Database/Firmware, BMC & network fabric
Intel processors with Linear Address Masking (LAM): SLAM: Linear Address Masking, a feature intended to let software
Impact
SLAM: Linear Address Masking, a feature intended to let software store metadata in unused address bits, makes previously impractical Spectre gadgets exploitable by widening the set of usable pointer-chasing gadgets - so a performance and usability feature became a security regression. Notable as a case where the mitigation was to ship the hardware feature disabled by default in Linux.
Who can reach it
Local unprivileged code on a host with LAM enabled.
What to do
Linux disables LAM by default in response; keep it disabled unless you have a specific requirement and have assessed the tradeoff. Kernel-level configuration - a kernel update and reboot, no microcode or BIOS. Verify LAM state on your nodes rather than assuming the default held through a kernel upgrade.
References
Related entries
- MSI / Intel Boot Guard OEM key leak: The Money Message ransomware dump exposed MSI's firmware image-signing privateNCVD-2023-001-msi-intel-boot-guard-oem-key-lea · MSI / Intel Boot Guard OEM key leakUnscored
- Intel SGX (cache side channel on sub-cacheline access): TeeJam: shows that SGX's cache-based side-channel resistance isNCVD-2024-001-intel-sgx-cache-side-channel-on · Intel SGX (cache side channel on sub-cacheline access)Unscored
- Platform attestation as an operational control (fTPM vs discrete TPM trust): Design-level: on most GPU servers the TPMNCVD-2024-001-platform-attestation-as-an-opera · Platform attestation as an operational control (fTPM vs discrete TPM trust)Unscored
- Intel processors (Indirect Branch Predictor structure): Indirector: reverse-engineering the Indirect Branch PredictorNCVD-2024-002-intel-processors-indirect-branch · Intel processors (Indirect Branch Predictor structure)Unscored
- Intel SGX (cache side channel on sub-cacheline access): TeeJam: shows that SGX's cache-based side-channel resistance isNCVD-2024-006-intel-sgx-cache-side-channel-on · Intel SGX (cache side channel on sub-cacheline access)Unscored
- Intel processors (Indirect Branch Predictor structure): Indirector: reverse-engineering the Indirect Branch PredictorNCVD-2024-007-intel-processors-indirect-branch · Intel processors (Indirect Branch Predictor structure)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.