QSB-081: x86: MMIO Stale Data vulnerabilities (XSA-404) www.qubes-os.org/news/20…/qsb-081 We have just published Qubes Security Bulletin (QSB) 081: x86: MMIO Stale Data vulnerabilities (XSA-404). The text of this QSB is reproduced below. This QSB and its accompanying signatures will always be available in the Qubes Security Pack (qubes-secpack). View QSB-081 in the qubes-secpack: github.com/QubesOS…2022.txt In addition, you may wish to: Get the qubes-secpack: https://www.qubes-os.org/security/pack/ View all past QSBs: https://www.qubes-os.org/security/qsb/ View the XSA Tracker: https://www.qubes-os.org/security/xsa/ ---===[ Qubes Security Bulletin 081 ]===--- 2022-06-17 x86: MMIO Stale Data vulnerabilities (XSA-404) User action required --------------------- Users with appropriate hardware (see the "affected hardware" section below) must install the following specific packages in order to address the issues discussed in this bulletin: For Qubes 4.0, in dom0: - Xen packages, version 4.8.5-41 For Qubes 4.1, in dom0: - Xen packages, version 4.14.5-3 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community. [1] Once available, the packages are to be installed via the Qubes Update tool or its command-line equivalents. [2] Dom0 must be restarted afterward in order for the updates to take effect. If you use Anti Evil Maid, you will need to reseal your secret passphrase to new PCR values, as PCR18+19 will change due to the new Xen binaries. Summary -------- On 2022-06-14, the Xen Project published XSA-404, "x86: MMIO Stale Data vulnerabilities" [3]: | This issue is related to the SRBDS, TAA and MDS vulnerabilities. | Please see: | | https://xenbits.xen.org/xsa/advisory-320.html (SRBDS) | https://xenbits.xen.org/xsa/advisory-305.html (TAA) | https://xenbits.xen.org/xsa/advisory-297.html (MDS) | | Please see Intel's whitepaper: | | www.intel.com/content…ies.html Impact ------- An adversary who controls a VM with an assigned PCI device can infer the memory content of other guests or Xen itself. This could allow the adversary to read information that should be accessible only to Xen or another VM and to use that information to launch further attacks. In the default Qubes OS configuration, only sys-net and sys-usb can be used to perform this attack. Affected hardware ------------------ All Intel systems are affected. While mitigations are available, they are available only for some Intel CPU models. Normally, it should be a simple matter to look up a given CPU model number in a table to see whether it is affected and whether it is eligible for any mitigations. Indeed, Intel has published a table [4] that claims to serve this purpose. Unfortunately, however, we have found several inaccuracies in this table. Since we cannot rely on the table, we have had to devise an alternative method using other published Intel technical documents that appear to be more accurate. This has turned out to be quite complex. Our best evidence indicates that mitigations are available for all and only those CPUs that are both eligible for and updated with the Intel microcode update released in May 2022. [5] Since going through all the complicated technical steps of checking this manually would be excessively cumbersome for most users, we have written a tool that does it for you. Please note that this tool is entirely optional and is *not* required for any security updates to take effect. Rather, its intended purpose is to satisfy the curiosity of users who wish to know whether their own CPUs are eligible for mitigations and who would struggle to