Microarchitectural Data Sampling

Short description: CPU vulnerabilities

Microarchitectural Data Sampling

Logo designed for the vulnerabilities, featuring a wounded hand holding a broken microprocessor.

CVE identifier(s)| CVE-2018-12126 (Fallout),
CVE-2018-12127 (RIDL),
CVE-2019-11091 (RIDL, ZombieLoad),
CVE-2018-12130 (RIDL, ZombieLoad),
CVE-2019-11135 (ZombieLoad v2)
Date discovered| 2018[1]
Date patched| 14 May 2019
Discoverer|  University of Adelaide
Graz University of Technology
Catholic University of Leuven
Qihoo 360
Cyberus Technology
Saarland University
Vrije Universiteit Amsterdam
Bitdefender
Oracle Corporation
University of Michigan
Worcester Polytechnic Institute[1]
Affected hardware| Pre-April 2019 Intel x86 microprocessors
Website| mdsattacks.com ZombieLoadAttack.com

The Microarchitectural Data Sampling (MDS) vulnerabilities are a set of weaknesses in Intel x86 microprocessors that use hyper-threading, and leak data across protection boundaries that are architecturally supposed to be secure. The attacks exploiting the vulnerabilities have been labeled Fallout, RIDL (Rogue In-Flight Data Load), ZombieLoad.,[2][3][4] and ZombieLoad 2.[5]

## Contents

* 1 Description
* 2 History
* 3 Impact
* 4 Mitigation
* 5 See also
* 6 References
* 7 Further reading
* 7.1 Original papers by the researchers
* 7.2 Information from processor manufacturers
* 8 External links

## Description

The vulnerabilities are in the implementation of speculative execution, which is where the processor tries to guess what instructions may be needed next. They exploit the possibility of reading data buffers found between different parts of the processor.[1][2][6][7]

* Microarchitectural Store Buffer Data Sampling (MSBDS), CVE-2018-12126
* Microarchitectural Load Port Data Sampling (MLPDS), CVE-2018-12127
* Microarchitectural Fill Buffer Data Sampling (MFBDS), CVE-2018-12130
* Microarchitectural Data Sampling Uncacheable Memory (MDSUM), CVE-2019-11091
* Transactional Asynchronous Abort (TAA), CVE-2019-11135

Not all processors are affected by all variants of MDS.[8]

## History

According to Intel in a May 2019 interview with Wired, Intel's researchers discovered the vulnerabilities in 2018 before anyone else.[1] Other researchers had agreed to keep the exploit confidential as well since 2018.[9]

On 14 May 2019, various groups of security researchers, amongst others from Austria's Graz University of Technology, Belgium's Catholic University of Leuven, and Netherlands' Vrije Universiteit Amsterdam, in a disclosure coordinated with Intel, published the discovery of the MDS vulnerabilities in Intel microprocessors, which they named Fallout, RIDL and ZombieLoad.[1][6] Three of the TU Graz researchers were from the group who had discovered Meltdown and Spectre the year before.[1]

On 12 November 2019, a new variant of the ZombieLoad attack, called Transactional Asynchronous Abort, was disclosed.[10][11]

## Impact

According to varying reports, Intel processors dating back to 2011[12] or 2008[1] are affected, and the fixes may be associated with a performance drop.[13][14] Intel reported that processors manufactured in the month before the disclosure have mitigations against the attacks.[1]

Intel characterized the vulnerabilities as "low-to-medium" impact, disagreeing with the security researchers who characterized them as major, and disagreeing with their recommendation that operating system software manufacturers should completely disable hyperthreading.[1][15] Nevertheless, the ZombieLoad vulnerability can be used by hackers exploiting the vulnerability to steal information recently accessed by the affected microprocessor.[16]

## Mitigation

Fixes to operating systems, virtualization mechanisms, web browsers and microcode are necessary.[1] As of 14 May 2019[update], applying available updates on an affected PC system was the most that could be done to mitigate the issues.[17]

* Intel incorporated fixes in its processors starting shortly before the public announcement of the vulnerabilities.[1]
* On 14 May 2019, a mitigation was released for the Linux kernel,[18] and Apple, Google, Microsoft, and Amazon released emergency patches for their products to mitigate ZombieLoad.[19]
* On 14 May 2019, Intel published a security advisory on its website detailing its plans to mitigate ZombieLoad.[7]

