CVE-2018-12130: Infoleak

A flaw was found by researchers in the implementation of fill buffers used by Intel microprocessors.

A fill buffer holds data that has missed in the processor L1 data cache, as a result of an attempt to use a value that is not present. When a level 1 data cache miss occurs within an Intel core, the fill buffer design allows the processor to continue with other operations while the value to be accessed is loaded from higher levels of cache. The design also allows the result to be forwarded to the Execution Unit requiring the load directly without being written into the Level 1 data cache.

A load operation is not decoupled in the same way that a store is, but it does involve an AGU (Address Generation Unit) operation. If the AGU generates a fault (#PF, etc.) or an assist (A/D bits) then the classical Intel design would block the load and later reissue it. In contemporary designs, it instead allows subsequent speculation operations to temporarily see a forwarded data value from the fill buffer slot prior to the load actually taking place. Thus it is possible to read data that was recently accessed by another thread if the fill buffer entry is not overwritten.

Additional information: https://access.redhat.com/security/vulnerabilities/mds

Upstream fixes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fa4bff165070dc40a3de35b78e4f8da8e8d85ec5

Intel Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html