Kernel Address Space Isolation Still Baking To Limit Data Leaks From Foreshadow & Co
Written by Michael Larabel in Linux Security on 14 September 2019 at 07:18 AM EDT. 8 Comments
LINUX SECURITY --
In addition to the work being led by DigitalOcean on core scheduling to make Hyper Threading safer in light of security vulnerabilities, IBM and Oracle engineers continue working on Kernel Address Space Isolation to help prevent data leaks during attacks.

Complementing the "Core Scheduling" work, Kernel Address Space Isolation was also talked about at this week's Linux Plumbers Conference in Lisbon, Portugal. The address space isolation work for the kernel was RFC'ed a few months ago as a feature to prevent leaking sensitive data during attacks like L1 Terminal Fault and MDS. The focus on this Kernel ASI is for pairing with hypervisors like KVM as well as being a generic address space isolation framework.

This ASI implementation aims to prevent guest-to-host attacks and guest-to-guest attacks via the host in a virtualized environment. But the KVM ASI support does not prevent guest-to-guest attacks and they also still recommend pinning VMs to distinct physical CPU cores, similar to the core scheduling work.

Kernel Address Space Isolation isn't ready to go into the kernel this year but the developers do have more improvements planned as well as implementing kernel local memory and still ultimately weighing "is the complexity worth the benefit?" They also have yet to assess the performance implications of Kernel ASI, but the hope is that it still performs better than disabling Hyper Threading.

More details on the Linux Kernel Address Space Isolation via this slide deck (PDF) from the joint Oracle-IBM presentation at LPC 2019.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week