Intel has disclosed a new speculative execution side channel vulnerability, dubbed L1 Terminal Fault (L1TF), that could potentially leak information residing in the processor L1 data cache. Mitigations are already available, according to Intel, based on its latest Microcode Updates and corresponding updates to operating systems and hypervisor stacks.
The L1TF vulnerability comes in three varieties, which have in common the basic mechanism that can be exploited, namely the fact that the processor L1 cache content is shared across processes, and the existence of a short time window that an attacker process can leverage to read the cache when it still contains information belonging to a different process. The time window is triggered by the attempt at resolving a malformed or not-present page fault. Each described variant specializes in the kind of information that can be leaked:
- L1TF SGX (CVE–2018–3615): this variant can be exploited to read information from the processor SGX enclave, a protected area of execution in memory meant to make select code and data safe from disclosure or modification. SGX was previously thought to be resilient to speculative execution attacks, including Meltdown and Spectre.
- L1TF SMM (CVE–2018–3620): in this case, the attack target is the operating system kernel memory and the System Management Mode (SMM) memory.
- L1TF VMM (CVE–2018–3646): this variant of the vulnerability affects mostly hypervisors, making it possible to leak information from the Virtual Machine Monitor (VMM) memory across different virtual machines running on the same cloud.
Intel’s microcode update includes a mechanism enabling processors to empty the content of their L1 caches during certain privilege transitions to prevent the possibility of information being leaked. Additionally, it provides a mechanism for the OS to force the flushing of the cache. While Intel microcode updates fully mitigates the L1TF SGX variety when hyperthreading is not used, this is not the case with other scenarios and Intel has provided full guidance for OS/driver and VMM developers. Intel has also provided a list of all processors affected by the vulnerability, as well as a list of all mitigations available on the different architectures.
The L1TF vulnerability was initially discovered by two independent groups of security researchers, who notified Intel of a new Foreshadow attack they devised that could leak data from the SGX enclave. Intel developers, while investigating Foreshadow, identified two related attacks, dubbed Foreshadow-Next Generation, that put at risk information from the OS kernel, SMM, or hypervisor memory.
Many OS and cloud providers, including Amazon, Microsoft, RedHat, Google, and others, have released their own advisors and mitigation guidance.