CVE-2018-12130: Infoleak

First published: Tue Nov 06 2018(Updated: )

A flaw was found by researchers in the implementation of fill buffers used by Intel microprocessors. A fill buffer holds data that has missed in the processor L1 data cache, as a result of an attempt to use a value that is not present. When a level 1 data cache miss occurs within an Intel core, the fill buffer design allows the processor to continue with other operations while the value to be accessed is loaded from higher levels of cache. The design also allows the result to be forwarded to the Execution Unit requiring the load directly without being written into the Level 1 data cache. A load operation is not decoupled in the same way that a store is, but it does involve an AGU (Address Generation Unit) operation. If the AGU generates a fault (#PF, etc.) or an assist (A/D bits) then the classical Intel design would block the load and later reissue it. In contemporary designs, it instead allows subsequent speculation operations to temporarily see a forwarded data value from the fill buffer slot prior to the load actually taking place. Thus it is possible to read data that was recently accessed by another thread if the fill buffer entry is not overwritten. Additional information: <a href="https://access.redhat.com/security/vulnerabilities/mds">https://access.redhat.com/security/vulnerabilities/mds</a> Upstream fixes: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5</a> Intel Advisory: <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html">https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html</a>

Credit: Ke Sun Henrique Kawakami Kekai Hu Rodrigo Branco IntelYuval Yarom University of AdelaideBrandon Falk Microsoft Windows Platform Security TeamGiorgi Maisuradze Microsoft ResearchMichael Schwarz Daniel Gruss Graz University of TechnologyAlyssa Milburn Sebastian Osterlund Pietro Frigo Kaveh Razavi Herbert Bos Cristiano Giuffrida VUSec group at VU AmsterdamDan Horea Lutas BitDefenderMoritz Lipp secure@intel.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/first-publish-date
• collector/launchpad-cve
• source/Launchpad
• agent/type
• agent/remedy
• agent/weakness
• agent/severity
• collector/mitre-cve
• source/MITRE
• agent/references
• collector/usn-cve
• source/Ubuntu
• agent/description
• agent/trending
• agent/source
• agent/author
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2018-12130
• agent/last-modified-date
• collector/apple-support
• alias/CVE-2018-12127
• alias/CVE-2019-11091
• agent/software-canonical-lookup-request
• agent/event
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup
• collector/nvd-index
• agent/tags
• agent/softwarecombine
• collector/security-tracker-debian
• source/Debian
• vendor/apple
• canonical/macos mojave
• canonical/macos high sierra
• vendor/intel
• canonical/intel microarchitectural fill buffer data sampling firmware
• vendor/fedoraproject
• canonical/red hat fedora
• version/red hat fedora/29
• package-manager/debian