AMD processors - page table walk traces in the last-level cache: The MMU's page table walks during address translation

CVSS 7.5CVE-2017-5926Firmware, BMC & network fabricAnC-style MMU side channelcurated

Impact

The MMU's page table walks during address translation leave traces in the last-level cache, which is shared across cores on an AMD socket. A side-channel attack on the MMU recovers information about a victim's virtual address layout - and since the LLC is shared, this reaches across cores, not just across SMT threads, so core pinning does not help.

Who can reach it

Local, co-resident on the same socket as the victim. Works across cores because the last-level cache is the shared resource.

What to do

**Effectively unpatchable in hardware** - shared last-level cache is a design property, not a bug. Mitigation is architectural: do not co-schedule mutually untrusted tenants on the same socket, and where the threat model demands it, allocate whole nodes rather than slices. On a GPU fleet that maps naturally onto whole-node allocation for sensitive customers, which most operators already offer as a premium tier.

References

https://nvd.nist.gov/vuln/detail/CVE-2017-5926

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.