x86-64.net

Processor vulnerability

CVE-2019-11091

A load that faults or needs a microcode assist picks up stale data from uncacheable accesses, left there by other code, and leaks it through the cache.

Name
Microarchitectural Data Sampling Uncacheable Memory
Also known as
MDSUM, RIDL
Vulnerability
Microarchitectural Data Sampling
Kind
Data sampling
CVE published
2019-05-30 CVE record
Advisories
INTEL-SA-00233
Linux reports it in
mds

This variant of MDS samples the buffers that carry accesses to uncacheable memory, which bypass the caches. A load that faults or needs a microcode assist can receive data that is still in it from code that ran before, on the same thread or, with SMT, on the sibling thread, and pass it to later instructions that leave a trace in the cache.

Linux reports all variants in one file; on Silvermont, Airmont and Xeon Phi processors it reports only the store buffer variant.

Affected processors

14 of the 38 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
MicroarchitectureStatusDetailSource
NetBurst (Prescott, Nocona)AffectedLinux 7.3 sets the bug on INTEL_P4_CEDARMILL, INTEL_P4_PRESCOTT, INTEL_P4_PRESCOTT_2M: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
Core (Merom, Conroe)AffectedLinux 7.3 sets the bug on INTEL_CORE2_MEROM, INTEL_CORE2_MEROM_L: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
PenrynAffectedLinux 7.3 sets the bug on INTEL_CORE2_DUNNINGTON, INTEL_CORE2_PENRYN: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
NehalemAffectedLinux 7.3 sets the bug on INTEL_NEHALEM, INTEL_NEHALEM_EP, INTEL_NEHALEM_EX, INTEL_NEHALEM_G: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
WestmereAffectedLinux 7.3 sets the bug on INTEL_WESTMERE, INTEL_WESTMERE_EP, INTEL_WESTMERE_EX: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
Sandy BridgeAffectedLinux 7.3 sets the bug on INTEL_SANDYBRIDGE, INTEL_SANDYBRIDGE_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
Ivy BridgeAffectedLinux 7.3 sets the bug on INTEL_IVYBRIDGE, INTEL_IVYBRIDGE_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
HaswellAffectedLinux 7.3 sets the bug on INTEL_HASWELL, INTEL_HASWELL_G, INTEL_HASWELL_L, INTEL_HASWELL_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
BroadwellAffectedLinux 7.3 sets the bug on INTEL_BROADWELL, INTEL_BROADWELL_D, INTEL_BROADWELL_G, INTEL_BROADWELL_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
SkylakeAffectedLinux 7.3 sets the bug on INTEL_SKYLAKE, INTEL_SKYLAKE_L: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
Kaby LakeAffectedLinux 7.3 sets the bug on INTEL_KABYLAKE stepping 9, INTEL_KABYLAKE_L steppings 9 to 12: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
Coffee LakeAffectedLinux 7.3 sets the bug on INTEL_KABYLAKE steppings 10 to 13, INTEL_KABYLAKE_L steppings 10 to 12: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
Skylake-SPAffectedLinux 7.3 sets the bug on INTEL_SKYLAKE_X steppings 3 to 4: cpu_vuln_whitelist does not list it with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
AirmontSome modelsLinux 7.3 sets the bug on INTEL_ATOM_AIRMONT, INTEL_ATOM_AIRMONT_NP: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_MDS or MSBDS_ONLY; and a processor released before 2018 does not report MDS_NOLinux 7.3
BonnellNot affectedLinux 7.3 lists INTEL_ATOM_BONNELL, INTEL_ATOM_BONNELL_MID in cpu_vuln_whitelist with NO_SPECULATIONLinux 7.3
SaltwellNot affectedLinux 7.3 lists INTEL_ATOM_SALTWELL, INTEL_ATOM_SALTWELL_MID, INTEL_ATOM_SALTWELL_TABLET in cpu_vuln_whitelist with NO_SPECULATIONLinux 7.3
SilvermontNot affectedLinux 7.3 lists INTEL_ATOM_SILVERMONT, INTEL_ATOM_SILVERMONT_D, INTEL_ATOM_SILVERMONT_MID, INTEL_ATOM_SILVERMONT_MID2 in cpu_vuln_whitelist with MSBDS_ONLYLinux 7.3
GoldmontNot affectedLinux 7.3 lists INTEL_ATOM_GOLDMONT, INTEL_ATOM_GOLDMONT_D in cpu_vuln_whitelist with NO_MDSLinux 7.3
Goldmont PlusNot affectedLinux 7.3 lists INTEL_ATOM_GOLDMONT_PLUS in cpu_vuln_whitelist with NO_MDSLinux 7.3
Knights LandingNot affectedLinux 7.3 lists INTEL_XEON_PHI_KNL in cpu_vuln_whitelist with MSBDS_ONLYLinux 7.3
Knights MillNot affectedLinux 7.3 lists INTEL_XEON_PHI_KNM in cpu_vuln_whitelist with MSBDS_ONLYLinux 7.3
K8 (Hammer)Not affectedLinux 7.3 lists AMD family Fh in cpu_vuln_whitelist with NO_MDSLinux 7.3
K10 (Family 10h)Not affectedLinux 7.3 lists AMD family 10h, AMD family 12h in cpu_vuln_whitelist with NO_MDSLinux 7.3
BulldozerNot affectedLinux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MDSLinux 7.3
PiledriverNot affectedLinux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MDSLinux 7.3
SteamrollerNot affectedLinux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MDSLinux 7.3
ExcavatorNot affectedLinux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_MDSLinux 7.3
ZenNot affectedLinux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_MDSLinux 7.3
Zen+Not affectedLinux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_MDSLinux 7.3
Zen 2Not affectedLinux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_MDSLinux 7.3
Zen 3Not affectedLinux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_MDSLinux 7.3
Zen 4Not affectedLinux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_MDSLinux 7.3
Zen 5Not affectedLinux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_MDSLinux 7.3
Zen 6Not affectedLinux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_MDSLinux 7.3
BobcatNot affectedLinux 7.3 lists AMD family 14h in cpu_vuln_whitelist with NO_MDSLinux 7.3
JaguarNot affectedLinux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_MDSLinux 7.3
PumaNot affectedLinux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_MDSLinux 7.3
DhyanaNot affectedLinux 7.3 lists Hygon family 18h in cpu_vuln_whitelist with NO_MDSLinux 7.3

Mitigations

  • Kernel: Microcode makes the old VERW instruction clear the processor's internal buffers; Linux executes it before returning to user space and before entering a guest. On processors with SMT the sibling thread is not protected unless SMT is off. Instructions: VERW. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/mds holds one of these lines:

  • Not affected
  • Vulnerable
  • Mitigation: Clear CPU buffers
  • Vulnerable: Clear CPU buffers attempted, no microcode

On an affected processor the line ends with the SMT state, such as SMT vulnerable or SMT disabled. Source.

Sources

  1. Linux 7.3 Documentation/admin-guide/hw-vuln/mds.rst: problem
  2. Linux 7.3 Documentation/arch/x86/mds.rst: mitigation with VERW