openssh unix dev - Feb 2018 - add Spectre variant 2 mitigations

Hi.

Both GCC and clang are adding mitigations for Spectre variant 2 although
neither have yet made a release and neither are on by default.

After trolling through and building release candidate branches for both
I believe this is what is required for the ssh programs (although all
the dependent libraries will also need to be built with mitigations, and
I suspect libcrypto is a more likely target).

Anyway we've got to start somewhere and this builds and passes regress on
x86_64 with gcc 7.2.1 20171218 and clang 6.0 branch.  Happy to get
feedback about other compilers.

diff --git a/configure.ac b/configure.ac
index c14f484b..89e6975c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -163,6 +163,10 @@ if test "$GCC" = "yes" || test
"$GCC" = "egcs"; then
 	OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
 	OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
     if test "x$use_toolchain_hardening" = "x1"; then
+	OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
+	OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
+	OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
+	OSSH_CHECK_CFLAG_LINK([-z retpolineplt]) # clang
 	OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
 	OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
 	OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

On 06/02/18 09:29, Darren Tucker wrote:
> Both GCC and clang are adding mitigations for Spectre variant 2 although
> neither have yet made a release and neither are on by default.
>
> After trolling through and building release candidate branches for both
> I believe this is what is required for the ssh programs
Do we need to do anything?? It's not clear to me how SSH is vulnerable 
to Spectre -- that is, how SSH can be used to execute a Spectre attack?? 
Browsers are vulnerable because they can be made to load and run 
abitrary JS programs.? Although SSH can be used to execute arbitrary 
programs, they don't run within the SSH processes.? Do we truly need to 
do anything?

On 6 February 2018 at 20:09, David Newall <openssh at davidnewall.com>
wrote:
> Do we need to do anything?  It's not clear to me how SSH is vulnerable
to
> Spectre -- that is, how SSH can be used to execute a Spectre attack?
I am more concerned with it being the target of a Spectre style
attack.  There's some long lived private data (host keys in the case
of sshd, session keys in the case of ssh and sshd and user keys in the
case of ssh-agent) and there's some scope to manipulate their
behaviour through external stimuli.

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.