ngCERT-2019-0011: ngCERT Advisory on Intel-chips-vulnerability
The techniques can be used to get applications, the operating system, virtual machines and trusted execution environments to leak information, including passwords, website content, disk encryption keys and browser history. An attacker can perform an MDS-based attack from user space, with unprivileged instructions. As the leakage occurs from stale data latched in buffers in the pipeline, the only defence is to flush the buffers before moving to a less privileged context. For example, hackers can use the ZombieLoad attack, which is a subclass of RIDL, to obtain a user’s browsing history even if the victim surfs the web from a virtual machine or uses the Tor anonymity network.
Mitigation can be in a way of combination of software, firmware and configuration changes. It is important to note that some affected processors are not expected to receive microcode updates. For these processors, there is no mitigation available. Users with workloads of concern on these processors should move the workload elsewhere.
Solution for this issue if you have any untrusted code running in VMs, and need to prevent the risk of data leakage, the only available option at the moment is to disable hyper-threading. This is preferably done in the BIOS, but can also be done by Xen at boot time by specifying `smt=no` on the command line.
If you find that a computer is susceptible to ZombieLoad, you may want to avoid using it as a multi-user system. ZombieLoad breaches the CPU's memory protection. On a machine that is susceptible to ZombieLoad, one process can potentially read all data used by other processes or by the kernel.