Database/Kernel, userspace & hypervisor
Intel CPU (Downfall / GDS): Downfall: Gather Data Sampling leaks AVX gather-instruction data across SMT siblings
Impact
Downfall: Gather Data Sampling leaks AVX gather-instruction data across SMT siblings, containers and VMs - directly breaks multi-tenant isolation
Who can reach it
Any tenant process in a container; tenant VM guest
What to do
Microcode update + reboot, standing perf cost (reported up to ~50% on gather-heavy vector code). Alternative is disabling AVX gather, which is worse for AI workloads. On shared-GPU nodes with co-tenanted CPUs this is a must-fix
Fleet impact
How widespread
very common - Skylake through Tiger Lake era Xeons, still the host CPU under a large installed base of GPU nodes
Cost to remediate
microcode+reboot - microcode is loaded at boot, so every node drains and reboots; the mitigation carries a measurable AVX2/AVX-512 gather slowdown, i.e. a permanent throughput tax on the fleet
Why it hits the whole fleet
Cross-tenant data leakage from stale vector registers on shared hardware - exactly the isolation property a multi-tenant GPU cloud sells - so it forces a fleet-wide reboot campaign regardless of workload.
References
Related entries
- Linux kernel (net/tls): A BPF sockmap psock could be attached to a socket that already had the kTLS ULP installed. TheCVE-2022-49732 · Linux kernel (net/tls)Medium
- AMD CPU (Zenbleed): Zenbleed: cross-process/cross-VM register-file data leak on Zen 2 at ~30 kB/s per core, no specialCVE-2023-20593 · AMD CPU (Zenbleed)Medium
- GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination): A GPU kernel reads whateverCVE-2023-4969 · GPU local/shared memory not cleared between kernels (AMD, Apple, Qualcomm, Imagination)Medium
- Linux kernel (net/xfrm): XFRM_MSG_NEWAE lets a caller update replay-window state on a state that never had replay_esnCVE-2023-53147 · Linux kernel (net/xfrm)Medium
- Linux kernel (drivers/vfio): Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to aCVE-2023-53171 · Linux kernel (drivers/vfio)Medium
- Linux kernel (drivers/iommu/iommufd): Iommufd accepts a user address plus length that wraps past zero, then asks the mmCVE-2023-54239 · Linux kernel (drivers/iommu/iommufd)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.