Processor vulnerability
CVE-2017-5754
A user-mode load from a supervisor-only page faults, but an affected processor first passes the data to later instructions, which can leave a trace in cache.
- Name
- Rogue Data Cache Load
- Also known as
- Meltdown, Variant 3
- Kind
- Transient execution
- CVE published
- 2018-01-04 CVE record
- Advisories
- INTEL-SA-00088
- Linux reports it in
meltdown
The page tables of a process used to map the kernel too, marked supervisor-only, so that entering the kernel needed no change of page tables. On an affected processor, a load from such a page in user mode does fault, but not before the processor has executed later instructions with the loaded value, out of order. Intel describes the leak as limited to data that is in the L1 data cache. A program that uses the value as an index into an array of its own brings one line of that array into the cache, and finds which one by timing its accesses afterwards: the value has left the processor through the cache.
The fix in software is to stop mapping the kernel while user code runs. Processors designed after the disclosure say in a bit of the IA32_ARCH_CAPABILITIES register that they are not affected, and operating systems then skip that fix.
Affected processors
17 of the 57 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| NetBurst (Prescott, Nocona) | Affected | Linux 7.3 sets the bug on INTEL_P4_CEDARMILL, INTEL_P4_PRESCOTT, INTEL_P4_PRESCOTT_2M: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Core (Merom, Conroe) | Affected | Linux 7.3 sets the bug on INTEL_CORE2_MEROM, INTEL_CORE2_MEROM_L: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Penryn | Affected | Linux 7.3 sets the bug on INTEL_CORE2_DUNNINGTON, INTEL_CORE2_PENRYN: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Nehalem | Affected | Linux 7.3 sets the bug on INTEL_NEHALEM, INTEL_NEHALEM_EP, INTEL_NEHALEM_EX, INTEL_NEHALEM_G: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Westmere | Affected | Linux 7.3 sets the bug on INTEL_WESTMERE, INTEL_WESTMERE_EP, INTEL_WESTMERE_EX: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Sandy Bridge | Affected | Linux 7.3 sets the bug on INTEL_SANDYBRIDGE, INTEL_SANDYBRIDGE_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Ivy Bridge | Affected | Linux 7.3 sets the bug on INTEL_IVYBRIDGE, INTEL_IVYBRIDGE_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Haswell | Affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Software 06_3FH stepping 4 (Haswell Server EX): Software | Intel’s list |
| Broadwell | Affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Software 06_56H stepping 3 (Broadwell DE V2 - V3): Software 06_56H stepping 4 (Broadwell DE Y0): Software 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Software | Intel’s list |
| Skylake | Affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Software | Intel’s list |
| Skylake-SP | Affected | 06_55H stepping 3 (Skylake Server): Software 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Software | Intel’s list |
| Silvermont | Affected | Linux 7.3 sets the bug on INTEL_ATOM_SILVERMONT, INTEL_ATOM_SILVERMONT_D, INTEL_ATOM_SILVERMONT_MID, INTEL_ATOM_SILVERMONT_MID2: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Airmont | Affected | Linux 7.3 sets the bug on INTEL_ATOM_AIRMONT, INTEL_ATOM_AIRMONT_NP: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Knights Landing | Affected | Linux 7.3 sets the bug on INTEL_XEON_PHI_KNL: cpu_vuln_whitelist does not list it with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Knights Mill | Affected | Linux 7.3 sets the bug on INTEL_XEON_PHI_KNM: cpu_vuln_whitelist does not list it with NO_SPECULATION or NO_MELTDOWN; and a processor released before 2018 does not report RDCL_NO | Linux 7.3 |
| Kaby Lake | Some models | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Software | Intel’s list |
| Coffee Lake | Some models | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Software 06_8EH stepping B (Whiskey Lake U): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping A (Coffee Lake H): Software 06_9EH stepping C (Coffee Lake S): Not Affected 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Not Affected | Intel’s list |
| Comet Lake | Not affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_A5H stepping 2 (Comet Lake H): Not Affected 06_A5H stepping 3 (Comet Lake-S): Not Affected 06_A5H stepping 5 (Comet Lake-S): Not Affected 06_A6H stepping 0 (Comet Lake U62): Not Affected 06_A6H stepping 1 (Comet Lake U62): Not Affected | Intel’s list |
| Ice Lake (client) | Not affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Not Affected | Intel’s list |
| Tiger Lake | Not affected | 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected | Intel’s list |
| Alder Lake | Not affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Not Affected 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Not Affected 06_97H stepping 5 (Catlow (Golden Cove)): Not Affected 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Not Affected 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Not Affected | Intel’s list |
| Rocket Lake | Not affected | 06_A7H stepping 1 (Rocket Lake): Not Affected | Intel’s list |
| Raptor Lake | Not affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Not Affected 06_B7H stepping 1 (Catlow (Raptor Cove)): Not Affected 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Not Affected 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Not Affected | Intel’s list |
| Arrow Lake | Not affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Lunar Lake | Not affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Panther Lake | Not affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Not Affected | Intel’s list |
| Cooper Lake | Not affected | 06_55H stepping B (Cooper Lake): Not Affected | Intel’s list |
| Ice Lake (server) | Not affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Not Affected 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Not Affected | Intel’s list |
| Emerald Rapids | Not affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Not Affected | Intel’s list |
| Sapphire Rapids | Not affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Not Affected 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Not Affected | Intel’s list |
| Clearwater Forest | Not affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Not Affected | Intel’s list |
| Bonnell | Not affected | Linux 7.3 lists INTEL_ATOM_BONNELL, INTEL_ATOM_BONNELL_MID in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Saltwell | Not affected | Linux 7.3 lists INTEL_ATOM_SALTWELL, INTEL_ATOM_SALTWELL_MID, INTEL_ATOM_SALTWELL_TABLET in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Not Affected 06_5FH stepping All (Denverton (Goldmont)): Not Affected | Intel’s list |
| Goldmont Plus | Not affected | 06_7AH stepping 8 (Gemini Lake): Not Affected | Intel’s list |
| Tremont | Not affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Not Affected | Intel’s list |
| K8 (Hammer) | Not affected | Linux 7.3 lists AMD family Fh in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| K10 (Family 10h) | Not affected | Linux 7.3 lists AMD family 10h, AMD family 12h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Bulldozer | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Piledriver | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Steamroller | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Excavator | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen+ | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen 2 | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen 3 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen 4 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen 5 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Zen 6 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Bobcat | Not affected | Linux 7.3 lists AMD family 14h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Jaguar | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Puma | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
| Dhyana | Not affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_whitelist with NO_MELTDOWN | Linux 7.3 |
Mitigations
- Kernel: Page table isolation (PTI): Linux gives each process a second set of page tables for user mode that maps only the code and data needed to enter and leave the kernel, and switches between the two on every entry and exit. It turns PTI on where it finds the processor affected; the boot options pti=off and nopti turn it off. Source.
- Hardware: A processor that is not affected sets bit 0 (RDCL_NO) of IA32_ARCH_CAPABILITIES (MSR 10AH); Linux reads it with RDMSR and then does not report the processor as affected. Instructions: RDMSR. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/meltdown holds one of these lines:
Not affectedMitigation: PTIVulnerableUnknown (XEN PV detected, hypervisor mitigation required)