## See also

* Transient execution CPU vulnerabilities
* Hardware security bug

## References

1. ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 "Meltdown Redux: Intel Flaw Lets Hackers Siphon Secrets from Millions of PCs". WIRED. 14 May 2019. https://www.wired.com/story/intel-mds-attack-speculative-execution-buffer/.
2. ↑ 2.0 2.1 "New RIDL and Fallout Attacks Impact All Modern Intel CPUs". Bleeping Computer. 14 May 2019. https://www.bleepingcomputer.com/news/security/new-ridl-and-fallout-attacks-impact-all-modern-intel-cpus/.
3. ↑ Spectre-NG-Lücken: OpenBSD schaltet Hyper-Threading ab, heise.de, 2018-06, accessed 2019-09-29
4. ↑ Let's Talk To Linux Kernel Developer Greg Kroah-Hartman | Open Source Summit, 2019, TFIR, 2019-09-03
5. ↑ Winder, Davey (2019-11-13). "Intel Confirms 'ZombieLoad 2' Security Threat" (in en). https://www.forbes.com/sites/daveywinder/2019/11/13/zombie-inside-intel-confirms-zombieload-2-security-threat/.
6. ↑ 6.0 6.1 "ZombieLoad Attack". https://zombieloadattack.com/.
7. ↑ 7.0 7.1 "INTEL-SA-00233". https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html.
8. ↑ "Microarchitectural Data Sampling". The Linux kernel user's and administrator's guide. 2019-05-14. https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html.
9. ↑ "MDS attacks". https://mdsattacks.com.
10. ↑ Nichols, Shaun (12 November 2019). "True to its name, Intel CPU flaw ZombieLoad comes shuffling back with new variant" (in en). https://www.theregister.co.uk/2019/11/12/zombieload_cpu_attack/.
11. ↑ Cimpanu, Catalin. "Intel's Cascade Lake CPUs impacted by new Zombieload v2 attack" (in en). https://www.zdnet.com/article/intels-cascade-lake-cpus-impacted-by-new-zombieload-v2-attack/.
12. ↑ "New secret-spilling flaw affects almost every Intel chip since 2011". TechCrunch. 14 May 2019. http://social.techcrunch.com/2019/05/14/zombieload-flaw-intel-processors/.
13. ↑ "Intel Zombieload bug fix to slow data centre computers". BBC News. 15 May 2019. https://www.bbc.com/news/technology-48278400.
14. ↑ "Benchmarking AMD FX vs. Intel Sandy/Ivy Bridge CPUs Following Spectre, Meltdown, L1TF, Zombieload". Phoronix. 24 May 2019. https://www.phoronix.com/scan.php?page=article&item=sandy-fx-zombieload&num=1.
15. ↑ "Intel: You don't need to disable Hyper-Threading to protect against the ZombieLoad CPU exploit - "ZombieLoad" exploit seems to put Intel's Hyper-Threading at risk of being put down". PC World. 15 May 2019. https://www.pcworld.com/article/3395439/intel-hyper-threading-zombieload-cpu-exploit.html.
16. ↑ "ZombieLoad attack lets hackers steal data from Intel chips". 14 May 2019. https://www.theverge.com/2019/5/14/18623708/zombieload-attack-intel-processors-speculative-execution.
17. ↑ "What To Do About the Nasty New Intel Chip Flaw". Gizmodo. 14 May 2019. https://gizmodo.com/what-to-do-about-the-new-intel-chip-flaw-1834759126.
18. ↑ "ChangeLog-5.1.2". 14 May 2019. https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.2.
19. ↑ "Apple, Amazon, Google, Microsoft and Mozilla release patches for ZombieLoad chip flaws". TechCrunch. http://social.techcrunch.com/2019/05/14/intel-chip-flaws-patches-released/.

## Further reading

### Original papers by the researchers

* "ZombieLoad: Cross-Privilege-Boundary Data Sampling". 2019-05-14. https://zombieloadattack.com/zombieload.pdf.
* "RIDL: Rogue In-Flight Data Load". 2019-05-14. https://mdsattacks.com/files/ridl.pdf.
* "Fallout: Reading Kernel Writes From User Space". 2019-05-14. https://mdsattacks.com/files/fallout.pdf.
* "ZombieLoad: Cross Privilege-Boundary Data Leakage". Cyberus Technology GmbH. 2019-05-14. https://www.cyberus-technology.de/posts/2019-05-14-zombieload.html.
* "cpu.fail". Graz University of Technology. 2019-05-14. https://cpu.fail/.

### Information from processor manufacturers

* "Side Channel Vulnerability Microarchitectural Data Sampling". Intel. 2019-05-14. https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html.
* "Deep Dive: Intel Analysis of Microarchitectural Data Sampling". Intel. 2019-05-14. https://software.intel.com/security-software-guidance/insights/deep-dive-intel-analysis-microarchitectural-data-sampling.

## External links

* Official disclosure website of ZombieLoad
* RIDL and Fallout: MDS attacks Vrije Universiteit Amsterdam

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Microarchitectural Data Sampling. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Microarchitectural_Data_Sampling&oldid=236602"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template