Processor vulnerability
CVE-2021-0086
An operation that needs a microcode assist, such as one with a subnormal result, hands a wrong value to dependent instructions until the assist flushes them.
- Name
- Floating Point Value Injection
- Also known as
- FPVI
- Vulnerability
- Floating Point Value Injection
- Kind
- Transient execution
- CVE published
- 2021-06-09 CVE record
- Advisories
- INTEL-SA-00516
Some floating-point operations, such as those producing a subnormal
result, need a microcode assist. Before the assist flushes the
pipeline, instructions that depend on the result run on a wrong
value, and an attacker who controls the inputs controls that value.
The risk is in JavaScript engines that box pointers in NaN values: a
transient result can break the convention that keeps a double from
looking like a pointer.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
27 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Haswell | Affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Software 06_3FH stepping 4 (Haswell Server EX): Software | Intel’s list |
| Broadwell | Affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Software 06_56H stepping 3 (Broadwell DE V2 - V3): Software 06_56H stepping 4 (Broadwell DE Y0): Software 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Software | Intel’s list |
| Skylake | Affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Software | Intel’s list |
| Kaby Lake | Affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Software | Intel’s list |
| Coffee Lake | Affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Software 06_8EH stepping B (Whiskey Lake U): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping A (Coffee Lake H): Software 06_9EH stepping C (Coffee Lake S): Software 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Software | Intel’s list |
| Comet Lake | Affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_A5H stepping 2 (Comet Lake H): Software 06_A5H stepping 3 (Comet Lake-S): Software 06_A5H stepping 5 (Comet Lake-S): Software 06_A6H stepping 0 (Comet Lake U62): Software 06_A6H stepping 1 (Comet Lake U62): Software | Intel’s list |
| Ice Lake (client) | Affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Software | Intel’s list |
| Tiger Lake | Affected | 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Software 06_8DH stepping 1 (Tiger Lake H): Software 06_8DH stepping 1 (Tiger Lake H): Software | Intel’s list |
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Catlow (Golden Cove)): Software 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Software 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Software 06_B7H stepping 1 (Catlow (Raptor Cove)): Software 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Software 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Software | Intel’s list |
| Meteor Lake | Affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Software | Intel’s list |
| Arrow Lake | Affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Software 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Software 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Software | Intel’s list |
| Lunar Lake | Affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Software | Intel’s list |
| Panther Lake | Affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Software | Intel’s list |
| Skylake-SP | Affected | 06_55H stepping 3 (Skylake Server): Software 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Software | Intel’s list |
| Cooper Lake | Affected | 06_55H stepping B (Cooper Lake): Software | Intel’s list |
| Ice Lake (server) | Affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Software | Intel’s list |
| Emerald Rapids | Affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Software | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Software 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Software | Intel’s list |
| Granite Rapids | Affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Software 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Software 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Software 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Software | Intel’s list |
| Sierra Forest | Affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Software | Intel’s list |
| Clearwater Forest | Affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Software | Intel’s list |
| Goldmont | Affected | 06_5CH stepping A (Apollo Lake): Software 06_5FH stepping All (Denverton (Goldmont)): Software | Intel’s list |
| Goldmont Plus | Affected | 06_7AH stepping 8 (Gemini Lake): Software | Intel’s list |
| Tremont | Affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Software 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Software 06_96H stepping All (Elkhart Lake (Tremont)): Software 06_9CH stepping All (Jasper Lake (Tremont)): Software | Intel’s list |
| Gracemont | Affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Software 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Software | Intel’s list |
Mitigations
- Programs: Isolating untrusted code in another process; in runtimes that use NaN boxing, clamping results with a compare and CMOVcc before use; or setting FTZ and DAZ where subnormals are not needed. Instructions: CMOVcc. Source.
- Compiler: An LFENCE after the floating-point operation or before the dependent access; code built with the LVI mitigations needs nothing more. Instructions: LFENCE. Source.
Related CVEs
- CVE-2021-26314 Floating Point Value Injection