Transient execution CPU vulnerabilities

Transient execution CPU vulnerabilities are vulnerabilities in a computer system in which a speculative execution optimization implemented in a microprocessor is exploited to leak secret data to an unauthorized party. The classic example is Spectre but since January 2018 many different vulnerabilities have been identified.

## Contents

* 1 Overview
* 2 Summary of Vulnerabilities
* 3 Notes
* 4 References
* 5 External Links

## Overview

Modern computers are highly parallel devices, composed of components with very different performance characteristics. If an operation (such as a branch) cannot yet be performed because some earlier slow operation (such as a memory read) has not yet completed, a microprocessor may attempt to predict the result of the earlier operation and execute the later operation speculatively, acting as if the prediction was correct. The prediction may be based on recent behavior of the system. When the earlier, slower operation completes, the microprocessor determines whether prediction was correct or incorrect. If it was correct then execution proceeds uninterrupted; if it was incorrect then the microprocessor rolls back the speculatively executed operations and repeats the original instruction with the real result of the slow operation.

In terms of the directly visible behavior of the computer it is as if the speculatively executed code "never happened". However, this speculative execution may affect the state of certain components of the microprocessor, such as the cache, and this effect may be discovered by careful monitoring of the timing of subsequent operations.

If an attacker can arrange that the speculatively executed code (which may be directly written by the attacker, or may be a suitable gadget that they have found in the targeted system) operates on secret data that they are unauthorized to access, and has a different effect on the cache for different values of the secret data, they may be able to discover the value of the secret data.

Starting in 2017, multiple examples of such vulnerabilities were identified, with publication starting in early 2018.

## Summary of Vulnerabilities

Hardware mitigations impose close to zero performance loss, while microcode and/or OS mitigations might incur quite a significant performance loss (depending on workload).

Various CPU microarchitectures not included in this table are also affected, among them are IBM Power, ARM, MIPS and others.[1][2][3][4]

Vulnerability  | N  | CVE  | Public Vulnerability Name

(codename)

| Affected CPU architectures and mitigations

|
|
|
|

Intel[5] | AMD[6]
Ice Lake[7] | Cascade Lake,

Comet Lake

| Whiskey Lake,

Amber Lake

| Coffee Lake (9th gen)[8] | Coffee Lake (8th gen)*  | Zen 1 / Zen 1+ | Zen 2[9]
Spectre  | 1  | 2017-5753 | Bounds Check Bypass  | OS/VMM | Microcode + OS/VMM  | Hardware + OS/VMM
Spectre  | 2  | 2017-5715 | Branch Target Injection  | Hardware + OS  | Microcode \+ OS  | Microcode + OS
SpectreRSB[10]/ret2spec[11] | 2  | 2018-15572 | Return Mispredict  |  |  |  |  |  |  |
Meltdown  | 3  | 2017-5754 | Rogue Data Cache Load  | Not affected  | Microcode  | Not affected
Spectre-NG  | 3a  | 2018-3640 | Rogue System Register Read  | Not affected[12] | Microcode
Spectre-NG  | 4  | 2018-3639 | Speculative Store Bypass | Hardware + OS/VMM[12] | Microcode + OS  | OS/VMM  | Hardware + OS/VMM
Foreshadow  | 5  | 2018-3615 | L1 Terminal Fault (L1TF)  | Not affected  | Microcode  | Not affected
Spectre-NG  |  | 2018-3665 | Lazy FP State Restore | OS/VMM[13]
Spectre-NG  | 1.1  | 2018-3693 | Bounds Check Bypass Store  | OS/VMM[14]
Spectre-NG  | 1.2  |  | Read-only Protection Bypass (RPB)  |  |  |  |  |  |  |
Foreshadow-OS  |  | 2018-3620 | L1 Terminal Fault (L1TF)  | Not affected  | Microcode + OS  | Not affected
Foreshadow-VMM  |  | 2018-3646 | L1 Terminal Fault (L1TF)
RIDL/ZombieLoad  |  | 2018-12130 | Microarchitectural Fill Buffer Data Sampling (MFBDS)
RIDL  |  | 2018-12127 | Microarchitectural Load Port Data Sampling (MLPDS)  | Not affected  | Not affected [1] | Not affected  | Microcode + OS [15]
RIDL  |  | 2019-11091 |

Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

| Not affected  | Microcode + OS
Fallout  |  | 2018-12126 | Microarchitectural Store Buffer Data Sampling (MSBDS)  | Not affected  | Not affected [2] | Not affected  | Microcode + OS
Spectre SWAPGS  | 1  | 2019-1125 | None yet[16][17][18] | Same as Spectre 1
RIDL/ZombieLoad v2  |  | 2019-11135 | Transactional Asynchronous Abort (TAA)[19][20][21] | Not Affected[22] | Microcode + OS

The 8th generation Coffee Lake architecture in this table also applies to a wide range of previously released Intel CPUs, not limited to the architectures based on Intel Core, Pentium 4 and Intel Atom starting with Silvermont.[23][24]

## Notes

1.^ Stepping 5 of the 2nd Generation Intel® Xeon® Scalable Processors based on Cascade Lake microarchitecture is affected by both MSBDS and MLPDS.

