Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 187911 - CVE-2006-1056 FPU Information leak on i386/x86-64 on AMD CPUs
Summary: CVE-2006-1056 FPU Information leak on i386/x86-64 on AMD CPUs
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: kernel
Version: 3.0
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Jim Paradis
QA Contact: Brian Brock
Whiteboard: impact=important,source=vendorsec,rep...
Depends On:
Blocks: RHEL3U8CanFix
TreeView+ depends on / blocked
Reported: 2006-04-04 13:37 UTC by Marcel Holtmann
Modified: 2007-11-30 22:07 UTC (History)
5 users (show)

Fixed In Version: RHSA-2006-0437
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2006-07-20 14:02:36 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2006:0437 normal SHIPPED_LIVE Important: Updated kernel packages for Red Hat Enterprise Linux 3 Update 8 2006-07-20 13:11:00 UTC

Comment 3 Marcel Holtmann 2006-04-19 12:02:46 UTC
An information leak has been reported that affects the Linux kernel running on
certain AMD processors (CVE-2006-1056). This issue is due to the behavior of
FXSAVE and FXRSTOR instructions on AMD processors is different from the behavior
on Intel processors. The difference is documented in "AMD64 Architecture
Programmer's Manual Volume 5: 64-Bit Media and x87 Floating-Point Instructions
Rev 3.06". This difference was not widely known and therefore Linux kernels
assumed these instructions would have same behavior as on Intel processors.

Under specific conditions this may allow a local user to observe the x87
exception pointers of another process. Although this is a minor information
leak, if the floating point unit is being used for a cryptographic algorithm
this could potentially leak some or all of key data.

According to AMD, this will affect processors with "AuthenticAMD" in the CPUID
vendor string. This includes the 7th generation (Family=06h) and 8th generation
(Family=0Fh) of AMD processors.

This issue has been rated as having important security severity and it affects
all Red Hat Enterprise Linux 2.1, 3, and 4 versions running on AMD processors of
the 7th and 8th generation.

Comment 5 Marcel Holtmann 2006-04-19 23:10:00 UTC
Response from AMD:

Comment 6 Ernie Petrides 2006-04-22 09:04:09 UTC
A fix for this problem has just been committed to the RHEL3 U8
patch pool this evening (in kernel version 2.4.21-40.9.EL).

Comment 7 Marcel Holtmann 2006-04-29 20:41:40 UTC
The patch introduced a bug in FP exception handling:

Comment 8 Ernie Petrides 2006-05-01 18:34:59 UTC
Thanks, Marcel.  As it turns out, the patch committed to RHEL3 uses
a "C" statement to perform the test, and the compiler generated the
correct code.  Thus, no regression was caused in RHEL3.

Comment 11 Red Hat Bugzilla 2006-07-20 14:02:37 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.