Intel GDS/Downfall Linux Mitigation Updated To Confirm All Skylake CPUs Are Affected

The Linux mitigation for the Intel Gather Data Sampling (GDS) "Downfall" vulnerability was updated to reflect all Skylake and Kabylake CPUs being vulnerable to this nasty issue. Due to those Skylake client processors reaching the end of their official support life at Intel, the original Linux mitigation for GDS/Downfall didn't properly protect those older Core processor models.

A new patch has been queued via TIP's x86/urgent for introduction soon to the mainline kernel. The patch marks all Skylake (and Kabylake) CPUs as vulnerable to Downfall.

As noted in the patch, due to the support window for those older processors, the client Skylake processors weren't mentioned as part of the GDS/Downfall disclosure from Intel even though the processors are affected. With those models not being mentioned in the GDS documentation, the Linux patch didn't apply protection to those models.

The patch fixing the client Skylake protection was written by longtime Intel Linux engineer Dave Hansen. In the patch he mentioned:

"I very much appreciate the report from Michael Zhivich [of Akamai] about this issue. Despite what level of support a hardware vendor is providing, the kernel very much needs an accurate and up-to-date list of vulnerable CPUs. More reports like this are very welcome."

Look for the patch to be mainlined shortly and back-ported to the stable Linux kernel versions. See my prior Downfall mitigation benchmarks from newer Intel CPUs and I'll have up some complementary tests soon.