Processor vulnerability
CVE-2019-1125
Spectre variant 1 in the kernel's entry code: a mispredicted branch around SWAPGS lets kernel loads use a GS base that user space chose.
- Name
- Spectre v1 swapgs
- Also known as
- SWAPGS
- Vulnerability
- Spectre variant 1
- Kind
- Transient execution
- CVE published
- 2019-09-03 CVE record
- Linux reports it in
spectre_v1
On entry from an interrupt or an exception, the x86-64 kernel checks
whether it came from user mode and only then executes SWAPGS, which
swaps the user’s GS base for the kernel’s. That check is a
conditional branch like any other. When the processor mispredicts
it, the kernel’s first loads through GS use the wrong base: the
user’s, which can point anywhere, or the kernel’s where the user’s
was expected. A load through an address read that way can leave a
trace of kernel data in the cache.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
38 of the 63 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| NetBurst (Prescott, Nocona) | Affected | Linux 7.3 sets the bug on INTEL_P4_CEDARMILL, INTEL_P4_PRESCOTT, INTEL_P4_PRESCOTT_2M: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Core (Merom, Conroe) | Affected | Linux 7.3 sets the bug on INTEL_CORE2_MEROM, INTEL_CORE2_MEROM_L: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Penryn | Affected | Linux 7.3 sets the bug on INTEL_CORE2_DUNNINGTON, INTEL_CORE2_PENRYN: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Nehalem | Affected | Linux 7.3 sets the bug on INTEL_NEHALEM, INTEL_NEHALEM_EP, INTEL_NEHALEM_EX, INTEL_NEHALEM_G: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Westmere | Affected | Linux 7.3 sets the bug on INTEL_WESTMERE, INTEL_WESTMERE_EP, INTEL_WESTMERE_EX: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Sandy Bridge | Affected | Linux 7.3 sets the bug on INTEL_SANDYBRIDGE, INTEL_SANDYBRIDGE_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Ivy Bridge | Affected | Linux 7.3 sets the bug on INTEL_IVYBRIDGE, INTEL_IVYBRIDGE_X: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Haswell | Affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Software 06_3FH stepping 4 (Haswell Server EX): Software | Intel’s list |
| Broadwell | Affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Software 06_56H stepping 3 (Broadwell DE V2 - V3): Software 06_56H stepping 4 (Broadwell DE Y0): Software 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Software | Intel’s list |
| Skylake | Affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Software | Intel’s list |
| Kaby Lake | Affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Software | Intel’s list |
| Coffee Lake | Affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Software 06_8EH stepping B (Whiskey Lake U): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping A (Coffee Lake H): Software 06_9EH stepping C (Coffee Lake S): Software 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Software | Intel’s list |
| Cannon Lake | Affected | Linux 7.3 sets the bug on INTEL_CANNONLAKE_L: cpu_vuln_whitelist does not list it with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Comet Lake | Affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_A5H stepping 2 (Comet Lake H): Software 06_A5H stepping 3 (Comet Lake-S): Software 06_A5H stepping 5 (Comet Lake-S): Software 06_A6H stepping 0 (Comet Lake U62): Software 06_A6H stepping 1 (Comet Lake U62): Software | Intel’s list |
| Ice Lake (client) | Affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Software | Intel’s list |
| Tiger Lake | Affected | 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Software 06_8DH stepping 1 (Tiger Lake H): Software 06_8DH stepping 1 (Tiger Lake H): Software | Intel’s list |
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Catlow (Golden Cove)): Software 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Software 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Software 06_B7H stepping 1 (Catlow (Raptor Cove)): Software 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Software 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Software | Intel’s list |
| Meteor Lake | Affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Software | Intel’s list |
| Arrow Lake | Affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Software 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Software 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Software | Intel’s list |
| Lunar Lake | Affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Software | Intel’s list |
| Panther Lake | Affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Software | Intel’s list |
| Nova Lake | Affected | Linux 7.3 sets the bug on INTEL_NOVALAKE, INTEL_NOVALAKE_L: cpu_vuln_whitelist does not list them with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Skylake-SP | Affected | 06_55H stepping 3 (Skylake Server): Software 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Software | Intel’s list |
