Tables of Contents:

Introduction

This document should be read together with the following articles:

And the references used here are, among the documents above, the following docs:

How to read this document ?

You should read this!
This is deeper information, you may ignore.
This is a CPU vulnerability!
This is a mitigation technique.
This is a CPU flag to advertise Kernel and/or Hypervisor.

Notes:

1. Sometimes the mitigation name is the acronym for the CPU flag, example: Indirect Branch Prediction Barrier - ibpb. And sometimes some CPU flag might mitigate more than 1 vulnerability.

2. Downloading the HTML from the wiki (through the proper Download link at the top) and opening it locally will make it better for reading (no CSS themes). You can also print it to PDF if you'd like.

Also, do check articles dates and look for newer ones not yet updated in this document. Newer side channel attack techniques might have been discovered by the time this page was created. If you feel this page should be updated, please send us an e-mail at: ubuntu-server@lists.ubuntu.com mentioning what should be updated and why.

Related CPU Vulnerabilities (CVEs)

Side Channel Attacks - Spectre and Meltdown

1. CVE-2017-5753 - Bounds Check Bypass (Variant 1 / Spectre)

2. CVE-2017-5715 - Branch Target Injection (Variant 2 / Spectre)

3. CVE-2017-5754 - Rogue Data Cache Load (Variant 3 / Meltdown)

Side Channel Attacks - Others

1. CVE-2018-3665 - Lazy FP Save/Restore (LazyFP)

2. CVE-2018-3693 - Bounds Check Bypass Store (Variant (or Spectre) 1.1 and 1.2 / BCBS)

3. CVE-2018-3640 - Rogue System Register Read (RSRE / Variant 3a)

4. CVE-2018-3639 - Speculative Store Bypass (SSB / Variant 4 / Spectre-NG)

L1 Terminal Fault (L1TF)

1. CVE-2018-3615 - Intel SGX (Software Guard Extensions) (Foreshadow / L1TF)

2. CVE-2018-3620 - Operating Systems and System Management Mode (Fault-OS / SMM) (L1TF)

3. CVE-2018-3646 - Virtualization Extensions (L1TF)

Microarchitectural Data Sampling (MDS)

1. CVE-2018-12126 - Microarchitectural Store Buffer Data Sampling (MSBDS / Fallout)

2. CVE-2018-12127 - Microarchitectural Load Port Data Sampling (MLPDS / RIDL)

3. CVE-2018-12130 - Microarchitectural Fill Buffer Data Sampling (MFBDS / ZombieLoad)

4. CVE-2019-11091 - Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This CVE topic structure is used in the same order in all subsequent sections of this document.
The idea is to allow reader to map:

CPU Vulnerabilities, HW / Firmware, Kernel and OS Mitigations

Side Channel Attacks - Spectre and Meltdown

1. CVE-2017-5753 - Bounds Check Bypass (Variant 1 / Spectre)

   _user pointer sanitization

   To mitigate this exploit technique in the Linux kernel, we first identify instruction sequences that can be tricked into exploitable behavior. Since a sequence must fit a specific pattern and operate on untrusted data before any potential exploit, not all conditional branches are exploitable. Techniques such as static analysis or manual inspection can identify these sequences.

2. CVE-2017-5715 - Branch Target Injection (Variant 2 / Spectre)

   
   The branch target injection exploit targets a processor’s 'indirect branch predictor'. Indirect branches are used very differently than the conditional branches that the first exploit may target. In Linux, indirect branches are used relatively rarely compared to conditional branches, but they are used in critical locations. In addition, the compiler may insert indirect branches without the programmer ever being aware.
   
   Since the compiler generates these branches, mitigation against this exploit is the most straightforward when the compiler can simply avoid generating vulnerable branch sequences. A software construct called retpoline can be deployed to help ensure that a given indirect branch is resistant to exploitation. The compiler, automatically, or the programmer, manually, can insert the retpoline logic in binary code. Retpoline deliberately steer the processor’s branch prediction logic to a trusted location, preventing a potential exploit from steering them elsewhere.

3. CVE-2017-5754 - Rogue Data Cache Load (Variant 3 / Meltdown)

QEMU/KVM ONLY - Mitigations and CPU Flags

Spectre and Meltdown mitigation detection tool