Processor vulnerability
CVE-2022-21233
Reads of the xAPIC MMIO page that are not aligned 8-byte loads can return stale data from earlier accesses of the same core.
- Name
- Stale Data Read from Legacy xAPIC
- Also known as
- AEPIC Leak
- Kind
- Data sampling
- CVE published
- 2022-08-18 CVE record
- Advisories
- INTEL-SA-00657
In the legacy xAPIC mode the APIC’s registers sit in a page of
memory. A misaligned read of that page can return stale data rather
than a register; naturally aligned 8-byte reads are not affected,
and neither is x2APIC mode. Reading the page needs privilege, so the
threat is to SGX: a malicious operating system maps the page where
an enclave reads outside its own range, and the enclave’s data comes
back. Intel lists SGX processors from Ice Lake and Gemini Lake to
Rocket Lake; Sapphire Rapids and later fix the SGX case in hardware.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
12 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Ice Lake (client) | Affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Software | Intel’s list |
| Tiger Lake | Affected | 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Software 06_8DH stepping 1 (Tiger Lake H): Software 06_8DH stepping 1 (Tiger Lake H): Software | Intel’s list |
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Catlow (Golden Cove)): Software 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Software 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Software 06_B7H stepping 1 (Catlow (Raptor Cove)): Software 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Software 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Software | Intel’s list |
| Lunar Lake | Affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Software | Intel’s list |
| Ice Lake (server) | Affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): MCU+Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): MCU+Software | Intel’s list |
| Emerald Rapids | Affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Hardware+Software | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Hardware+Software 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Hardware+Software | Intel’s list |
| Goldmont | Affected | 06_5CH stepping A (Apollo Lake): Software 06_5FH stepping All (Denverton (Goldmont)): Software | Intel’s list |
| Goldmont Plus | Affected | 06_7AH stepping 8 (Gemini Lake): Software | Intel’s list |
| Tremont | Affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Software 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Software 06_96H stepping All (Elkhart Lake (Tremont)): Software 06_9CH stepping All (Jasper Lake (Tremont)): Software | Intel’s list |
| Haswell | Not affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Not Affected 06_3FH stepping 4 (Haswell Server EX): Not Affected | Intel’s list |
| Broadwell | Not affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Not Affected 06_56H stepping 3 (Broadwell DE V2 - V3): Not Affected 06_56H stepping 4 (Broadwell DE Y0): Not Affected 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Not Affected | Intel’s list |
| Skylake | Not affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Not Affected | Intel’s list |
| Kaby Lake | Not affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Not Affected | Intel’s list |
| Coffee Lake | Not affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Not Affected 06_8EH stepping B (Whiskey Lake U): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping A (Coffee Lake H): Not Affected 06_9EH stepping C (Coffee Lake S): Not Affected 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Not Affected | Intel’s list |
| Comet Lake | Not affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_A5H stepping 2 (Comet Lake H): Not Affected 06_A5H stepping 3 (Comet Lake-S): Not Affected 06_A5H stepping 5 (Comet Lake-S): Not Affected 06_A6H stepping 0 (Comet Lake U62): Not Affected 06_A6H stepping 1 (Comet Lake U62): Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Not Affected | Intel’s list |
| Arrow Lake | Not affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Panther Lake | Not affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Not Affected | Intel’s list |
| Skylake-SP | Not affected | 06_55H stepping 3 (Skylake Server): Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Not Affected | Intel’s list |
| Cooper Lake | Not affected | 06_55H stepping B (Cooper Lake): Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Not Affected | Intel’s list |
| Clearwater Forest | Not affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Not Affected | Intel’s list |
Mitigations
- Kernel: Running the APIC in x2APIC mode, which removes the MMIO page and makes the registers MSRs. Instructions: WRMSR, RDMSR. Source.
- Microcode: Microcode that clears buffers when a logical processor leaves an enclave, and from February 2023 microcode that stops enclaves reading stale xAPIC data. Source.
- Programs: An updated SGX SDK that reads data outside the enclave in aligned 8-byte units. Source.