| Cascade Lake | Affected | Linux 7.3 sets the bug on INTEL_SKYLAKE_X steppings 5 to 7: cpu_vuln_whitelist does not list it with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Cooper Lake | Affected | 06_55H stepping B (Cooper Lake): Software | Intel’s list |
| Ice Lake (server) | Affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Software | Intel’s list |
| Emerald Rapids | Affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Software | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Software 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Software | Intel’s list |
| Granite Rapids | Affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Software 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Software 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Software 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Software | Intel’s list |
| Sierra Forest | Affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Software | Intel’s list |
| Clearwater Forest | Affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Software | Intel’s list |
| Diamond Rapids | Affected | Linux 7.3 sets the bug on INTEL_DIAMONDRAPIDS_X: cpu_vuln_whitelist does not list it with NO_SPECULATION or NO_SWAPGS | Linux 7.3 |
| Goldmont | Affected | 06_5CH stepping A (Apollo Lake): Software 06_5FH stepping All (Denverton (Goldmont)): Software | Intel’s list |
| Goldmont Plus | Affected | 06_7AH stepping 8 (Gemini Lake): Software | Intel’s list |
| Tremont | Affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Software 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Software 06_96H stepping All (Elkhart Lake (Tremont)): Software 06_9CH stepping All (Jasper Lake (Tremont)): Software | Intel’s list |
| Gracemont | Affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Software 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Software | Intel’s list |
| Bonnell | Not affected | Linux 7.3 lists INTEL_ATOM_BONNELL, INTEL_ATOM_BONNELL_MID in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Saltwell | Not affected | Linux 7.3 lists INTEL_ATOM_SALTWELL, INTEL_ATOM_SALTWELL_MID, INTEL_ATOM_SALTWELL_TABLET in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Silvermont | Not affected | Linux 7.3 lists INTEL_ATOM_SILVERMONT, INTEL_ATOM_SILVERMONT_D, INTEL_ATOM_SILVERMONT_MID, INTEL_ATOM_SILVERMONT_MID2 in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Airmont | Not affected | Linux 7.3 lists INTEL_ATOM_AIRMONT, INTEL_ATOM_AIRMONT_NP in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Knights Landing | Not affected | Linux 7.3 lists INTEL_XEON_PHI_KNL in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Knights Mill | Not affected | Linux 7.3 lists INTEL_XEON_PHI_KNM in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| K8 (Hammer) | Not affected | Linux 7.3 lists AMD family Fh in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| K10 (Family 10h) | Not affected | Linux 7.3 lists AMD family 10h, AMD family 12h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Bulldozer | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Piledriver | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Steamroller | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Excavator | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen+ | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen 2 | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen 3 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen 4 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen 5 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Zen 6 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Bobcat | Not affected | Linux 7.3 lists AMD family 14h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Jaguar | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Puma | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Dhyana | Not affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| LuJiaZui | Not affected | Linux 7.3 lists Centaur family 7, Zhaoxin family 7 in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
| Century Avenue (Shijidadao) | Not affected | Linux 7.3 lists Centaur family 7, Zhaoxin family 7 in cpu_vuln_whitelist with NO_SWAPGS | Linux 7.3 |
Mitigations
- Kernel: Linux puts an LFENCE on the interrupt, exception and NMI entry paths where needed, so that no load through GS starts before the branch around SWAPGS is resolved. The user entry path gets one only where the processor has this bug and page table isolation is off, since the page-table switch of PTI already serializes it. Instructions: LFENCE, SWAPGS. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v1 holds one of these lines:
Not affectedMitigation: usercopy/swapgs barriers and __user pointer sanitizationVulnerable: __user pointer sanitization and usercopy barriers only; no swapgs barriers
Linux reports it in the spectre_v1 file, together with variant 1. Source.
Related CVEs
- CVE-2017-5753 Bounds Check Bypass
- CVE-2018-3693 Bounds Check Bypass Store