victim is responsible for bringing data to the CPU. As
77 a result, the malicious actor has to sample as 77 a result, the malicious actor has to sample as much data as possible and
78 then postprocess it to try to infer any useful 78 then postprocess it to try to infer any useful information from it.
79 79
80 A potential attacker only has read access to t 80 A potential attacker only has read access to the data. Also, there is no direct
81 privilege escalation by using this technique. 81 privilege escalation by using this technique.
82 82
83 83
84 .. _tsx_async_abort_sys_info: 84 .. _tsx_async_abort_sys_info:
85 85
86 TAA system information 86 TAA system information
87 ----------------------- 87 -----------------------
88 88
89 The Linux kernel provides a sysfs interface to 89 The Linux kernel provides a sysfs interface to enumerate the current TAA status
90 of mitigated systems. The relevant sysfs file 90 of mitigated systems. The relevant sysfs file is:
91 91
92 /sys/devices/system/cpu/vulnerabilities/tsx_as 92 /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
93 93
94 The possible values in this file are: 94 The possible values in this file are:
95 95
96 .. list-table:: 96 .. list-table::
97 97
98 * - 'Vulnerable' 98 * - 'Vulnerable'
99 - The CPU is affected by this vulnerabili 99 - The CPU is affected by this vulnerability and the microcode and kernel mitigation are not applied.
100 * - 'Vulnerable: Clear CPU buffers attempte 100 * - 'Vulnerable: Clear CPU buffers attempted, no microcode'
101 - The processor is vulnerable but microco 101 - The processor is vulnerable but microcode is not updated. The
102 mitigation is enabled on a best effort 102 mitigation is enabled on a best effort basis.
103 103
104 If the processor is vulnerable but the 104 If the processor is vulnerable but the availability of the microcode
105 based mitigation mechanism is not adver 105 based mitigation mechanism is not advertised via CPUID, the kernel
106 selects a best effort mitigation mode. 106 selects a best effort mitigation mode. This mode invokes the mitigation
107 instructions without a guarantee that t 107 instructions without a guarantee that they clear the CPU buffers.
108 108
109 This is done to address virtualization 109 This is done to address virtualization scenarios where the host has the
110 microcode update applied, but the hyper 110 microcode update applied, but the hypervisor is not yet updated to
111 expose the CPUID to the guest. If the h 111 expose the CPUID to the guest. If the host has updated microcode the
112 protection takes effect; otherwise a fe 112 protection takes effect; otherwise a few CPU cycles are wasted
113 pointlessly. 113 pointlessly.
114 * - 'Mitigation: Clear CPU buffers' 114 * - 'Mitigation: Clear CPU buffers'
115 - The microcode has been updated to clear 115 - The microcode has been updated to clear the buffers. TSX is still enabled.
116 * - 'Mitigation: TSX disabled' 116 * - 'Mitigation: TSX disabled'
117 - TSX is disabled. 117 - TSX is disabled.
118 * - 'Not affected' 118 * - 'Not affected'
119 - The CPU is not affected by this issue. 119 - The CPU is not affected by this issue.
120 120
121 Mitigation mechanism 121 Mitigation mechanism
122 -------------------- 122 --------------------
123 123
124 The kernel detects the affected CPUs and the p 124 The kernel detects the affected CPUs and the presence of the microcode which is
125 required. If a CPU is affected and the microco 125 required. If a CPU is affected and the microcode is available, then the kernel
126 enables the mitigation by default. 126 enables the mitigation by default.
127 127
128 128
129 The mitigation can be controlled at boot time 129 The mitigation can be controlled at boot time via a kernel command line option.
130 See :ref:`taa_mitigation_control_command_line` 130 See :ref:`taa_mitigation_control_command_line`.
131 131
132 Virtualization mitigation 132 Virtualization mitigation
133 ^^^^^^^^^^^^^^^^^^^^^^^^^ 133 ^^^^^^^^^^^^^^^^^^^^^^^^^
134 134
135 Affected systems where the host has TAA microc 135 Affected systems where the host has TAA microcode and TAA is mitigated by
136 having disabled TSX previously, are not vulner 136 having disabled TSX previously, are not vulnerable regardless of the status
137 of the VMs. 137 of the VMs.
138 138
139 In all other cases, if the host either does no 139 In all other cases, if the host either does not have the TAA microcode or
140 the kernel is not mitigated, the system might 140 the kernel is not mitigated, the system might be vulnerable.
