Security Software

Rogue System Register Read / CVE-2018-3640 / INTEL-SA-00115

2018-05-21
2018-05-21
4.3

Medium

Industry-wide severity ratings can be found in the National Vulnerability Database

Critical
Medium
High
Low

Aliases

  • Variant 3a
  • Meltdown variant

Overview

Rogue System Register Read (INTEL-SA-00115) is a domain-bypass transient execution attack that uses transient execution of instructions to potentially allow malicious actors to infer the values of some system register states that should not be architecturally accessible. This method was first described as Variant 3a (V3a) in the Cache Speculation Side-channels ARM* whitepaper. The set of system registers that can have their values inferred by this method is specific to each hardware implementation. Rogue System Register Read has been assigned CVE-2018-3640 with a base score of 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Although these transient operations will architecturally fault or VM exit, in certain cases they may return data that is accessible to subsequent instructions in the speculative execution path. These subsequent instructions can then create a side channel to infer the system register state.

Intel’s analysis is that the majority of states exposed by the Rogue System Register Read method are not secret or sensitive, and that this method does not directly enable attacks or exposure of user data. However, the use of the rogue system register read method by an attacker may potentially result in the exposure of the physical addresses for some data structures and may also expose the linear addresses of some kernel software entry points.

Knowledge of these physical and linear addresses may enable malicious actors to determine the addresses of other kernel data and code elements, which may impact the efficacy of the Kernel Address Space Layout Randomization (KASLR) technique. KASLR, as a security defense in-depth feature, has been subject to a number of attacks in recent years; in particular by local malicious actors who can control code execution. As the rogue system register read method involves attacker-controlled code execution, a local attacker who employs rogue system register read to break KASLR may be low impact for most end users.

The list of Instructions Affected by Rogue System Register Read describes transient execution behavior that may occur on one or more existing Intel processors. Individual processors will only be affected by a subset of the issues listed in this link. These issues are addressed in future processors.

Mitigation

Malware must be running locally on a system to compromise security using the rogue system register read method.

Microcode updates help ensure that the RDMSR instruction will not speculatively return data when executed at CPL > 0 or when executed by a Virtual Machine eXtension (VMX) guest to a model-specific register (MSR) for which RDMSR is configured to cause a Virtual Machine (VM) exit.

Recent processors further restrict speculative values returned. Note that cases where the speculative value returned depends only on the instruction operands are not believed to constitute a security threat and may not be mitigated. An example of this would be a RDMSR instruction that speculatively returns the ECX value used as input. A non-system-register read example would be a divide instruction that, when it causes a divide error exception, returns data related to that divide’s inputs.
 

References


Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software, or service activation. Performance varies depending on system configuration. Check with your system manufacturer or retailer or learn more at www.intel.com.

All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications and roadmaps.

Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors.

Performance tests, such as SYSmark and MobileMark, are measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products. For more complete information visit www.intel.com/benchmarks.

Performance results are based on testing as of dates shown in configurations and may not reflect all publicly available​ updates. No product or component can be absolutely secure.

The products and services described may contain defects or errors known as errata which may cause deviations from published specifications. Current characterized errata are available on request.

Intel provides these materials as-is, with no express or implied warranties.

No product or component can be absolutely secure.

Intel, the Intel logo, Intel Core, Intel Atom, Intel Xeon, Intel Xeon Phi, Intel® C Compiler, Intel Software Guard Extensions, and Intel® Trusted Execution Engine are trademarks of Intel Corporation in the U.S. and/or other countries.

*Other names and brands may be claimed as the property of others.