Shulou(Shulou.com)06/01 Report--

What is the processor CacheOut vulnerability? in view of this problem, this article introduces the corresponding analysis and solution in detail, hoping to help more partners who want to solve this problem to find a more simple and feasible way.

0x00 vulnerability description

On January 27th, Intel officially confirmed and issued the CacheOut vulnerability announcement, the vulnerability number is: CVE-2020-0549. The vulnerability may allow data values in certain modified cache rows in the L1 data cache (L1D) to be inferred under a specific set of complex conditions. The vulnerability has not been found to have been exploited.

Intel refers to this vulnerability as L1D Eviction Sampling. On some processors in some microarchitectures, recently cleared modified L1D cache lines may be propagated to unused (invalid) L1D fill buffers. On processors affected by microarchitecture Data Samping (MDS) or Transactional Asynchronous Abort (TAA), data from the L1D fill buffer can be inferred using one of these side channel methods. Combining these two vulnerabilities, it is possible for an attacker to infer data values from modified cache rows that were previously deleted by L1D.

The researchers say AMD is not affected by CacheOut vulnerabilities because AMD does not provide features similar to Intel TSX in CPU. It has not been confirmed whether ARM and IBM are affected by this vulnerability.

0x01 affects products

Intel has confirmed that this vulnerability affects the following products:

0x02 repair recommendation

Intel will release Intel ®processor microcode updates to customers and partners. Intel recommends that users of affected Intel ®processors pay attention to the manufacturer's notification and update the microcode in a timely manner.

The answer to the question about the processor CacheOut vulnerability is shared here. I hope the above content can be of some help to you. If you still have a lot of doubts to be solved, you can follow the industry information channel to learn more about it.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.