Linux RNG Improvements Aim For Better VM Security
The new patch series by Jason Donenfeld is about ensuring the same stream of random numbers isn't produced if forking/cloning a VM and/or rolling back that VM. Obviously if two VMs or a rolled back VM is able to produce the same random numbers that would have "catastrophic cryptographic consequences" and so this new kernel code better fends off such a situation.
The new patch work revives work originally started by Amazon/AWS engineers but then stalled some time ago. The code is listening for VMGENID ACPI notifications and then having the RNG reinitialize safely. The VMGENID is short for VM Generation ID and is actually a specification started by Microsoft but beyond Hyper-V is also supported now by QEMU. For handling the VMGENID ACPI notifications, a new "vmgenid" virt driver is introduced. VMGENID is summed up as:
If the OS is running in a VM, there is a problem that most hypervisors can snapshot the state of the machine and later rewind the VM state to the saved state. This results in the machine running a second time with the exact same RNG state, which leads to serious security problems. To reduce the window of vulnerability, Windows 10 on a Hyper-V VM will detect when the VM state is reset, retrieve a unique (not random) value from the hypervisor, and reseed the root RNG with that unique value. This does not eliminate the vulnerability, but it greatly reduces the time during which the RNG system will produce the same outputs as it did during a previous instantiation of the same VM state.
More details on this pending Linux RNG improvement via this patch series. If all goes well this and the other recent RNG improvements will be found in Linux 5.18.
5 Comments
