TheMicroarchitectural Data Sampling (MDS)vulnerabilities are a set of weaknesses inIntel x86 microprocessors that usehyper-threading, and leak data across protection boundaries that are architecturally supposed to be secure. The attacks exploiting the vulnerabilities have been labeledFallout,RIDL (Rogue In-Flight Data Load),ZombieLoad.,[2][3][4] andZombieLoad 2.[5]
The vulnerabilities are in the implementation ofspeculative execution, which is where the processor tries to guess what instructions may be needed next. They exploit the possibility of readingdata buffers found between different parts of the processor.[1][2][6][7]
Microarchitectural Store Buffer Data Sampling (MSBDS),CVE-2018-12126
Microarchitectural Load Port Data Sampling (MLPDS), CVE-2018-12127
Microarchitectural Fill Buffer Data Sampling (MFBDS), CVE-2018-12130
Microarchitectural Data Sampling Uncacheable Memory (MDSUM), CVE-2019-11091
According to Intel in a May 2019 interview withWired, Intel's researchers discovered the vulnerabilities in 2018 before anyone else.[1] Other researchers had agreed to keep the exploit confidential as well since 2018.[9]
According to varying reports, Intel processors dating back to 2011[12] or 2008[1] are affected, and the fixes may be associated with aperformance drop.[13][14] Intel reported that processors manufactured in the month before the disclosure have mitigations against the attacks.[1]
Intel characterized the vulnerabilities as "low-to-medium" impact, disagreeing with the security researchers who characterized them as major, and disagreeing with their recommendation that operating system software manufacturers should completely disablehyperthreading.[1][15] Nevertheless, the ZombieLoad vulnerability can be used by hackers exploiting the vulnerability to steal information recently accessed by the affected microprocessor.[16]
University of Adelaide
Graz University of Technology
Catholic University of Leuven
Qihoo 360
Cyberus Technology
Vrije Universiteit Amsterdam
Bitdefender
Oracle Corporation