141 141
142 142
143 .. _taa_mitigation_control_command_line: 143 .. _taa_mitigation_control_command_line:
144 144
145 Mitigation control on the kernel command line 145 Mitigation control on the kernel command line
146 --------------------------------------------- 146 ---------------------------------------------
147 147
148 The kernel command line allows to control the 148 The kernel command line allows to control the TAA mitigations at boot time with
149 the option "tsx_async_abort=". The valid argum 149 the option "tsx_async_abort=". The valid arguments for this option are:
150 150
151 ============ ============================== 151 ============ =============================================================
152 off This option disables the TAA m 152 off This option disables the TAA mitigation on affected platforms.
153 If the system has TSX enabled 153 If the system has TSX enabled (see next parameter) and the CPU
154 is affected, the system is vul 154 is affected, the system is vulnerable.
155 155
156 full TAA mitigation is enabled. If 156 full TAA mitigation is enabled. If TSX is enabled, on an affected
157 system it will clear CPU buffe 157 system it will clear CPU buffers on ring transitions. On
158 systems which are MDS-affected 158 systems which are MDS-affected and deploy MDS mitigation,
159 TAA is also mitigated. Specify 159 TAA is also mitigated. Specifying this option on those
160 systems will have no effect. 160 systems will have no effect.
161 161
162 full,nosmt The same as tsx_async_abort=fu 162 full,nosmt The same as tsx_async_abort=full, with SMT disabled on
163 vulnerable CPUs that have TSX 163 vulnerable CPUs that have TSX enabled. This is the complete
164 mitigation. When TSX is disabl 164 mitigation. When TSX is disabled, SMT is not disabled because
165 CPU is not vulnerable to cross 165 CPU is not vulnerable to cross-thread TAA attacks.
166 ============ ============================== 166 ============ =============================================================
167 167
168 Not specifying this option is equivalent to "t 168 Not specifying this option is equivalent to "tsx_async_abort=full". For
169 processors that are affected by both TAA and M 169 processors that are affected by both TAA and MDS, specifying just
170 "tsx_async_abort=off" without an accompanying 170 "tsx_async_abort=off" without an accompanying "mds=off" will have no
171 effect as the same mitigation is used for both 171 effect as the same mitigation is used for both vulnerabilities.
172 172
173 The kernel command line also allows to control 173 The kernel command line also allows to control the TSX feature using the
174 parameter "tsx=" on CPUs which support TSX con 174 parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used
175 to control the TSX feature and the enumeration 175 to control the TSX feature and the enumeration of the TSX feature bits (RTM
176 and HLE) in CPUID. 176 and HLE) in CPUID.
177 177
178 The valid options are: 178 The valid options are:
179 179
180 ============ ============================== 180 ============ =============================================================
181 off Disables TSX on the system. 181 off Disables TSX on the system.
182 182
183 Note that this option takes ef 183 Note that this option takes effect only on newer CPUs which are
184 not vulnerable to MDS, i.e., h 184 not vulnerable to MDS, i.e., have MSR_IA32_ARCH_CAPABILITIES.MDS_NO=1
185 and which get the new IA32_TSX 185 and which get the new IA32_TSX_CTRL MSR through a microcode
186 update. This new MSR allows fo 186 update. This new MSR allows for the reliable deactivation of
187 the TSX functionality. 187 the TSX functionality.
188 188
189 on Enables TSX. 189 on Enables TSX.
190 190
191 Although there are mitigations 191 Although there are mitigations for all known security
192 vulnerabilities, TSX has been 192 vulnerabilities, TSX has been known to be an accelerator for
193 several previous speculation-r 193 several previous speculation-related CVEs, and so there may be
194 unknown security risks associa 194 unknown security risks associated with leaving it enabled.
195 195
196 auto Disables TSX if X86_BUG_TAA is 196 auto Disables TSX if X86_BUG_TAA is present, otherwise enables TSX
197 on the system. 197 on the system.
198 ============ ============================== 198 ============ =============================================================
199 199
200 Not specifying this option is equivalent to "t 200 Not specifying this option is equivalent to "tsx=off".
201 201
202 The following combinations of the "tsx_async_a 202 The following combinations of the "tsx_async_abort" and "tsx" are possible. For
203 affected platforms tsx=auto is equivalent to t 203 affected platforms tsx=auto is equivalent to tsx=off and the result will be:
204 204
205 ========= ========================== ==== 205 ========= ========================== =========================================
206 tsx=on tsx_async_abort=full The 206 tsx=on tsx_async_abort=full The system will use VERW to clear CPU
207 buff 207 buffers. Cross-thread attacks are still
208 poss 208 possible on SMT machines.
