Intel Makes Public Two More Data Leakage Disclosures
Written by Michael Larabel in Intel on 28 January 2020 at 06:42 AM EST. 36 Comments
INTEL --
Intel last night made public two more data leakage disclosures, which tie back to Zombieload and November's TAA issue.

Here are the new disclosures:
CVEID: CVE-2020-0548
Description: Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Base Score: 2.8 Low

CVE-2020-0549
Description: Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Base Score: 6.5 Medium

CVE-2020-0548 is referred to as Vector Register Sampling and CVE-2020-0549 is going as L1D Eviction Sampling.
A speculative execution side channel variant known as L1D Eviction Sampling may allow the data value of some modified cache lines in the L1 data cache to be inferred under a specific set of complex conditions.

L1D Eviction Sampling is to be mitigated by new CPU microcode updates.
A speculative execution side channel variant known as Vector Register Sampling may allow the partial data values of some vector operations to be inferred under a specific set of complex conditions that include vector operations executing after a period of vector inactivity.

Vector Register Sampling will also require CPU microcode updates and they recommend SMT scheduling restrictions to reduce the exposure risk.

As of writing no CPU microcode updates have been released for Linux users but as soon as that happens I'll begin with some tests for seeing any new performance overhead.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week