Kernel Address Space Isolation Aims To Prevent Leaking Data From Hyper Threading Attacks

Kernel Address Space Isolation is an experimental feature in development by Oracle in aiming to prevent leaking sensitive data from Intel Hyper Threading due to speculative execution attacks like L1TF.

While disabling Intel Hyper Threading has become recommended for fending off newer speculative execution attacks, obviously many don't want to lose out on those extra threads. In particular, data centers and public cloud providers certainly don't want to give up on Hyper Threading as it will hurt their margins hard. Oracle began working on address space isolation for the Kernel-based Virtual Machine (KVM) but now that has evolved into Kernel Address Space Isolation as a generic address-space isolation framework and KVM simply being one of the consumers of this framework.

Kernel Address Space Isolation isolates the address spaces used by different areas of the kernel to prevent leaking bits between hyper threads as a result of attacks like L1T Terminal Fault / Foreshadow.

Oracle put this code under a "request for comments" flag and the engineer spearheading this work does acknowledge there are some bugs causing hangs that remain.

Those interested in this Kernel Address Space Isolation feature that could perhaps see the mainline kernel in the future can see the current RFC series on the kernel mailing list.