Processor vulnerability
CVE-2020-0551
A faulting or assisted load in victim code can transiently receive a value the attacker left in a buffer, steering what the victim does next.
- Name
- Load Value Injection
- Also known as
- LVI
- Vulnerability
- Load Value Injection
- Kind
- Transient execution
- CVE published
- 2020-03-12 CVE record
- Advisories
- INTEL-SA-00334
On some processors a load that faults, aborts or needs a microcode assist can transiently receive data from a microarchitectural buffer instead of memory. An attacker who can make such a load happen in victim code, and who has put data in that buffer, controls the value the victim’s next instructions compute with, and through them what leaks over a covert channel. Intel’s list distinguishes stale-data and zero-data forms.
Intel’s assessment is that the practical target is an SGX enclave attacked by its own operating system or hypervisor; where the operating system and hypervisor are trusted it does not consider LVI practical. No microcode update addresses it.
Affected processors
10 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Haswell | Affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation 06_3FH stepping 4 (Haswell Server EX): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation | Intel’s list |
| Broadwell | Affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation 06_56H stepping 3 (Broadwell DE V2 - V3): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation 06_56H stepping 4 (Broadwell DE Y0): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation | Intel’s list |
| Skylake | Affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software | Intel’s list |
| Kaby Lake | Affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software | Intel’s list |
| Coffee Lake | Affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_8EH stepping B (Whiskey Lake U): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_9EH stepping A (Coffee Lake H): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_9EH stepping C (Coffee Lake S): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software | Intel’s list |
| Skylake-SP | Affected | 06_55H stepping 3 (Skylake Server): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: No planned mitigation | Intel’s list |
| Comet Lake | Some models | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Software 06_A5H stepping 2 (Comet Lake H): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Not Affected 06_A5H stepping 3 (Comet Lake-S): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Not Affected 06_A5H stepping 5 (Comet Lake-S): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Not Affected 06_A6H stepping 0 (Comet Lake U62): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Not Affected 06_A6H stepping 1 (Comet Lake U62): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Ice Lake (client) | Some models | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Hardware+MCU | Intel’s list |
| Rocket Lake | Some models | 06_A7H stepping 1 (Rocket Lake): Load Value Injection: Zero Data: Software; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Cooper Lake | Some models | 06_55H stepping B (Cooper Lake): Load Value Injection: Zero Data: No planned mitigation; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Tiger Lake | Not affected | 06_8CH stepping 1 (Tiger Lake U): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_8CH stepping 1 (Tiger Lake U): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_8DH stepping 1 (Tiger Lake H): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_8DH stepping 1 (Tiger Lake H): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Alder Lake | Not affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_97H stepping 5 (Catlow (Golden Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Raptor Lake | Not affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_B7H stepping 1 (Catlow (Raptor Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Arrow Lake | Not affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Lunar Lake | Not affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Panther Lake | Not affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Ice Lake (server) | Not affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Emerald Rapids | Not affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Sapphire Rapids | Not affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Clearwater Forest | Not affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_5FH stepping All (Denverton (Goldmont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Goldmont Plus | Not affected | 06_7AH stepping 8 (Gemini Lake): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Tremont | Not affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Load Value Injection: Zero Data: Not Affected; Load Value Injection: Stale Data: Not Affected | Intel’s list |
Mitigations
- Compiler: In enclave code, an LFENCE between a load and the instructions that depend on it, or after every load, and RET and indirect jumps and calls replaced by fenced sequences; Intel's SGX SDK and patched assemblers and compilers insert them. Instructions: LFENCE, RET. Source.
- Kernel: Outside SGX, SMAP and SMEP, and not letting user code map address 0, as defence in depth; CLAC and STAC have LFENCE semantics on the affected processors. Instructions: CLAC, STAC. Source.
Related CVEs
- CVE-2026-20917 Load Value Injection: zero data