Security Microarchitectural Data Sampling (MDS) Speculative Execution Side Channel Vulnerability (Zombieload)

eva2000 · May 15, 2019

On May 14th 2019, Intel released a statement regarding Microarchitectural Data Sampling (MDS) Speculative Execution Side Channel Vulnerability named, Zombieload which affects Cloud VPS providers like DigitalOcean, Vultr, Linode, Upcloud etc using older Intel cpus.

Intel's newest 8th and 9th Generation Intel Core processors, as well as the 1st Generation Intel Xeon Scalable Processor Family are also affected according to Intel. So we will expect cloud VPS hosting providers will be contacting their customers to inform them of their plans and steps to mitigate MDS side channel vulnerability via microcode updates and Linux Kernel updates. So yes you will need to do yum update when new Linux Kernels are available and do server reboot.

For desktop/laptop users, their manufacturers would also have updates, bios/firmware level updates and operating system updates for this I suspect.

Intel Side Channel Vulnerability MDS

https://blog.digitalocean.com/may-2019-intel-vulnerability/

Intel’s MDS (ZombieLoad) CPU Vulnerabilities & Linode

https://www.phoronix.com/scan.php?page=news_item&px=Microarch-Data-Sampling

Intel CPUs impacted by new Zombieload side-channel attack | ZDNet

ZombieLoad Attack

https://mdsattacks.com/

RedHat & CentOS Kernel Updates For MDS Vulnerabilities

Redhat & CentOS Kernel Updates are starting to show up in YUM repositories for MDS Vulnerabilities. Note the Kernel updates themselves require a server reboot however to fill fix this, you'd need web host's to also update the bios/microcode updates to their servers which also require a reboot/downtime. For OpenVZ VPS users, you're Linux Kernel is derived from VPS host node's Kernel so you need for your web host to update their Linux Kernels which may involve server reboots as OpenVZ VPS users have no control over Linux Kernel they use unlike KVM/Xen/VMware or bare metal server users.

From MDS - Microarchitectural Data Sampling - CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 - Red Hat Customer Portal where RedHat mentions also imply CentOS. Both CentOS 6 and 7 are affected.

Take Action
Red Hat customers running affected versions of these Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the available updates immediately and enable the mitigations as they feel appropriate.

The order the patches are applied is not important, but after updating firmware and hypervisors, every system/virtual machine will need to power off and restart to recognize a new hardware type.
Click to expand...

Redhat 8 https://access.redhat.com/errata/RHSA-2019:1167 Linux Kernel = kernel-4.18.0-80.1.2

Redhat 7 / CentOS 7 https://access.redhat.com/errata/RHSA-2019:1168 Linux Kernel = kernel-3.10.0-957.12.2

Redhat 6 / CentOS 6 https://access.redhat.com/errata/RHSA-2019:1169 Linux Kernel = kernel-2.6.32-754.14.2

Example for CentOS 7 yum list update listing available updates
Code (Text):
yum list updates
Code (Text):
glibc.x86_64                  2.17-260.el7_6.5                  updates         
glibc-common.x86_64           2.17-260.el7_6.5                  updates         
glibc-devel.x86_64            2.17-260.el7_6.5                  updates         
glibc-headers.x86_64          2.17-260.el7_6.5                  updates         
kernel.x86_64                 3.10.0-957.12.2.el7               updates         
kernel-devel.x86_64           3.10.0-957.12.2.el7               updates         
kernel-headers.x86_64         3.10.0-957.12.2.el7               updates         
kernel-tools.x86_64           3.10.0-957.12.2.el7               updates         
kernel-tools-libs.x86_64      3.10.0-957.12.2.el7               updates         
microcode_ctl.x86_64          2:2.1-47.2.el7_6                  updates
Run yum update
Code (Text):
yum -y update
Then reboot server for Linux Kernel update to take effect and verify with command
Code (Text):
uname -r
Code (Text):
uname -r
3.10.0-957.12.2.el7.x86_64
More Info

From Phoronix

The Microarchitectural Data Sampling vulnerability was discovered by Intel researchers and independently reported as well by external researchers and is said to be similar to existing speculative execution side channel vulnerabilities. Fortunately, some current-generation CPUs are not vulnerable and Intel says all new processors moving forward will be mitigated. For those processors affected, microcode/software updates are said to be coming.

Microarchitectural Data Sampling can expose sensitive data to malicious users, assuming they already have access to the system in some capacity. MDS can lead to exposing data from store buffers, fill buffers, and load ports. There are four CVEs making up MDS:

- CVE-2018-12126 Microarchitectural Store Buffer Data Sampling (MSBDS)
- CVE-2018-12130 Microarchitectural Fill Buffer Data Sampling (MFBDS)
- CVE-2018-12127 Microarchitectural Load Port Data Sampling (MLPDS)
- CVE-2019-11091 Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

Intel microcode updates are said to be coming that will clear microarchitectural buffers when switching between software that does not trust each other. Besides the CPU microcode, kernel-level changes are also coming and likely to hypervisors too. No word on the performance impact in this initial disclosure.
Click to expand...

