MDS: The Newest Speculative Execution Side-Channel Vulnerability

Intel just disclosed a new speculative execution side-channel vulnerability in its processors similar to the existing Spectre/L1TF vulnerabilities. This new disclosure is called the Microarchitectural Data Sampling (MDS).

The Microarchitectural Data Sampling vulnerability was discovered by Intel researchers and independently reported as well by external researchers and is said to be similar to existing speculative execution side channel vulnerabilities. Fortunately, some current-generation CPUs are not vulnerable and Intel says all new processors moving forward will be mitigated. For those processors affected, microcode/software updates are said to be coming.

Microarchitectural Data Sampling can expose sensitive data to malicious users, assuming they already have access to the system in some capacity. MDS can lead to exposing data from store buffers, fill buffers, and load ports. There are four CVEs making up MDS:

- CVE-2018-12126 Microarchitectural Store Buffer Data Sampling (MSBDS)
- CVE-2018-12130 Microarchitectural Fill Buffer Data Sampling (MFBDS)
- CVE-2018-12127 Microarchitectural Load Port Data Sampling (MLPDS)
- CVE-2019-11091 Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

Intel microcode updates are said to be coming that will clear microarchitectural buffers when switching between software that does not trust each other. Besides the CPU microcode, kernel-level changes are also coming and likely to hypervisors too. No word on the performance impact in this initial disclosure.

Intel's public statement on the matter says, "Microarchitectural Data Sampling (MDS) is already addressed at the hardware level in many of our recent 8th and 9th Generation Intel Core processors, as well as the 2nd Generation Intel Xeon Scalable Processor Family. For other affected products, mitigation is available through microcode updates, coupled with corresponding updates to operating system and hypervisor software that are available starting today. We’ve provided more information on our website and continue to encourage everyone to keep their systems up to date, as its one of the best ways to stay protected. We’d like to extend our thanks to the researchers who worked with us and our industry partners for their contributions to the coordinated disclosure of these issues."

A public white paper is expected to be released momentarily and we'll be on the lookout for the updated microcode files and subsequent Linux kernel patches. When they are out, of course, I'll be firing up some benchmarks on Phoronix to look at the impact.