Data Sampling on MDS-Resistant 10Th Generation Intel Core (Ice Lake) 1
Data Sampling on MDS-resistant 10th Generation Intel Core (Ice Lake) Daniel Moghimi Worcester Polytechnic Institute, Worcester, MA, USA Abstract the store buffer. MSBDS has been shown in attacks on the kernel space as well as on SGX [1]. In addition to the leakage Microarchitectural Data Sampling (MDS) is a set of hardware component, MSBDS can also be turned around easily to tran- vulnerabilities in Intel CPUs that allows an attacker to leak siently inject values into a victim, an attack technique known bytes of data from memory loads and stores across various as Load Value Injection (LVI) [14]. security boundaries. On affected CPUs, some of these vulner- abilities were patched via microcode updates. Additionally, To mitigate these vulnerabilities, Intel released software Intel announced that the newest microarchitectures, namely workarounds and microcode updates for affected CPUs [4]. Cascade Lake and Ice Lake, were not affected by MDS. While One of the most recent microarchitectures, Ice Lake, is re- Cascade Lake turned out to be vulnerable to the ZombieLoad ported to be unaffected by MDS attacks [6,8]. Intel has also v2 MDS attack (also known as TAA), Ice Lake was not af- explicitly listed Ice Lake processors as not being vulnera- fected by this attack. ble to LVI-SB [14], which exploits MSBDS for Load Value Injection [7]. In this technical report, we show a variant of MSBDS (CVE- 2018-12126), an MDS attack, also known as Fallout, that To better analyze the MDS vulnerabilities, and potentially works on Ice Lake CPUs. This variant was automatically find new variants, Moghimi et al.
[Show full text]