From Redhat MDS - Microarchitectural Store Buffer Data - CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 - Red Hat Customer Portal

Four new microprocessor flaws have been discovered, the most severe of which is rated by Red Hat Product Security as having an Important impact. These flaws, if exploited by an attacker with local shell access to a system, could allow data in the CPU’s cache to be exposed to unauthorized processes. While difficult to execute, a skilled attacker could use these flaws to read memory from a virtual or containerized instance, or the underlying host system. Red Hat has mitigations prepared for affected systems and has detailed steps customers should take as they evaluate their exposure risk and formulate their response.

Issue Details and Background Information
Red Hat has been made aware of a series of microarchitectural (hardware) implementation issues that could allow an unprivileged local attacker to bypass conventional memory security restrictions in order to gain read access to privileged memory that would otherwise be inaccessible. These flaws could also be exploited by malicious code running within a container. These issues affect many modern Intel microprocessors, requiring updates to the Linux kernel, virtualization stack, and updates to CPU microcode. The issues have been assigned CVE-2018-12130, as a severity impact of Important, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 are considered Moderate severity.

At this time, these specific flaws are only known to affect Intel-based processors, although Red Hat Product Security expects researchers to continue probing for unrelated Simultaneous Multi Threading (SMT) vulnerabilities across a wide range of vendors.

Flaws were found with the manner in which Intel microprocessor designs implement several performance micro-optimizations. Exploitation of the vulnerabilities provide attackers a side channel to access recently used data on the system belonging to other processes, containers, virtual machines, or to the kernel.

These vulnerabilities are referred to as Microarchitectural Data Sampling (MDS) due to the fact that they rely upon leveraging speculation to obtain state left within internal CPU structures.
Click to expand...

From DigitalOcean

Today, Intel released a statement regarding Microarchitectural Data Sampling (MDS) – also referred to as ZombieLoad – a significant security vulnerability that affects cloud providers with multi-tenant environments, including DigitalOcean. Left unmitigated, this vulnerability could allow sophisticated attackers to gain access to sensitive data, secrets, and credentials that could allow for privilege escalation and unauthorized access to user data.

We have been working closely with Intel to understand the impact of these vulnerabilities and the best courses of action to protect our platform and our users. We have received updated microcode from Intel and developed a set of kernel updates to mitigate the vulnerability, and we are rapidly rolling out these mitigations with no downtime to our users.

We also recommend taking steps to ensure your Droplet is up to date and secure. This is especially important if you are running multi-tenant applications or untrusted code inside your Droplet.

In addition to sharing this blog post, we’re reaching out to all users via email. We’ll continue to post informational updates here, and we will reach out directly to users should any additional action be required.

The security of our platform and our users’ data is our top priority, and we’re taking every measure to ensure our customers remain secure. For more information about MDS, you can read Intel’s initial statement.
Click to expand...

From ZombieLoad Attack

After Meltdown, Spectre, and Foreshadow, we discovered more critical vulnerabilities in modern processors. The ZombieLoad attack allows stealing sensitive data and keys while the computer accesses them.

While programs normally only see their own data, a malicious program can exploit the fill buffers to get hold of secrets currently processed by other running programs. These secrets can be user-level secrets, such as browser history, website content, user keys, and passwords, or system-level secrets, such as disk encryption keys.

The attack does not only work on personal computers but can also be exploited in the cloud.

Make sure to get the latest updates for your operating system!
Click to expand...

From https://mdsattacks.com/

The RIDL and Fallout speculative execution attacks allow attackers to leak confidential data across arbitrary security boundaries on a victim system, for instance compromising data held in the cloud or leaking your information to malicious websites. Our attacks leak data by exploiting the newly disclosed Microarchitectural Data Sampling (or MDS) side-channel vulnerabilities in Intel CPUs. Unlike existing attacks, our attacks can leak arbitrary in-flight data from CPU-internal buffers (Line Fill Buffers, Load Ports, Store Buffers), including data never stored in CPU caches. We show that existing defenses against speculative execution attacks are inadequate, and in some cases actually make things worse. Attackers can use our attacks to obtain sensitive data despite mitigations, due to vulnerabilities deep inside Intel CPUs.
Click to expand...

Redhat video explaining MDS Side Channel Vulnerability

eva2000 · May 15, 2019

From Zdnet Intel CPUs impacted by new Zombieload side-channel attack | ZDNet

Academics have discovered a new class of vulnerabilities in Intel processors that can allow attackers to retrieve data being processed inside a CPU.

The leading attack in this new vulnerability class is a security flaw named Zombieload, which is another side-channel attack in the same category as Meltdown, Spectre, and Foreshadow.

NEW ATTACK ON SPECULATIVE EXECUTION
Just like the first three, Zombieload is exploited by taking advantage of the speculative execution process, which is an optimization technique that Intel added to its CPUs to improve data processing speeds and performance.

