When creating the initial fix for previous MDS issues. Intel created a firmware update that enabled buffer clearing on conditions which allowed the attack to take place.
- VERW instruction
- L1D_FLUSH instruction
- RSM (Return from System Management mode)
- SGX Enter and SGX Exit. (Secure Enclave Enter and Exit).
The VERW and L1D_FLUSH commands were used by operating system vendors to instruct the firmware running on the affected processors to overwrite buffer values that can be used in the various MDS attack set.
The particular flaw is that the L1D buffers were incorrectly cleared and not all bits of the buffer were set to zero. Some parts (Bits 16-31 and 48-63) of the buffer were restored to their last known value prior to clearing.
This allows a partial view into shared data by the system but not to the same extent as previous MDS flaws.
A local attacker would need to execute and MDS style attack on systems to gather intelligence on the system. The attack reliability is expected to be considerably less than previous MDS style attacks.
A microcode update from Intel is forthcoming with no expected performance impact.
Statement:
Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/solutions/2019-microcode-nov