Bug 1075922 (CVE-2017-13218) - VUL-0: CVE-2017-13218: kernel-source: aarch64: Access to CNTVCT_EL0 could be used for side channel attacks. This could lead tolocal information disclosure with no additional execution privileges needed.User interaction is not needed for exploitati
Summary: VUL-0: CVE-2017-13218: kernel-source: aarch64: Access to CNTVCT_EL0 could be ...
Status: RESOLVED WONTFIX
Alias: CVE-2017-13218
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: aarch64 All
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Yousaf Kaukab
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/198237/
Whiteboard: CVSSv3:SUSE:CVE-2017-13218:2.5:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-01-15 06:24 UTC by Marcus Meissner
Modified: 2020-07-02 15:46 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-01-15 06:24:15 UTC 
CVE-2017-13218

Access to CNTVCT_EL0 could be used for side channel attacks. This could lead to
local information disclosure with no additional execution privileges needed.
User interaction is not needed for exploitation. Product: Android. Versions:
Android kernel. Android ID: A-68266545.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13218
Comment 1 Marcus Meissner 2018-01-15 06:24:50 UTC 
This is an Android patch limiting access to this regisrter/ opcode CNTVCT_EL0
for high precision.

Not sure if we need to mirror this in our aarch64 kernels.
Comment 2 Alexander Graf 2018-01-15 08:13:52 UTC 
Limiting access to CNTVCT_EL0 would be roughly equivalent to limiting rdtsc on x86. We would basically prohibit user space from measuring time accurately.
Comment 3 Yousaf Kaukab 2018-02-02 16:35:47 UTC 
See comment#2