For more than a year, academics have been poking holes in various components of the speculative execution process, revealing ways to leak data from various CPU buffer zones and data processing operations. Meltdown, Spectre, and Foreshadow have shown how various CPU components leak data during the speculative execution process.

Today, an international team of academics -- including some of the people involved in the original Meltdown and Spectre research -- along with security researchers from Bitdefender have disclosed a new attack impacting the speculative execution process.

This one is what researchers have named a Microarchitectural Data Sampling (MDS) attack, and targets a CPU's microarchitectural data structures, such as the load, store, and line fill buffers, which the CPU uses for fast reads/writes of data being processed inside the CPU. These are smaller-sized caches that are used alongside the main CPU cache.

By exploiting normal speculative execution operations that work within these microarchitectural structures, an MDS attack can infer data that is being processed in the CPU by other apps, to which an attacker shouldn't normally have access to.
Click to expand...

THE GOOD NEWS
But things aren't as bleak as they were when Meltdown and Spectre were first disclosed in January 2018. For starters, Intel hasn't been caught with its pants down like the last time, and the company has already shipped microcode updates.

Furthermore, newer processors aren't impacted, as they already include protections against speculative execution attacks --such as the MDS attacks-- since last year when Meltdown and Spectre first hit, and Intel modified the way its CPU's worked.

In addition, Microsoft, Apple, and the Linux project are expected to have operating system updates roll out later today, or in the coming days.

"Microarchitectural Data Sampling (MDS) is already addressed at the hardware level in many of our recent 8th and 9th Generation Intel Core processors, as well as the 2nd Generation Intel Xeon Scalable Processor Family," Intel told ZDNet via email last week.

"For other affected products, mitigation is available through microcode updates, coupled with corresponding updates to operating system and hypervisor software that are available starting today."
Click to expand...

eva2000 · May 15, 2019

Microsoft Windows https://support.microsoft.com/en-au...ct-against-speculative-execution-side-channel

Summary

Microsoft is aware of new variants of the class of attack known as speculative execution side-channel vulnerabilities. The variants are named L1 Terminal Fault (L1TF) and Microarchitectural Data Sampling (MDS). An attacker who can successfully exploit L1TF or MDS may be able to read privileged data across trust boundaries.

UPDATED ON May 14, 2019: On May 14, 2019, Intel published information about a new subclass of speculative execution side-channel vulnerabilities known as Microarchitectural Data Sampling. They have been assigned the following CVEs:

CVE-2018-11091 – “Microarchitectural Data Sampling Uncacheable Memory (MDSUM)”

CVE-2018-12126 – “Microarchitectural Store Buffer Data Sampling (MSBDS)”

CVE-2018-12127 – “Microarchitectural Fill Buffer Data Sampling (MFBDS)”

CVE-2018-12130 – “Microarchitectural Load Port Data Sampling (MLPDS)”

Click to expand...

Mitigation overview
To resolve these issues, Microsoft is working together with Intel to develop software mitigations and guidance. Software updates to help mitigate the vulnerabilities have been released. To obtain all available protections, updates may be required that could also include microcode from device OEMs.

This article describes how to mitigate the following vulnerabilities:

CVE-2018-3620 – "L1 Terminal Fault – OS, SMM"

CVE-2018-3646 – "L1 Terminal Fault – VMM"

CVE-2018-11091 – "Microarchitectural Data Sampling Uncacheable Memory (MDSUM)"

CVE-2018-12126 – "Microarchitectural Store Buffer Data Sampling (MSBDS)"

CVE-2018-12127 – "Microarchitectural Load Port Data Sampling (MLPDS)"

CVE-2018-121 30 – "Microarchitectural Fill Buffer Data Sampling (MFBDS)"

To learn more about the vulnerabilities see the following security advisories:

L1TF: {{windowTitle}}

MDS: {{windowTitle}}
Click to expand...

eva2000 · May 15, 2019

From https://www.securityweek.com/new-class-data-leaking-vulnerabilities-impact-intel-cpus

The attack methods work against both PCs and cloud environments, and they can be launched against most Intel CPUs made in the past decade. The techniques can be used to get applications, the operating system, virtual machines and trusted execution environments to leak information, including passwords, website content, disk encryption keys and browser history.

For example, experts have demonstrated that hackers can use the ZombieLoad attack, which is a subclass of RIDL, to obtain a user’s browsing history even if the victim surfs the web from a virtual machine and uses the Tor anonymity network.

The Fallout method is mostly useful for determining the operating system’s memory position, which researchers say strengthens the other attacks.

The vulnerabilities can be exploited using malware planted on the targeted devices, but some of them can also be exploited remotely from the internet via JavaScript code and malicious websites.

Researchers warned that it may be difficult for cybersecurity software to detect attacks, and exploitation of the flaws might not leave any traces in log files. For the time being, there is no evidence of malicious attacks and experts believe the flaws are more likely to be exploited in highly targeted operations.