209 tsx=on tsx_async_abort=full,nosmt As a 209 tsx=on tsx_async_abort=full,nosmt As above, cross-thread attacks on SMT
210 miti 210 mitigated.
211 tsx=on tsx_async_abort=off The 211 tsx=on tsx_async_abort=off The system is vulnerable.
212 tsx=off tsx_async_abort=full TSX 212 tsx=off tsx_async_abort=full TSX might be disabled if microcode
213 prov 213 provides a TSX control MSR. If so,
214 syst 214 system is not vulnerable.
215 tsx=off tsx_async_abort=full,nosmt Ditt 215 tsx=off tsx_async_abort=full,nosmt Ditto
216 tsx=off tsx_async_abort=off ditt 216 tsx=off tsx_async_abort=off ditto
217 ========= ========================== ==== 217 ========= ========================== =========================================
218 218
219 219
220 For unaffected platforms "tsx=on" and "tsx_asy 220 For unaffected platforms "tsx=on" and "tsx_async_abort=full" does not clear CPU
221 buffers. For platforms without TSX control (M 221 buffers. For platforms without TSX control (MSR_IA32_ARCH_CAPABILITIES.MDS_NO=0)
222 "tsx" command line argument has no effect. 222 "tsx" command line argument has no effect.
223 223
224 For the affected platforms below table indicat 224 For the affected platforms below table indicates the mitigation status for the
225 combinations of CPUID bit MD_CLEAR and IA32_AR 225 combinations of CPUID bit MD_CLEAR and IA32_ARCH_CAPABILITIES MSR bits MDS_NO
226 and TSX_CTRL_MSR. 226 and TSX_CTRL_MSR.
227 227
228 ======= ========= ============= ========= 228 ======= ========= ============= ========================================
229 MDS_NO MD_CLEAR TSX_CTRL_MSR Status 229 MDS_NO MD_CLEAR TSX_CTRL_MSR Status
230 ======= ========= ============= ========= 230 ======= ========= ============= ========================================
231 0 0 0 Vulnerabl 231 0 0 0 Vulnerable (needs microcode)
232 0 1 0 MDS and T 232 0 1 0 MDS and TAA mitigated via VERW
233 1 1 0 MDS fixed 233 1 1 0 MDS fixed, TAA vulnerable if TSX enabled
234 because M 234 because MD_CLEAR has no meaning and
235 VERW is n 235 VERW is not guaranteed to clear buffers
236 1 X 1 MDS fixed 236 1 X 1 MDS fixed, TAA can be mitigated by
237 VERW or T 237 VERW or TSX_CTRL_MSR
238 ======= ========= ============= ========= 238 ======= ========= ============= ========================================
239 239
240 Mitigation selection guide 240 Mitigation selection guide
241 -------------------------- 241 --------------------------
242 242
243 1. Trusted userspace and guests 243 1. Trusted userspace and guests
244 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 244 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
245 245
246 If all user space applications are from a trus 246 If all user space applications are from a trusted source and do not execute
247 untrusted code which is supplied externally, t 247 untrusted code which is supplied externally, then the mitigation can be
248 disabled. The same applies to virtualized envi 248 disabled. The same applies to virtualized environments with trusted guests.
249 249
250 250
251 2. Untrusted userspace and guests 251 2. Untrusted userspace and guests
252 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 252 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
253 253
254 If there are untrusted applications or guests 254 If there are untrusted applications or guests on the system, enabling TSX
255 might allow a malicious actor to leak data fro 255 might allow a malicious actor to leak data from the host or from other
256 processes running on the same physical core. 256 processes running on the same physical core.
257 257
258 If the microcode is available and the TSX is d 258 If the microcode is available and the TSX is disabled on the host, attacks
259 are prevented in a virtualized environment as 259 are prevented in a virtualized environment as well, even if the VMs do not
260 explicitly enable the mitigation. 260 explicitly enable the mitigation.
261 261
262 262
263 .. _taa_default_mitigations: 263 .. _taa_default_mitigations:
264 264
265 Default mitigations 265 Default mitigations
266 ------------------- 266 -------------------
267 267
268 The kernel's default action for vulnerable pro 268 The kernel's default action for vulnerable processors is:
269 269
270 - Deploy TSX disable mitigation (tsx_async_a 270 - Deploy TSX disable mitigation (tsx_async_abort=full tsx=off).
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.