Microarchitectural Data Sampling

Lore & Background

Microarchitectural Data Sampling (MDS) refers to a group of security flaws in Intel x86 processors that support hyper-threading. These flaws allow data to leak across security boundaries that are architecturally meant to be secure. The attacks that exploit these vulnerabilities are known as Fallout, RIDL (Rogue In-Flight Data Load), ZombieLoad, and ZombieLoad 2.

The vulnerabilities arise from the implementation of speculative execution, a technique where the processor predicts which instructions might be needed next. They work by reading data buffers located between different parts of the processor. Specific variants include Microarchitectural Store Buffer Data Sampling (MSBDS), Microarchitectural Load Port Data Sampling (MLPDS), Microarchitectural Fill Buffer Data Sampling (MFBDS), Microarchitectural Data Sampling Uncacheable Memory (MDSUM), and Transactional Asynchronous Abort (TAA), which is tracked as CVE-2019-11135. Not every Intel processor is affected by all MDS variants.

Intel stated in a May 2019 interview with Wired that its own researchers discovered these vulnerabilities in 2018, before anyone else. Other researchers had also agreed to keep the exploit confidential from that year. On May 14, 2019, multiple security research groups—including teams from Austria's Graz University of Technology, Belgium's Catholic University of Leuven, and the Netherlands' Vrije Universiteit Amsterdam—published their findings in a disclosure coordinated with Intel. They named the vulnerabilities Fallout, RIDL, and ZombieLoad. Three of the researchers from Graz University of Technology were part of the group that had discovered Meltdown and Spectre the previous year. On November 12, 2019, a new variant of the ZombieLoad attack, called Transactional Asynchronous Abort, was disclosed.

Reports indicate that Intel processors dating back to either 2011 or 2008 are affected. Fixes may come with a performance drop. Intel stated that processors manufactured shortly before the public disclosure already included mitigations. Intel characterized the vulnerabilities as having a "low-to-medium" impact, disagreeing with security researchers who considered them major and who recommended that operating system vendors disable hyper-threading entirely. Nonetheless, the ZombieLoad vulnerability can be used by attackers to steal information recently accessed by the affected processor.

Mitigations require fixes to operating systems, virtualization mechanisms, web browsers, and microcode. Applying available updates on an affected PC was the most that could be done to address the issues. Intel incorporated fixes into its processors starting just before the public announcement. On May 14, 2019, a mitigation was released for the Linux kernel, and Apple, Google, Microsoft, and Amazon issued emergency patches for their products to address ZombieLoad. On the same day, Intel published a security advisory on its website detailing its plans to mitigate ZombieLoad.

Reader's Guide

The MDS vulnerabilities represent a significant class of transient execution CPU flaws, following the earlier Meltdown and Spectre discoveries. Intel characterized the vulnerabilities as 'low-to-medium' impact, disagreeing with security researchers who characterized them as major and with their recommendation that operating system software manufacturers should completely disable hyperthreading. Nevertheless, the ZombieLoad vulnerability can be used by hackers to steal information recently accessed by the affected microprocessor. According to varying reports, Intel processors dating back to 2011 or 2008 are affected, and the fixes may be associated with a performance drop. Intel reported that processors manufactured in the month before the disclosure have mitigations against the attacks. Fixes to operating systems, virtualization mechanisms, web browsers and microcode are necessary. On 14 May 2019, a mitigation was released for the Linux kernel, and Apple, Google, Microsoft, and Amazon released emergency patches for their products to mitigate ZombieLoad. Intel published a security advisory on its website detailing its plans to mitigate ZombieLoad. Applying available updates on an affected PC system was the most that could be done to mitigate the issues.

Did You Know?

• The vulnerabilities exploit data buffers found between different parts of the processor.
• Not all processors are affected by all variants of MDS.
• Intel incorporated fixes in its processors starting shortly before the public announcement of the vulnerabilities.
• Three of the Graz University of Technology researchers were from the group who discovered Meltdown and Spectre.