CVE-2019-1125 "SWAPGS" Is The Newest Spectre Vulnerability

CVE-2019-1125 was made public today or also referred to as the "SWAPGS" vulnerability as a new variant of Spectre V1 affecting Windows and Linux with Intel (and according to mixed information, AMD - though the current Linux kernel patches at least seem to only apply to Intel) x86_64 processors.

The SWAPGS vulnerability allows attackers to gain read access to privileged memory and builds off existing Spectre fixes. Red Hat has a great write-up on the technical side of this new vulnerability. There is also the CVE text.

Microsoft has already patched Windows 10 quietly for this vulnerability while Linux kernel patches already landed in Git. Linux distribution vendors are working on relevant kernel updates to push out for existing distribution kernels. No CPU microcode updates are required.

Fortunately it looks quite difficult to be able to exploit the SWAPGS vulnerability in practice but upgrading to a patched kernel is certainly recommended.

And, yes, it does look like it will impact performance... Benchmarks being worked on.

UPDATE: AMD is reporting "AMD believes it is not vulnerable to the SWAPGS variant attacks because AMD products are designed not to speculate on the new GS value following a speculative SWAPGS."