Processor vulnerability
CVE-2021-0089
Code that writes instructions and runs them without serializing, as JIT compilers do, can execute the stale bytes transiently.
- Name
- Speculative Code Store Bypass
- Also known as
- SCSB
- Vulnerability
- Speculative Code Store Bypass
- Kind
- Transient execution
- CVE published
- 2021-06-09 CVE record
- Advisories
- INTEL-SA-00516
When software writes new code bytes and jumps to them without a
serializing step, the processor can fetch and run the old bytes
transiently before it sees the store. An attacker who controls the
old bytes, in the same address space, can make them leak data
through the cache. Systems that never map memory writable and
executable at once are not affected, as the system calls that switch
a page serialize.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
27 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Haswell | Affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Software 06_3FH stepping 4 (Haswell Server EX): Software | Intel’s list |
| Broadwell | Affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Software 06_56H stepping 3 (Broadwell DE V2 - V3): Software 06_56H stepping 4 (Broadwell DE Y0): Software 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Software | Intel’s list |
| Skylake | Affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Software | Intel’s list |
| Kaby Lake | Affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Software | Intel’s list |
| Coffee Lake | Affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Software 06_8EH stepping B (Whiskey Lake U): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping A (Coffee Lake H): Software 06_9EH stepping C (Coffee Lake S): Software 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Software | Intel’s list |
| Comet Lake | Affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_A5H stepping 2 (Comet Lake H): Software 06_A5H stepping 3 (Comet Lake-S): Software 06_A5H stepping 5 (Comet Lake-S): Software 06_A6H stepping 0 (Comet Lake U62): Software 06_A6H stepping 1 (Comet Lake U62): Software | Intel’s list |
| Ice Lake (client) | Affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Software | Intel’s list |
| Tiger Lake | Affected | 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Software 06_8DH stepping 1 (Tiger Lake H): Software 06_8DH stepping 1 (Tiger Lake H): Software | Intel’s list |
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Catlow (Golden Cove)): Software 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Software 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Software 06_B7H stepping 1 (Catlow (Raptor Cove)): Software 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Software 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Software | Intel’s list |
| Meteor Lake | Affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Software | Intel’s list |
| Arrow Lake | Affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Software 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Software 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Software | Intel’s list |
| Lunar Lake | Affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Software | Intel’s list |
| Panther Lake | Affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Software | Intel’s list |
| Skylake-SP | Affected | 06_55H stepping 3 (Skylake Server): Software 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Software | Intel’s list |
| Cooper Lake | Affected | 06_55H stepping B (Cooper Lake): Software | Intel’s list |
| Ice Lake (server) | Affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Software | Intel’s list |
| Emerald Rapids | Affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Software | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Software 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Software | Intel’s list |
| Granite Rapids | Affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Software 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Software 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Software 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Software | Intel’s list |
| Sierra Forest | Affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Software | Intel’s list |
| Clearwater Forest | Affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Software | Intel’s list |
| Goldmont | Affected | 06_5CH stepping A (Apollo Lake): Software 06_5FH stepping All (Denverton (Goldmont)): Software | Intel’s list |
| Goldmont Plus | Affected | 06_7AH stepping 8 (Gemini Lake): Software | Intel’s list |
| Tremont | Affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Software 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Software 06_96H stepping All (Elkhart Lake (Tremont)): Software 06_9CH stepping All (Jasper Lake (Tremont)): Software | Intel’s list |
| Gracemont | Affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Software 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Software | Intel’s list |
Mitigations
- Programs: A serializing instruction, such as CPUID, between writing code and executing it, or keeping untrusted code in another process. Instructions: CPUID, SERIALIZE. Source.
- Programs: On current processors LFENCE, SYSRET or INVPCID also stop the old bytes from executing, though they do not meet the manual's rules for modifying code. Instructions: LFENCE. Source.
Related CVEs
- CVE-2021-26313 Speculative Code Store Bypass