Intel said the vulnerabilities were first identified by its own researchers and partners, and later independently reported by others, including experts who discovered the original Meltdown and Spectre vulnerabilities. The company has credited researchers from the University of Michigan, Worcester Polytechnic Institute, Graz University of Technology, imec-DistriNet, KU Leuven, University of Adelaide, Microsoft, the VUSec group at VU Amsterdam, Bitdefender (which published its own paper), Oracle, and Qihoo 360.

A timeline published by researchers shows that Intel started receiving reports about the weaknesses in June 2018.
Click to expand...

eva2000 · May 15, 2019

From https://mdsattacks.com/ exploit demos for three RIDL exploits in action, leaking the root password hash from an unprivileged user, sensitive data from the Linux OS kernel, and JavaScript

In this video, we leak the /etc/shadow file by repeatedly trying to authenticate an user. The animation is sped up for the latter part of the video, the total process takes about 24 hours at the moment.
Click to expand...

In this video, we show how to leak recent kernel data using RIDL. This demo first reads 0 bytes from /proc/version, whereafter we are able to leak the full contents of /proc/version without the data ever present in userspace.
Click to expand...

We leak a string from another process using Javascript and WebAssembly in the SpiderMonkey engine.
Click to expand...

MDS Tool from RIDL Team

Verify whether your system is vulnerable today with our MDS tool.

Windows https://mdsattacks.com/files/mdstool-win.zip

Linux https://mdsattacks.com/files/mdstool-linux.zip

Github vusec/ridl

FAQ

Am I affected ?

Very likely. Our attacks affect all modern Intel CPUs in servers, desktops and laptops. This includes the latest 9th-generation processors, despite their in-silicon mitigations for Meltdown. Ironically, 9th-generation CPUs are more vulnerable to some of our attacks compared to older generation hardware.

Processors from other vendors (AMD and ARM) do not appear to be affected. Official statements from these vendors can be found in the RIDL and Fallout papers.
Click to expand...

What's with all the different attack names, teams, and authors?

Multiple teams and researchers independently discovered, studied, and reported MDS-class vulnerabilities and attacks to Intel. Unfortunately, the different timelines (see below), as well as the fine-grained vulnerability classification and embargo strategy enforced by Intel (which coordinated the disclosure process) made proper coordination across teams impossible. The year-long disclosure process (the longest to date) ultimately resulted in independent finders of even closely related MDS-class vulnerabilities to be completely unaware of one another until a few days before the May 14 disclosure date.

We worked with Intel to make sure we'd give proper credit to everyone involved in the disclosure of these vulnerabilities, both in our papers and on this website. This website is our last-minute effort to coordinate the different teams, presenting the two independent papers (and counting?) on RIDL and Fallout.
Click to expand...

eva2000 · May 15, 2019

Conflicting info as to which cpus are affected https://twitter.com/IanColdwater/status/1128409938441564160

These attacks affect all modern Intel CPUs in servers, desktops and laptops, including the latest 9th-gen processors that contain Meltdown mitigations. 9th-gen CPUs are actually more vulnerable to some of these attacks than older-gen hardware. AMD and ARM CPUs are not affected.
Click to expand...

Understanding the MDS vulnerability: What it is, why it works and how to mitigate it

Cyberus Technology: ZombieLoad: Cross Privilege-Boundary Data Leakage

INTEL-SA-00233

From INTEL-SA-00233

Affected Products:
A list of impacted products can be found here.

Recommendation:
Intel has worked with operating system vendors, equipment manufacturers, and other ecosystem partners to develop platform firmware and software updates that can help protect systems from these methods. This includes the release of updated Intel microprocessor microcode to our customers and partners.

Status of available microcode can be found here.

Public Github: intel/Intel-Linux-Processor-Microcode-Data-Files

End users and systems administrators should check with their system manufacturers and system software vendors and apply any available updates as soon as practical.
Click to expand...

From linked PDF does look like 8th & 9th generation Intel & 1st generation Intel Xeon Scalable Skylake cpus are affected too

eva2000 · May 15, 2019

Linux Kernel updates starting to show up for MSD mitigation fixes which need to work with microcode firmware updates with server manufacturers according to Phoronix https://www.phoronix.com/scan.php?page=news_item&px=MDS-Kernel-Fixes. There's supposedly another 10% performance penalty with the updated Kernel fixes which Phoronix will benchmark test.

Following today's disclosure of the new MDS vulnerabilities affecting Intel CPUs, a slew of new Linux kernel stable releases have been issued.

Greg Kroah-Hartman has issued Linux 5.1.2, 5.0.16, 4.19.43, 4.14.119, and 4.9.176 with these now public mitigation patches that pair with Intel's CPU microcode for mitigating this latest set of speculative execution side-channel vulnerabilities.
Click to expand...

