CVE-2019-1125 "SWAPGS" Is The Newest Spectre Vulnerability
Written by Michael Larabel in Linux Security on 6 August 2019 at 07:41 PM EDT. 27 Comments
LINUX SECURITY --
CVE-2019-1125 was made public today or also referred to as the "SWAPGS" vulnerability as a new variant of Spectre V1 affecting Windows and Linux with Intel (and according to mixed information, AMD - though the current Linux kernel patches at least seem to only apply to Intel) x86_64 processors.

The SWAPGS vulnerability allows attackers to gain read access to privileged memory and builds off existing Spectre fixes. Red Hat has a great write-up on the technical side of this new vulnerability. There is also the CVE text.

Microsoft has already patched Windows 10 quietly for this vulnerability while Linux kernel patches already landed in Git. Linux distribution vendors are working on relevant kernel updates to push out for existing distribution kernels. No CPU microcode updates are required.

Fortunately it looks quite difficult to be able to exploit the SWAPGS vulnerability in practice but upgrading to a patched kernel is certainly recommended.

And, yes, it does look like it will impact performance... Benchmarks being worked on.

UPDATE: AMD is reporting "AMD believes it is not vulnerable to the SWAPGS variant attacks because AMD products are designed not to speculate on the new GS value following a speculative SWAPGS."
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week