## References

1. ↑ "Meltdown and Spectre Status Page". https://wiki.netbsd.org/security/meltdown_spectre/.
2. ↑ Ltd, Arm. "Speculative Processor Vulnerability | Cache Speculation Issues Update" (in en). https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/latest-updates/cache-speculation-issues-update.
3. ↑ "About speculative execution vulnerabilities in ARM-based and Intel CPUs" (in en). https://support.apple.com/en-us/HT208394.
4. ↑ "Potential Impact on Processors in the POWER Family" (in en-US). 2019-05-14. https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/.
5. ↑ "Engineering New Protections Into Hardware" (in en). https://www.intel.com/content/www/us/en/architecture-and-technology/engineering-new-protections-into-hardware.html.
6. ↑ "AMD Product Security | AMD". 2019-08-10. https://www.amd.com/en/corporate/product-security.
7. ↑ Cutress, Dr Ian. "The Ice Lake Benchmark Preview: Inside Intel's 10nm". https://www.anandtech.com/show/14664/testing-intel-ice-lake-10nm/3.
8. ↑ online, heise. "Intel Core i9-9900K mit 8 Kernen und 5 GHz für Gamer" (in de-DE). https://www.heise.de/newsticker/meldung/Intel-Core-i9-9900K-mit-8-Kernen-und-5-GHz-fuer-Gamer-4183783.html.
9. ↑ Cutress, Ian. "AMD Zen 2 Microarchitecture Analysis: Ryzen 3000 and EPYC Rome". https://www.anandtech.com/show/14525/amd-zen-2-microarchitecture-analysis-ryzen-3000-and-epyc-rome.
10. ↑ "Spectre Returns! Speculation Attacks using the Return Stack Buffer" (PDF). https://www.usenix.org/system/files/conference/woot18/woot18-paper-koruyeh.pdf.
11. ↑ "ret2spec: Speculative Execution Using Return Stack Buffers" (PDF). 2018. https://arxiv.org/pdf/1807.10364.pdf.
12. ↑ 12.0 12.1 "Engineering New Protections Into Hardware" (in en). https://www.intel.com/content/www/us/en/architecture-and-technology/engineering-new-protections-into-hardware.html.
13. ↑ "INTEL-SA-00145". https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html.
14. ↑ "Bounds Check Bypass Store (BCBS) Vulnerability (INTEL-OSS-10002)". https://www.intel.com/content/www/us/en/support/articles/000029382/processors.html.
15. ↑ "Intel Deep Dive CPUID Enumeration and Architectural MSRs". https://software.intel.com/security-software-guidance/insights/deep-dive-cpuid-enumeration-and-architectural-msrs.
16. ↑ "Bitdefender SWAPGS Attack Mitigation Solutions". https://www.bitdefender.com/business/swapgs-attack.html.
17. ↑ "Documentation/admin-guide/hw-vuln/spectre.rst - chromiumos/third_party/kernel - Git at Google". https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/tags/v4.19.65/Documentation/admin-guide/hw-vuln/spectre.rst.
18. ↑ Winder, Davey (6 August 2019). "Microsoft Confirms New Windows CPU Attack Vulnerability, Advises All Users To Update Now". Forbes. https://www.forbes.com/sites/daveywinder/2019/08/06/microsoft-confirms-new-windows-cpu-attack-vulnerability--advises-all-users-to-update-now/. Retrieved 7 August 2019.
19. ↑ "Cyberus Technology: TSX Asynchronous Abort" (in en). https://www.cyberus-technology.de/.
20. ↑ at 18:02, Shaun Nichols in San Francisco 12 Nov 2019. "True to its name, Intel CPU flaw ZombieLoad comes shuffling back with new variant" (in en). https://www.theregister.co.uk/2019/11/12/zombieload_cpu_attack/.
21. ↑ Cimpanu, Catalin. "Intel's Cascade Lake CPUs impacted by new Zombieload v2 attack" (in en). https://www.zdnet.com/article/intels-cascade-lake-cpus-impacted-by-new-zombieload-v2-attack/.
22. ↑ "Intel Deep Dive TSX Asynchronous Abort" (in en). https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynchronous-abort.
23. ↑ "INTEL-SA-00088" (in en). https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00088.html.
24. ↑ "INTEL-SA-00115" (in en). https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html.

## External Links

1. Vulnerabilities associated with CPU speculative execution
2. A systematic evaluation of transient execution attacks and defenses
3. A dynamic tree of transient execution vulnerabilities for Intel, AMD and ARM CPUs
4. Transient Execution Attacks by Daniel Gruss, June 20, 2019
5. CPU Bugs

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Transient_execution_CPU_vulnerabilities&oldid=237799"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template