Intel Corporation information about two new vulnerabilities in Intel CPUs caused by data leakage from the L1D cache (, L1DES — L1D Eviction Sampling) and vector registers (, VRS — Vector Register Sampling). The vulnerabilities belong to the class (Microarchitectural Data Sampling) and are based on the use of side-channel analysis methods on data in microarchitectural structures. AMD, ARM, and other processors are not affected by these issues.
The most dangerous vulnerability is L1DES, which the accumulation of cached data blocks (cache line) being evicted from the level 1 cache (L1D) into the fill buffer, which at this stage should be empty. To identify the data that has settled in the fill buffer, side-channel analysis methods previously proposed in attacks are applicable (Microarchitectural Data Sampling) and (Transactional Asynchronous Abort). The essence of the previously implemented defense against
MDS and TAA is to clear microarchitectural buffers before context switching, but it turns out that under certain conditions, data can be speculatively flushed into buffers after cleanup operations; thus, MDS and TAA methods remain applicable.
As a result, an attacker can determine the data evicted from the level 1 cache that was modified during the execution of an application that previously occupied the current CPU core, or applications running concurrently in other logical threads (hyperthreads) on the same CPU core (disabling HyperThreading negates the effectiveness of the attack). Unlike the attack , L1DES does not allow choosing specific physical addresses for verification, but it does enable passive tracking of activity in other logical threads related to loading or storing values in memory.
Based on L1DES, various research teams have developed several attack vectors that potentially allow sensitive information to be extracted from other processes, the operating system, virtual machines, and protected SGX enclaves.
- The VUSec team the RIDL attack method for the L1DES vulnerability. A prototype exploit is available. , which also bypasses the proposed Intel method of protection against MDS, based on using the VERW instruction to clear the contents of microarchitectural buffers when returning from the kernel to user space or when transferring control to the guest system (researchers initially insisted that VERW (clearing microarchitectural buffers) is insufficient for protection and a complete reset of the L1 cache is required for every context switch).
- The command has updated its considering the L1DES vulnerability.
- Researchers from the University of Michigan have developed their own attack method (), which allows for the extraction of confidential information from the operating system kernel, virtual machines, and protected enclaves SGX. The method is based on with the asynchronous operation interruption mechanism (TAA, TSX Asynchronous Abort) to determine the contents of the fill buffer after data leakage from the L1D cache.
The second vulnerability VRS (Vector Register Sampling) to leakage into the store buffer of results from reading vector registers, altered while executing vector instructions (SSE, AVX, AVX-512) on the same CPU core. The leakage occurs under quite rare circumstances and is caused by a speculatively executed operation that leads to the reflection of the state of vector registers in the store buffer, which is delayed and completes after the buffer is cleared, rather than before it. Similar to the L1DES vulnerability, the contents of the store buffer can then be determined using MDS and TAA attack methods.
Researchers from the VUSec group , allowing for the determination of values in vector registers obtained from computations in another logical thread of the same CPU core. Intel the VRS vulnerability as too complex to carry out real attacks and assigned it a minimal danger level (2.8 CVSS).
Information about the issues was reported to Intel in May 2019 by the Zombieload team from Graz University of Technology (Austria) and the VUSec group from Vrije Universiteit Amsterdam. Subsequently, after analyzing other attack vectors related to MDS, the vulnerabilities were confirmed by several other researchers. The initial MDS report did not include information about the L1DES and VRS issues due to the lack of a fix. A fix is still not available, but the agreed non-disclosure period has expired.
As a workaround, it is recommended to disable HyperThreading. To block the vulnerability at the kernel level, it is suggested to flush the L1 cache on every context switch (MSR bit MSR_IA32_FLUSH_CMD) and disable the TSX extension (MSR bits MSR_IA32_TSX_CTRL and MSR_TSX_FORCE_ABORT).
Intel to release a microcode update with mechanisms to block the issues in the near future. Intel also notes that the methods proposed in 2018 for protecting against the attack (L1 Terminal Fault) allow for blocking the exploitation of the L1DES vulnerability from virtual environments. The attack Intel Core processors starting from the sixth generation (Sky, Kaby, Coffee, Whiskey, Amber Lake, etc.), as well as some models of Intel Xeon and Xeon Scalable.
Additionally, it can be noted , allowing the attack methods to be applied to determine the contents of the root password hash from /etc/shadow during periodic authentication attempts. If the initially proposed exploit determined the password hash in , and after applying the leak during the operation of the asynchronous interrupt mechanism (TAA, TSX Asynchronous Abort) performed a similar operation in , the new variant performs the attack in 4 seconds.
Source: opennet.ru