For Redhat and CentOS, they will usually backport such MDS mitigation fixes into their 2.6.32/3.10 Linux Kernel with minor version increments so need to keep an eye out for those.

eva2000 · May 16, 2019

From Linode Intel’s MDS (ZombieLoad) CPU Vulnerabilities & Linode

This week Intel publicly disclosed a group of processor vulnerabilities known as Microarchitectural Data Sampling (MDS), also referred to as “ZombieLoad”. MDS affects systems that host virtual machines from varying security domains and/or that the system owner does not fully trust, which includes Linode’s infrastructure and Linodes themselves. This guide has additional detailed information on these vulnerabilities as well as their mitigation.

We’ve started mitigation efforts and anticipate full mitigation of our fleet in the coming weeks. These mitigation efforts may require interruption to your running systems, but we will clearly communicate any scheduled maintenance or coordination required by our customers via Support ticket.

To address these vulnerabilities on your end, we’ve released a new kernel (5.1.2) with mitigations in place, so make sure you select this kernel in your Linode’s configuration profile, then reboot. If you are using a distribution-supplied kernel, you will need to upgrade your kernel accordingly. As always, you should also ensure your Linode is up to date and secured.

We’ll keep you updated here in the coming weeks as we proceed with our mitigation efforts.
Click to expand...

eva2000 · May 17, 2019

More info as Apple, Microsoft, Google and Amazon release patch updates Apple, Amazon, Google, Microsoft and Mozilla release patches for ZombieLoad chip flaws – TechCrunch

Microsoft rolls out Windows updates
Microsoft has released patches for its operating system and cloud.

Jeff Jones, a senior director at Microsoft, said the software and cloud giant has been “working closely with affected chip manufacturers to develop and test mitigations” for its customers. “We are working to deploy mitigations to cloud services and release security updates to protect Windows customers against vulnerabilities affecting supported hardware chips,” he said.

In a TechNet article, the company said customers may need to obtain directly from their device maker microcode updates for their processor. Microsoft is pushing many of the microcode updates itself through Windows Update, but they are also available from its website.

Software updates will be released Tuesday also through Windows Update. Microsoft also has a page with guidance for how to protect against the new attacks.

Microsoft Azure customers are already protected, the company said.
Click to expand...

Google patches Android, will update Chrome
The search and browser maker also confirmed it has released patches to mitigate against ZombieLoad.

Google said the “vast majority” of Android devices aren’t affected but Intel-only devices will need to be patched once device makers make updates available.

Chrome OS devices, such as Chromebooks, are already protected in the latest version, and permanent mitigations will be pushed to devices in the next version.

And, the company’s Chrome team has a technical advisory out, but said users should rely on patches for their computer. “Operating system vendors may release updates to improve isolation, so users should ensure they install any updates and follow any additional guidance from their operating system vendor,” said Google. In other words, make sure your Windows PC or your Mac is patched.

Google also rolled out patches to its data centers, so cloud customers are already patched, but should be aware of the company’s guidance.
Click to expand...

From https://support.microsoft.com/en-us/help/4093836/summary-of-intel-microcode-updates

Microsoft is making available Intel-validated microcode updates that are related to Microarchitectural Data Sampling (CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130).

The following table lists specific Microsoft Knowledge Base articles by Windows version. The article contains links to the available Intel microcode updates by CPU.

KB4494452 Intel microcode updates Windows 10, version 1709, and Windows Server 2016, version 1709 Microsoft Update Catalog

KB4494453 Intel microcode updates Windows 10, version 1703 Microsoft Update Catalog

KB4494175 Intel microcode updates Windows 10, version 1607, and Windows Server 2016 Microsoft Update Catalog

KB4494454 Intel microcode updates Windows 10 (RTM) Microsoft Update Catalog

We will offer additional Intel-validated microcode updates for Windows as they become available to Microsoft, and update these articles accordingly.
Click to expand...

eva2000 · May 17, 2019

Ouch patches for MDS vulnerabilities have a measurable overhead cost for performance https://www.phoronix.com/scan.php?page=news_item&px=MDS-Zombieload-Initial-Impact

The default Linux mitigations for the new Microarchitectural Data Sampling (MDS) vulnerabilities (also known as "Zombieload") do incur measurable performance cost out-of-the-box in various workloads. That's even with the default behavior where SMT / Hyper Threading remains on while it becomes increasingly apparent if wanting to fully protect your system HT must be off.

MDS was announced on Tuesday and now back from the Open-Source Technology Summit I am running a number of MDS/Zombieload mitigation benchmarks including the likes now of comparing the overall Spectre/Meltdown/L1TF/MDS impact and also if going the "full" route of disabling Hyper Threading. Tomorrow will be the first featured (multi-page) article with MDS data on multiple systems while here are some initial numbers I am seeing when just looking at the new default cost of this MDS mitigation.
Click to expand...

eva2000 · May 17, 2019

eva2000 said: ↑

Conflicting info as to which cpus are affected https://twitter.com/IanColdwater/status/1128409938441564160
Click to expand...

