CVE-2018-12130: Infoleak

First published: Tue Nov 06 2018(Updated: )

A flaw was found by researchers in the implementation of fill buffers used by Intel microprocessors. A fill buffer holds data that has missed in the processor L1 data cache, as a result of an attempt to use a value that is not present. When a level 1 data cache miss occurs within an Intel core, the fill buffer design allows the processor to continue with other operations while the value to be accessed is loaded from higher levels of cache. The design also allows the result to be forwarded to the Execution Unit requiring the load directly without being written into the Level 1 data cache. A load operation is not decoupled in the same way that a store is, but it does involve an AGU (Address Generation Unit) operation. If the AGU generates a fault (#PF, etc.) or an assist (A/D bits) then the classical Intel design would block the load and later reissue it. In contemporary designs, it instead allows subsequent speculation operations to temporarily see a forwarded data value from the fill buffer slot prior to the load actually taking place. Thus it is possible to read data that was recently accessed by another thread if the fill buffer entry is not overwritten. Additional information: <a href="https://access.redhat.com/security/vulnerabilities/mds">https://access.redhat.com/security/vulnerabilities/mds</a> Upstream fixes: <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5</a> Intel Advisory: <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html">https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html</a>

Credit: Ke Sun Henrique Kawakami Kekai Hu Rodrigo Branco IntelYuval Yarom University of AdelaideBrandon Falk Microsoft Windows Platform Security TeamKe Sun Henrique Kawakami Kekai Hu Rodrigo Branco IntelGiorgi Maisuradze Microsoft ResearchHenrique Kawakami Kekai Hu Rodrigo Branco IntelMichael Schwarz Daniel Gruss Graz University of TechnologyAlyssa Milburn Sebastian Osterlund Pietro Frigo Kaveh Razavi Herbert Bos Cristiano Giuffrida VUSec group at VU AmsterdamDan Horea Lutas BitDefenderKe Sun Henrique Kawakami Kekai Hu Rodrigo Branco IntelMoritz Lipp Michael Schwarz Daniel Gruss Graz University of Technology secure@intel.com secure@intel.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/first-publish-date
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2018-12130
• agent/type
• collector/apple-support
• alias/CVE-2018-12127
• alias/CVE-2019-11091
• agent/software-canonical-lookup-request
• agent/remedy
• agent/weakness
• agent/severity
• agent/author
• collector/nvd-index
• collector/mitre-cve
• source/MITRE
• agent/references
• agent/tags
• collector/usn-cve
• source/Ubuntu
• agent/description
• collector/nvd-cve
• source/NVD
• agent/software-canonical-lookup
• agent/last-modified-date
• agent/event
• collector/security-tracker-debian
• source/Debian
• agent/softwarecombine
• agent/trending
• vendor/apple
• canonical/apple macos mojave
• canonical/apple high sierra
• canonical/apple sierra
• vendor/intel
• canonical/intel microarchitectural fill buffer data sampling firmware
• canonical/intel microarchitectural fill buffer data sampling
• vendor/fedoraproject
• canonical/fedoraproject fedora
• version/fedoraproject fedora/29
• package-manager/debian