Intel processors (rogue data cache load): Meltdown: unprivileged code reads kernel memory - and on affected parts

Impact

Meltdown: unprivileged code reads kernel memory - and on affected parts, memory belonging to other tenants mapped into the kernel's direct map - by exploiting out-of-order execution past a permission check. The mitigation, kernel page-table isolation, is the reason every syscall on affected hardware got measurably slower.

Who can reach it

Any local unprivileged code on an affected processor.

What to do

Kernel page-table isolation (KPTI/PTI), shipped in the kernel; take the kernel update and reboot. Newer silicon fixes it in hardware. No microcode or BIOS component for the mitigation itself. Expect a syscall-heavy throughput regression on affected parts - that is the fix working.

References

Related entries

• Intel processors: speculative sampling of stale data from microarchitectural buffers (MDS)CVE-2018-12126 · Intel processors (microarchitectural data sampling)Medium
• Intel processors (L1 terminal fault, OS/SMM): The OS-level variant of L1 terminal fault: a local user can speculativelyCVE-2018-3620 · Intel processors (L1 terminal fault, OS/SMM)Medium
• Intel processors (rogue system register read): Spectre v3a: speculative reads of system registers leak systemCVE-2018-3640 · Intel processors (rogue system register read)Medium
• Intel processors (lazy FP state restore): LazyFP: when the OS restores FPU/vector state lazily, one process canCVE-2018-3665 · Intel processors (lazy FP state restore)Medium
• Intel processors (bounds check bypass store): Spectre 1.1: speculative stores can overflow a bounds-checked bufferCVE-2018-3693 · Intel processors (bounds check bypass store)Medium
• Intel processors (snoop-assisted L1D sampling): Data can be leaked out of L1D during snoop transactions, crossingCVE-2020-0550 · Intel processors (snoop-assisted L1D sampling)Medium