On 05/03/2016 02:31 PM, Andy Lutomirski wrote: > Having actually read the erratum: how can this affect Linux at all > under any scenario where user code hasn't already completely > compromised the kernel? > > I.e. why do we care about this erratum?
First of all, with SMEP, it doesn't affect us. At all. Without SMEP, there would have to be a page accessible to userspace that the kernel executes instructions from. The only thing that I can think of that's normally user-accessible and not _controlled_ by userspace is the VDSO. But the kernel never actually executes from it, so it doesn't matter here. I've heard reports of (but no actual cases in the wild of) folks remapping kernel text to be user-accessible so that userspace can execute it, or of having the kernel jump into user-provided libraries. Those are both obviously bonkers and would only be done with out-of-tree gunk, but even if somebody did that, they would be safe from the erratum, with this workaround.
