CVE-2018-3639

Processors predict whether a load depends on an older store whose address is not yet computed, and if they guess that it does not, they run the load early. When the guess is wrong, the load reads the value from before the store, and the instructions after it run with that stale value until the processor notices and replays them. Code that overwrites a secret, or checks a pointer by storing over it, can so leak the old value, which matters most to sandboxes such as JavaScript engines.

Linux reports it on processors that it does not list as not affected and that do not report SSB_NO (bit 4 of IA32_ARCH_CAPABILITIES) or AMD’s equivalent CPUID bit.

Affected processors

42 of the 50 microarchitectures listed are affected in all or some of their models.

Mitigations

• Microcode: Speculative Store Bypass Disable (SSBD): microcode adds bit 2 of IA32_SPEC_CTRL, which stops loads from running ahead of stores with unknown addresses; some AMD processors have their own control in an MSR instead. Instructions: WRMSR. Source.
• Kernel: Because SSBD slows every program, Linux by default turns it on only for processes that ask through prctl() or run under seccomp; the boot option spec_store_bypass_disable chooses otherwise. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/spec_store_bypass holds one of these lines:

• Not affected
• Vulnerable
• Mitigation: Speculative Store Bypass disabled
• Mitigation: Speculative Store Bypass disabled via prctl
• Mitigation: Speculative Store Bypass disabled via prctl and seccomp

Source.