Sequence of Processor Instructions Leads to Unexpected Behavior

Opis

Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.

If the instruction set architecture (ISA) and processor logic are not designed carefully and tested thoroughly, certain combinations of instructions may lead to locking the processor or other unexpected and undesirable behavior. Upon encountering unimplemented instruction opcodes or illegal instruction operands, the processor should throw an exception and carry on without negatively impacting security. However, specific combinations of legal and illegal instructions may cause unexpected behavior with security implications such as allowing unprivileged programs to completely lock the CPU.

Skutki

• Integrity, Availability

  Varies by Context

Zapobieganie

• Testing

  Implement a rigorous testing strategy that incorporates randomization to explore instruction sequences that are unlikely to appear in normal workloads in order to identify halt and catch fire instruction sequences.

• Patching and Maintenance

  Patch operating system to avoid running Halt and Catch Fire type sequences or to mitigate the damage caused by unexpected behavior. See [REF-1108].

Przykłady podatności

• CVE-2021-26339 A bug in AMD CPU's core logic allows a potential DoS by using a specific x86 instruction sequence to hang the processor
• CVE-1999-1476 A bug in some Intel Pentium processors allow DoS (hang) via an invalid "CMPXCHG8B" instruction, causing a deadlock

Słabość nadrzędna

• CWE-691 Insufficient Control Flow Management

Kiedy powstaje

• Architecture and Design — Unexpected behavior from certain instruction combinations can arise from bugs in the ISA
• Implementation — Unexpected behavior from certain instruction combinations can arise because of implementation details such as speculative execution, caching etc.

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Not Technology-Specific, Processor Hardware

Źródła

1. Breaking the x86 ISA — Christopher Domas
2. Deep Dive: Retpoline: A Branch Target Injection Mitigation — Intel Corporation
3. Cyrix coma bug — Wikipedia, 2006
4. Undocumented M6800 Instructions — Gary Wheeler, 1977
5. The Pentium F00F Bug — Robert R. Collins, 1998
6. Hackatdac19 commit_stage.sv — 2019
7. commit_stage.sv — Florian Zaruba, Michael Schaffner, Stefan Mach, Andreas Traber, 2018