Vulnerability
Processor MMIO Stale Data
Accesses to device registers (MMIO) can move stale data where software or MDS-style sampling can read it; it matters most to guests given device access.
- Also known as
- MMIO Stale Data
- Kind
- Data sampling
- CVEs
- 3
- Published
- 2022
- Linux reports it in
mmio_stale_data
These flaws are not transient execution attacks by themselves. Some
operations on memory-mapped device registers copy stale data around
the uncore and into a core’s fill buffers, from where it can be
sampled, or, on client parts, read back directly. Most systems give
untrusted code no access to device registers; virtual machines with
a device assigned to them are the main concern.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2022-21123 | Shared Buffers Data Read (SBDR) (described below) | Intel | 2022-06-15 |
| CVE-2022-21125 | Shared Buffers Data Sampling (SBDS) | Intel | 2022-06-15 |
| CVE-2022-21166 | Device Register Partial Write (DRPW) | Intel | 2022-06-15 |
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/mmio_stale_data reports it; the kernel’s documentation lists the lines it can hold.
CVEs without a page of their own
The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.
CVE-2022-21123: Shared Buffers Data Read
Like Shared Buffers Data Sampling, but the stale data is read straight into registers a program can see; client parts only, in the same column of Intel's list. INTEL-SA-00615. Source. CVE record (2022-06-15).