3 ms·
Commentary by Intel: https://software.intel.com/security-software-guidance/software-guidance/microarchitectural-data-sampling https://software.intel.com/securit
by JdeBP 7y ago
Commentary by Intel: https://software.intel.com/security-software-guidance/software-guidance/microarchitectural-data-sampling https://software.intel.com/security-software-guidance/softwa...
Commentary by RedHat: https://www.redhat.com/en/blog/understanding-mds-vulnerability-what-it-why-it-works-and-how-mitigate-it https://www.redhat.com/en/blog/understanding-mds-vulnerabili... (https://news.ycombinator.com/item?id=19912108 https://news.ycombinator.com/item?id=19912108)
Commentary by Ubuntu: https://blog.ubuntu.com/2019/05/14/ubuntu-updates-to-mitigate-new-microarchitectural-data-sampling-mds-vulnerabilities https://blog.ubuntu.com/2019/05/14/ubuntu-updates-to-mitigat...
- tarlinian 7y agoSome additional pages by Intel describing mitigation techniques for non-HT domains (including the new overload of the VERW instruction): https://software.intel.com/security-software-guidance/insights/deep-dive-intel-analysis-microarchitectural-data-sampling https://software.intel.com/security-software-guidance/insigh... Details of which steppings of which processors are affected by which CVEs: https://software.intel.com/security-software-guidance/insights/deep-dive-cpuid-enumeration-and-architectural-msrs#MDS-CPUID https://software.intel.com/security-software-guidance/insigh...
- rurban 7y agoThey advise only to use lfence, similar to compiler vendors. I advise to use a full mfence instead when clearing secrets. Load/store ordering is violated in caches. And cleaning secrets is done not so often, it needs to be reliable. MDS is thanksfully only for small data, and modern keys are much larger. But adding a simple verw for the tiny non-cache buffers does not hurt either.
- mtgx 7y agoCommentary by Chromium team: https://www.chromium.org/Home/chromium-security/mds https://www.chromium.org/Home/chromium-security/mds