Vulnerability
Fast Store Forwarding Predictor
A predictor that lets a load take a store's data before the addresses are checked; without microcode fixes another thread or privilege level could steer it.
- Also known as
- FSFP
- Kind
- Transient execution
- CVEs
- 2
- Published
- 2020–2022
Some Intel processors predict that a load will take its data from an
older store and start the load on that guess. A wrong guess is
caught and the load runs again, but the instructions in between ran
transiently with the store’s data, which a disclosure gadget in the
victim can turn into a cache side channel. Intel’s later microcode
isolates the predictor: activity in one domain does not steer it in
another, whether or not IBRS or STIBP is set.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2020-8698 | Fast Store Forwarding Predictor: cross-thread (FSFP) | Intel | 2020-11-12 |
| CVE-2021-0145 | Fast Store Forwarding Predictor: cross-domain (FSFP) | Intel | 2022-02-09 |