Seems conflicting info is due to cpu revision steppings so a cpu model can have stepping revisions over time, only older cpu stepping revisions in 8th and 9th generation Intel cpus are vulnerable https://www.phoronix.com/forums/for...ping-hyper-threading-on?p=1099466#post1099466

Only certain (very recent) steppings of the 8th and 9th gen CPUs have hardware mitigations for the MDS vulnerabilities. My brand new (under 1 month old) work laptop with an i7-8750H has an 'A' stepping CPU which is vulnerable, only the 'C' and 'D' steppings aren't vulnerable. Cascade Lake has one stepping vulnerable to two variants of MDS and two newer steppings that aren't vulnerable to any variants.
Click to expand...

eva2000 · May 18, 2019

RedHat & CentOS Kernel Updates For MDS Vulnerabilities

Redhat & CentOS Kernel Updates are starting to show up in YUM repositories for MDS Vulnerabilities. Note the Kernel updates themselves require a server reboot however to fill fix this, you'd need web host's to also update the bios/microcode updates to their servers which also require a reboot/downtime. For OpenVZ VPS users, you're Linux Kernel is derived from VPS host node's Kernel so you need for your web host to update their Linux Kernels which may involve server reboots as OpenVZ VPS users have no control over Linux Kernel they use unlike KVM/Xen/VMware or bare metal server users.

From MDS - Microarchitectural Data Sampling - CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 - Red Hat Customer Portal where RedHat mentions also imply CentOS. Both CentOS 6 and 7 are affected.

Take Action
Red Hat customers running affected versions of these Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the available updates immediately and enable the mitigations as they feel appropriate.

The order the patches are applied is not important, but after updating firmware and hypervisors, every system/virtual machine will need to power off and restart to recognize a new hardware type.
Click to expand...

Redhat 8 Red Hat Customer Portal Linux Kernel = kernel-4.18.0-80.1.2

Redhat 7 / CentOS 7 Red Hat Customer Portal Linux Kernel = kernel-3.10.0-957.12.2

Redhat 6 / CentOS 6 Red Hat Customer Portal Linux Kernel = kernel-2.6.32-754.14.2

Example for CentOS 7 yum list update listing available updates
Code (Text):
yum list updates
Code (Text):
glibc.x86_64                  2.17-260.el7_6.5                  updates         
glibc-common.x86_64           2.17-260.el7_6.5                  updates         
glibc-devel.x86_64            2.17-260.el7_6.5                  updates         
glibc-headers.x86_64          2.17-260.el7_6.5                  updates         
kernel.x86_64                 3.10.0-957.12.2.el7               updates         
kernel-devel.x86_64           3.10.0-957.12.2.el7               updates         
kernel-headers.x86_64         3.10.0-957.12.2.el7               updates         
kernel-tools.x86_64           3.10.0-957.12.2.el7               updates         
kernel-tools-libs.x86_64      3.10.0-957.12.2.el7               updates         
microcode_ctl.x86_64          2:2.1-47.2.el7_6                  updates
Run yum update
Code (Text):
yum -y update
Then reboot server for Linux Kernel update to take effect and verify with command
Code (Text):
uname -r
Code (Text):
uname -r
3.10.0-957.12.2.el7.x86_64

eva2000 · May 19, 2019

Phoronix benchmarks for The Performance Impact Of MDS / Zombieload Plus The Overall Cost Now Of Spectre/Meltdown/L1TF/MDS.

The past few days I've begun exploring the performance implications of the new Microarchitectural Data Sampling "MDS" vulnerabilities now known more commonly as Zombieload. As I shared in some initial results, there is a real performance hit to these mitigations. In this article are more MDS/Zombieload mitigation benchmarks on multiple systems as well as comparing the overall performance impact of the Meltdown/Spectre/Foreshadow/Zombieload mitigations on various Intel CPUs and also AMD CPUs where relevant.

While disabling Hyper Threading now is recommended by multiple parties if running untrusted code on the system, even if keeping HT/SMT active, the MDS mitigations do provide a very noticeable performance hit in many real and synthetic workloads with the updated Linux kernel patches paired with the newest Intel CPU microcode. Like the other mitigations to this point, the workloads affected most are those with lots of context switches / high interactivity between kernel and user-space.

Before getting to the benchmarks looking at the overall impact of the mitigations to date, first is looking at the MDS on/off costs on various systems while keeping Hyper Threading active. These tests were done on Ubuntu 19.04 using its newest stable release updates bringing a patched Linux 5.0 kernel and the new Intel CPU microcode images.

I tested the MDS on/off tests with a few distinctly different systems for seeing the mitigation cost for Zombieload. Following this batch of tests is a larger set of tests looking at no mitigations for the CPU vulnerabilities, the default mitigations, and then the default mitigations with Hyper Threading disabled. All of these benchmarks were carried out using the Phoronix Test Suite.
Click to expand...

For this second round of tests is looking at the overall cost of all these CPU mitigations to date by making use of the new mitigations= kernel flag. Tests were done with mitigations=off that disable at run-time the relevant mitigations, mitigations=auto as the default behavior for the kernel's mitigations, and then mitigations=auto,nosmt that apply these mitigations but also disable SMT. With mitigations=auto,nosmt it's worth noting that only Intel Hyper Threading is disabled but if using the same parameter on AMD Zen hardware, SMT is left active.

