Intel CPUs Made Since 2011 Discovered to be Vulnerable to the ‘ZombieLoad’ Flaw

• A new class of Intel CPU vulnerabilities can lead to sophisticated data extraction pathways.
• Users of Windows, Linux, and macOS should have already received an update that plugs the flaws.
• All Intel CPUs made between 2011 and 2017 are vulnerable to nasty MDS attacks.

A coalition of teams of university researchers and cyber-security professionals have discovered yet another critical set of speculative execution side-channel vulnerabilities in Intel processors similar to the Spectre and Meltdown. This new class of vulnerabilities was named “Microarchitectural Data Sampling” (MDS), and could potentially allow an attacker to gain access to the microarchitectural data structures that are mini-caches inside the main CPU cache. Inside those caches, the processor temporary stores information for quick access and processing, so the user’s activity is reflected there without any regards to security or privileges, and this means that an attacker can read and steal anything, including administrator passwords.

Intel has already acknowledged the problem and is already pushing a microcode patch that clears all data from these micro-cache buffers within certain and specified safety-respecting intervals. This means that you must have already received updates that plug the four identified vulnerabilities, no matter what OS you are using. In fact, even Linux users are not safe from the disclosed vulnerabilities and have to upgrade to kernel version 5.1.2 that plugs the problems. Apple users have also received an update that addresses the vulnerabilities today, with macOS Mojave 10.14.5.

The four vulnerabilities that were discovered are the following:

• CVE-2018-12126 - Microarchitectural Store Buffer Data Sampling (MSBDS), dubbed as “Fallout”;
• CVE-2018-12130 - Microarchitectural Fill Buffer Data Sampling (MFBDS), dubbed as “Zombieload”;
• CVE-2018-12127 - Microarchitectural Load Port Data Sampling (MLPDS);
• CVE-2019-11091 - Microarchitectural Data Sampling Uncacheable Memory (MDSUM).

Although Intel classifies the first three as “Medium Severity”, researchers present the “Zombieload” flaw as the nastiest of them all, because it works on a wide range of applications, even if running inside virtual boxes or in the cloud. It is not limited to native code execution and works across virtualization boundaries. The only way to address this, according to the researchers, is to switch off hyperthreading as well as to flush the buffers as explained above.

For a full list of the Intel processors that are affected by this new set of MDS flaws, check out Intel’s product list here. For a bulk estimation, if your processor was made between 2011 and 2017, you are most probably affected and should install the microcode fix immediately. Those who are using CPUs that left Intel’s production lines in 2018 and later, have MDS-resistant processors thanks to the Spectre and Meltdown variations that are still out there. If you are using AMD or ARM chips, you are safe, as this whole story is not applicable to those types of CPUs.

Have something to say about the new “Zombieload” vulnerability? Feel free to do so in the comments down below, and also on our socials, on Facebook and Twitter.