Processor vulnerability
CVE-2020-0550
A snoop that hits a modified L1D line in the same cycle as a faulting, assisting or aborting load can expose the line's data to that load.
- Name
- Snoop-assisted L1D Sampling
- Kind
- Data sampling
- CVE published
- 2020-03-12 CVE record
- Advisories
- INTEL-SA-00330
The attack needs a narrow coincidence: a cache-coherence snoop to a modified line in the L1 data cache, arriving in the same clock cycle as a load that faults, needs a microcode assist or aborts. That load can then see the line’s data transiently. Unlike L1D Eviction Sampling it needs the snoop. The affected processors are a subset of those with L1TF.
Intel does not recommend flushing the L1D in the operating system for it, as that is costly and needs scheduler changes with Hyper- Threading; processors with the L1TF mitigation for SMM already flush the L1D when they leave SMM.
Affected processors
2 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Haswell | Affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): No planned mitigation 06_3FH stepping 4 (Haswell Server EX): No planned mitigation | Intel’s list |
| Broadwell | Affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): No planned mitigation 06_56H stepping 3 (Broadwell DE V2 - V3): No planned mitigation 06_56H stepping 4 (Broadwell DE Y0): No planned mitigation 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): No planned mitigation | Intel’s list |
| Skylake | Not affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Not Affected | Intel’s list |
| Kaby Lake | Not affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Not Affected | Intel’s list |
| Coffee Lake | Not affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Not Affected 06_8EH stepping B (Whiskey Lake U): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping A (Coffee Lake H): Not Affected 06_9EH stepping C (Coffee Lake S): Not Affected 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Not Affected | Intel’s list |
| Comet Lake | Not affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_A5H stepping 2 (Comet Lake H): Not Affected 06_A5H stepping 3 (Comet Lake-S): Not Affected 06_A5H stepping 5 (Comet Lake-S): Not Affected 06_A6H stepping 0 (Comet Lake U62): Not Affected 06_A6H stepping 1 (Comet Lake U62): Not Affected | Intel’s list |
| Ice Lake (client) | Not affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Not Affected | Intel’s list |
| Tiger Lake | Not affected | 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected | Intel’s list |
| Alder Lake | Not affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Not Affected 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Not Affected 06_97H stepping 5 (Catlow (Golden Cove)): Not Affected 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Not Affected 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Not Affected | Intel’s list |
| Rocket Lake | Not affected | 06_A7H stepping 1 (Rocket Lake): Not Affected | Intel’s list |
| Raptor Lake | Not affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Not Affected 06_B7H stepping 1 (Catlow (Raptor Cove)): Not Affected 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Not Affected 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Not Affected | Intel’s list |
| Arrow Lake | Not affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Lunar Lake | Not affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Panther Lake | Not affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Not Affected | Intel’s list |
| Skylake-SP | Not affected | 06_55H stepping 3 (Skylake Server): Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Not Affected | Intel’s list |
| Cooper Lake | Not affected | 06_55H stepping B (Cooper Lake): Not Affected | Intel’s list |
| Ice Lake (server) | Not affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Not Affected 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Not Affected | Intel’s list |
| Emerald Rapids | Not affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Not Affected | Intel’s list |
| Sapphire Rapids | Not affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Not Affected 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Not Affected | Intel’s list |
| Clearwater Forest | Not affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Not Affected | Intel’s list |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Not Affected 06_5FH stepping All (Denverton (Goldmont)): Not Affected | Intel’s list |
| Goldmont Plus | Not affected | 06_7AH stepping 8 (Gemini Lake): Not Affected | Intel’s list |
| Tremont | Not affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Not Affected | Intel’s list |