In this comparison using Linux 5.0 on Ubuntu 19.04, various Intel and AMD desktop CPUs were tested for getting a broad look at how the mitigation costs are looking on different hardware. All systems were equipped with NVMe SSD storage and RAM to satisfy the maximum number of memory channels on each system and at their optimal rated frequency. Similar tests using Intel Xeon and AMD EPYC processors are forthcoming on Phoronix. The desktop CPUs tested in time for today's article included the Core i7 6800K, Core i7 8700K, Core i9 7980XE, AMD Ryzen 7 2700X, and AMD Ryzen 7 2700X.
Click to expand...

eva2000 · May 21, 2019

More Phoronix benchmarks A Look At The MDS Cost On Xeon, EPYC & Xeon Total Impact Of Affected CPU Vulnerabilities

This weekend I posted a number of benchmarks looking at the performance impact of the new MDS/Zombieload vulnerabilities that also included a look at the overall cost of Spectre/Meltdown/L1TF/MDS on Intel desktop CPUs and AMD CPUs (Spectre). In this article are similar benchmarks but turning the attention now to Intel Xeon hardware and also comparing those total mitigation costs against AMD EPYC with its Spectre mitigations.

This article offers a look at the MDS/Zombieload mitigations on a 1st Gen Skylake Xeon Scalable server as well as a Kabylake Xeon E3 server for reference. Following that is a look at the total CPU vulnerability mitigation costs for 1st Gen Xeon Scalable, 2nd Gen Xeon Scalable (Cascade Lake), and an AMD EPYC 2P server as well for its Spectre mitigations.

As expected given Intel's guidance last week of their latest Xeon processors being mitigated for MDS, indeed, the dual Xeon Platinum 8280 Cascade Lake server reported it was not affected by the MDS mitigations and thus not enabled. So for the MDS tests up first it's just some reference results using a dual Xeon Gold 6138 Skylake server running Ubuntu 19.04 with the Linux 5.0 patched kernel and reference results side-by-side for a separate Xeon E3-1275 v6 server.
Click to expand...

Next is looking at the performance impact of mitigations=off / mitigations=auto (all relevant default/out-of-the-box CPU mitigations applied currently by the Linux kernel respectively for Intel and AMD) / mitigations=auto,nosmt (disabling SMT / Hyper Threading where deemed unsafe, Cascadelake didn't see HT disabled in this configuration and obviously not relevant for AMD). This round of tests was done on a dual socket AMD EPYC 7601 server, dual socket Xeon Gold 6138 server, and dual socket Xeon Platinum 8280 Cascadelake server for looking at the overall impact of these mitigations on each of the different boxes.

There was varying RAM between the systems due to different memory channels and other factors, but each server did see all memory channels occupied with RAM at each of the processors rated frequencies. All three of these servers were tested with Ubuntu 19.04 running the patched Linux 5.0 kernel with the latest microcodes for each processor under test.
Click to expand...

eva2000 · May 24, 2019

More from Phoronix https://www.phoronix.com/scan.php?page=news_item&px=Haswell-Xeon-Zombie-Load-Ref

With tests over the past week following the disclosure of the Microarchitectural Data Sampling (MDS) vulnerabilities also known as "Zombieload", we've looked at the MDS mitigation costs (and now the overall Spectre/Meltdown/L1TF/MDS impact) for desktop CPUs, servers, and some laptop hardware. I've also begun doing some tests on older hardware, such as some Phoronix readers curious how well aging Intel Haswell CPUs are affected.
Click to expand...

eva2000 · May 24, 2019

Phoronix has more wonderful benchmarks of how the MDS/Zombieload mitigations negatively affect performance at https://www.phoronix.com/scan.php?page=article&item=sandy-fx-zombieload&num=1

Now with MDS / Zombieload being public and seeing a 8~10% performance hit in the affected workloads as a result of the new mitigations to these Microarchitectural Data Sampling vulnerabilities, what's the overall performance look like now if going back to the days of AMD FX Vishera and Intel Sandybridge/Ivybridge processors? If Spectre, Meltdown, L1TF/Foreshadow, and now Zombieload had come to light years ago would it have shaken that pivotal point in the industry? Here are benchmarks looking at the the performance today with and without the mitigations to the known CPU vulnerabilities to date.

As I've already delivered many benchmarks of these mitigations (including MDS/Zombieload) on newer CPUs, for this article we're looking at older AMD FX CPUs with their relevant Spectre mitigations against Intel Sandybridge and Ivybridge with the Spectre/Meltdown/L1TF/MDS mitigations. Tests were done on Ubuntu 19.04 with the Linux 5.0 kernel while toggling the mitigation levels of off (no coverage) / auto (the default / out-of-the-box mitigations used on all major Linux distributions for the default protections) / auto,nosmt (the more restricted level that also disables SMT / Hyper Threading). The AMD CPUs were tested with off/auto as in the "auto,nosmt" mode it doesn't disable any SMT as it doesn't deem it insecure on AMD platforms.

