Intel June 2020 Microcode Update

Issue

Red Hat is aware of several CPU hardware flaws that affect Intel CPU hardware microarchitecture and on-board components.

Red Hat provides updated microcode, developed by our microprocessor partners, as a convenience to our customers. Please contact your hardware vendor to determine whether more recent BIOS or firmware updates are recommended, as additional improvements may be available.

Background

CVE-2020-0543 Special Register Buffer Data Sampling (SRBDS)

A new domain bypass transient execution attack, known as Special Register Buffer Data Sampling (SRBDS), may allow data values from special registers to be inferred by malicious code executing on any core of the CPU. This vulnerability affects some client and Intel® Xeon® E3 processors; it does not affect other Intel Xeon or Intel Atom® processors (see applicability in the "Intel Microcode Updates that mitigate the issues" table below).

This issue has been assigned CVE-2020-0543 and Red Hat has rated the severity impact as Moderate.

This issue requires a microcode update, and it is expected to have a performance impact on the performance of RDRAND and RDSEED instructions.

See also:

• SRBDS KCS
• Intel Product Assurance and Security (IPAS)
• SRBDS Whitepaper

CVE-2020-0548 Vector Register Data Sampling (VRDS)

MDS mitigations clear the store buffer upon execution of the clear buffer instruction (VERW). Program instructions often delegate work to hardware subcomponents. The delegated work, which began before clear buffer instruction, the subcomponents would complete after the clear buffer instruction and then place the results in the store buffer after it was cleared. This makes the results of these instructions able to be inferred by using MDS/TAA exploit methods.

The specific delegated operations that were outstanding were SSE/AVX/AVX-512 register reads from another process or a CPU sibling.

This issue requires a microcode update.

This issue has been assigned CVE-2020-0548 and is rated Low.

See also:

• L1D cache eviction and vector register sampling
• Intel-SA-00329
• IPAS: INTEL-SA-00329
• Intel-SA-00270

CVE-2020-0549 L1D Cache Eviction Sampling (L1DCES)

A microarchitectural timing flaw was found on some Intel processors. A corner case exists where data in-flight during the eviction process can end up in the “fill buffers” and not properly cleared by the MDS mitigations. The fill buffer contents (which were expected to be blank) can be inferred using MDS or TAA style attack methods to allow a local attacker to infer fill buffer values.

This issue requires a microcode update.

This issue has been assigned CVE-2020-0549 and is rated Moderate.

See also:

• L1D cache eviction and vector register sampling
• Intel-SA-00329
• IPAS: INTEL-SA-00329
• Intel-SA-00270

Diagnostic Tools

At this time there is no method of knowing if an attack has taken place.

Affected Products

(*) For systems that use CPUs with model 78 or 94 (Skylake-H/S/U/Y/Xeon E3 v5) the update may lead to possible hangs, please use microcode_ctl-20191115-4.20200609.1.el8_2 (RHEA-2020:2741) where the updated microcode is blacklisted by default.

(**) For systems that use CPUs with model 78 or 94 (Skylake-H/S/U/Y/Xeon E3 v5) the update may lead to possible hangs, please use microcode_ctl-2.1-61.10.el7_8 (RHEA-2020:2743) where the updated microcode is blacklisted by default.

(***) For systems that use CPUs with model 78 or 94 (Skylake-H/S/U/Y/Xeon E3 v5) the update may lead to possible hangs, please use microcode_ctl-1.17-33.29.el6_10 (RHEA-2020:2742) where the updated microcode is blacklisted by default.

Affected Configurations

Listed below are the CPU families affected by these flaws broken down by the flaw type. You must determine your CPU’s family to see if you are affected.

Find your CPU family model

Find the CPU model provided by your system. This is available in the /proc/cpuinfo file.

$ grep -E '^(cpu family|model|stepping|microcode)' /proc/cpuinfo | sort -u
cpu family  : 6
microcode   : 0x84
model       : 94
model name  : Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
stepping    : 3

(Note: on RHEL 6, microcode revision is in decimal; on RHEL 7 onwards, it is in hexadecimal with the respective prefix)

Affected Intel CPU models and microcode update revisions that mitigate the issues

(*) Has to be enabled explicitly on SKL-X/W with microcode_ctl-20191115-4.20200602.2.el8_2, microcode_ctl-2.1-61.6.el7_8, and microcode_ctl-1.17-33.26.el6_10. The explicit enablement is not needed with microcode_ctl-20191115-4.20200609.1.el8_2, microcode_ctl-2.1-61.10.el7_8, and microcode_ctl-1.17-33.29.el6_10.

See also:

• Affected Processors: Latest Transient Execution Attacks by Product CPU Model

Resolution

Red Hat customers running affected versions of Red Hat products are strongly recommended to update them as soon as errata are available. Customers are urged to apply the appropriate updates immediately and reboot to mitigate this flaw correctly.

Acknowledgements

Red Hat thanks Intel for fixing these issues and making Red Hat aware of the remediation.

Frequently Asked Questions

Q: Do I need to reboot for the changes to take effect?
A: Reboot is not required, but the reporting of the SRBDS mitigation via sysfs will be incorrect on RHEL 7 and 8 if a late microcode update is performed.
Q: What if my CPU is not listed in the table?
A: Red Hat intends to continue to update these microcode packages as necessary. Please contact your hardware vendor to determine whether more recent BIOS and firmware updates are recommended for your hardware because additional improvements may be available.

Additional Information

Red Hat can not guarantee the correctness of the above information as the microcode update is provided by upstream vendors.

Related Knowledge Base articles:

• Is CPU microcode available to address CVE-2017-5715 via the microcode_ctl package?
• Is CPU microcode available to address CVE-2018-3639 via the microcode_ctl package?
• Is CPU microcode available to address CVE-2018-3620 and CVE-2018-3646 via the microcode_ctl package?
• Is CPU microcode available to address MDS (ZombieLoad) CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091 via the microcode_ctl package?
• Intel November 2019 Microcode Update