Vulnerability
L1 Terminal Fault
A load through a page table entry marked not present speculatively reads the L1 data cache at the physical address the entry still holds.
- Also known as
- L1TF, Foreshadow
- Kind
- Transient execution
- CVEs
- 3
- Published
- 2018
- Linux reports it in
l1tf
When a page table entry has its present bit clear, the processor
should ignore the rest of it. On affected Intel processors, a load
through such an entry still reads the L1 data cache speculatively at
the physical address in the entry, before the page fault. The
attacker no longer needs a mapping of the memory, only data in the
L1 cache at an address it can name, so the flaw crosses every
boundary: from user mode into the kernel and System Management Mode,
from a guest into the host and other guests (it bypasses the
extended page tables), and into SGX enclaves. Intel gave each of
these three a CVE of its own.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2018-3615 | L1 Terminal Fault: SGX (L1TF-SGX, Foreshadow) | Intel | 2018-08-14 |
| CVE-2018-3620 | L1 Terminal Fault: operating systems and SMM (L1TF-OS, Foreshadow-NG) | Intel | 2018-08-14 |
| CVE-2018-3646 | L1 Terminal Fault: virtualization (L1TF-VMM, Foreshadow-NG) | Intel | 2018-08-14 |
What the vendors say
- AMD: AMD states that its processors are not affected by L1TF (Foreshadow), because of its paging architecture. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/l1tf reports it; the kernel’s documentation lists the lines it can hold.