The processors used for testing were the:

- Intel Core i3 2120
- Intel Core i5 2500K
- Intel Core i7 2700K
- Intel Core i7 3700K
- AMD FX-8320E
- AMD FX-8370E
- AMD FX-8370
Click to expand...

eva2000 · May 27, 2019

Interesting write up by Techspot How Screwed is Intel without Hyper-Threading?

Unlike previous speculative execution flaws that partially affected AMD and Arm-based processors, the MDS flaws are exclusive to Intel chips. In the short term the only way to mitigate or minimize these vulnerabilities is to disable simultaneous multithreading (SMT), or as Intel brands it "Hyper-Threading."

As it stands Microsoft is pushing out OS-level updates to address the four MDS vulnerabilities and you’ll get those with this month's Windows 10 1903 update. However, this doesn’t mitigate the problem entirely, for that we need motherboard BIOS updates and reportedly Intel has released the new microcode to motherboard partners. However as of writing no new BIOS revisions have been released to the public. We believe we can test a worst case scenario by disabling Hyper-Threading and for older platforms that won’t get updated this might end up being the only solution.

With that, today we’re exploring the impact disabling Hyper-Threading has on Intel processors that support the feature. We’ve done this in the past and it’s an interesting test, however there is a new critical incentive to go over this data considering that Intel's latest hardware security vulnerability impacts SMT.

We’ve grabbed a Core i7-8700K and 7700K and tested them in a battery of game and applications with and without Hyper-Threading enabled. We didn’t bother with the i9-9900K because it’s an 8-core part, so the missing threads won’t be an issue for gaming performance, though there'll still be a negative impact on application performance and that should be inline with what we see from the 8700K and 7700K.
Click to expand...

eva2000 · May 28, 2019

LOL this tweet from Intel sounds like they're preparing for a world where disabling Intel Hyperthreading to mitigate MDS/zombieload security vulnerabilities https://twitter.com/IntelBusiness/status/1132813701772394499

Not all cores are created equal, and more cores doesn't always equate to better overall performance. With an ideal mix of CPU cores, I/O and memory channels, Intel Xeon processors deliver unmatched workload performance.
Click to expand...

eva2000 · May 31, 2019

Latest Upcloud newsletter regarding MDS/Zombieload mitigation - wow they even disabled Intel Hyper-Threading !

Information on the Microarchitectural Data Sampling vulnerabilities

Earlier this month, Intel published a new class of vulnerabilities which are related to the already year-old speculative execution attacks. These more recently disclosed Microarchitectural Data Sampling (MDS) hardware vulnerabilities are affecting most modern Intel CPUs. As we learned of the new vulnerabilities, we immediately began validating the available CPU microcode updates that Intel had already released at the time. Our entire infrastructure has since been upgraded to the latest security updates to mitigate the issue. In addition, the researchers behind the discoveries recommended disabling Intel’s Hyper-Threading Technology which we have also done on all affected hardware. Read more about the vulnerabilities and what you should do at our security update.
Click to expand...

Mitigation in works
We learned of the new vulnerabilities as they were published and immediately began validating available mitigation methods. Intel has already provided CPU microcode updates and recommendations for mitigation strategies for operating systems and hypervisor software. We are working to apply these updates across our infrastructure while also exploring other options for further mitigation. The security updates will not cause interruptions to our users.

According to the researchers, it’s recommended to disable Simultaneous Multi-Threading (SMT), also known as Intel Hyper-Threading Technology. This is reported to significantly reduce the impact of MDS-based attacks without the cost of more complex mitigations. While Hyper-Threading can improve system performance in certain workloads, we are disabling it on all hosts that were still using it to mitigate the vulnerabilities.

These new attacks are able to violate the kernel privacy by extracting information from within it. Moreover, attackers using these vulnerabilities could expose the kernel’s location in the system’s memory, simplifying other exploits. Therefore, we highly recommend all our users to keep their cloud servers up to date on security updates provider for your operating system vendor. We are also upgrading our public templates to make sure all future deployments include the latest security updates to mitigate these attacks.
Click to expand...

eva2000 · Jun 4, 2019

Linode scheduled server reboots to mitigate MDS / Zombieload https://community.centminmod.com/threads/scheduled-maintenance-for-cpu-vulnerabilities.17642/

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Security Microarchitectural Data Sampling (MDS) Speculative Execution Side Channel Vulnerability (Zombieload)

eva2000 Administrator Staff Member

RedHat & CentOS Kernel Updates For MDS Vulnerabilities

More Info

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

RedHat & CentOS Kernel Updates For MDS Vulnerabilities

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Security Microarchitectural Data Sampling (MDS) Speculative Execution Side Channel Vulnerability (Zombieload)

eva2000 Administrator Staff Member

RedHat & CentOS Kernel Updates For MDS Vulnerabilities

More Info

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

RedHat & CentOS Kernel Updates For MDS Vulnerabilities

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member