Intel Makes Public Two More Data Leakage Disclosures

Intel last night made public two more data leakage disclosures, which tie back to Zombieload and November's TAA issue.

Here are the new disclosures:

CVEID: CVE-2020-0548
Description: Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Base Score: 2.8 Low

CVE-2020-0549
Description: Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Base Score: 6.5 Medium

CVE-2020-0548 is referred to as Vector Register Sampling and CVE-2020-0549 is going as L1D Eviction Sampling.

A speculative execution side channel variant known as L1D Eviction Sampling may allow the data value of some modified cache lines in the L1 data cache to be inferred under a specific set of complex conditions.

L1D Eviction Sampling is to be mitigated by new CPU microcode updates.

A speculative execution side channel variant known as Vector Register Sampling may allow the partial data values of some vector operations to be inferred under a specific set of complex conditions that include vector operations executing after a period of vector inactivity.

Vector Register Sampling will also require CPU microcode updates and they recommend SMT scheduling restrictions to reduce the exposure risk.

As of writing no CPU microcode updates have been released for Linux users but as soon as that happens I'll begin with some tests for seeing any new performance overhead.