RIDL and Fallout: MDS attacks

[pondus]

RIDL and Fallout: MDS attacks. Attacks on the newly-disclosed "MDS" hardware vulnerabilities in Intel CPUs

https://mdsattacks.com/

https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html

https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

https://zombieloadattack.com/#attack
 

[David H. Lipman]

Thanx @pondus

 

 

 

[pondus]

you're welcome    

 

 

[Firefox]

I believe MS patched this in the May 2019 updates... but thanks for the info all the same.

[pondus]

This option is available for macOS Mojave, High Sierra, and Sierra after installing security updates. 

https://support.apple.com/en-us/HT210108

 

 

[1PW]

Excellent!  

Thank you @pondus

 

[exile360]

On 5/15/2019 at 10:26 AM, Firefox said:

I believe MS patched this in the May 2019 updates... but thanks for the info all the same.

The patches only mitigate some of the issues; without disabling HyperThreading completely in the BIOS you are still vulnerable to at least some of these attacks.  In fact, apparently the latest 9th gen Intel chips (i.e. the 9900K, 9700K, 9400K etc. and their KF counterparts et al) are apparently even more vulnerable to the Fallout vulnerability due to the hardware mitigations for the Meltdown vulnerability.  How's that for irony?

I just finished patching my CPU's ME firmware to mitigate a new vulnerability reported for the Intel Management Engine and I just now used the VMWare CPU Microcode Update Driver to patch my CPU's microcode to the latest version (since my OEM isn't going to release any BIOS/firmware updates, and the new microcode is needed for some of these vulnerability mitigations; though of course Microsoft isn't releasing any of them for Windows 7 anyway even though they are supposed to still be providing security updates for that OS; they haven't released any for Windows 8 or 8.1 either, only Windows 10).

It's a tough day to be an Intel user .  Obviously AMD isn't immune to all of these vulnerabilities/exploits either, but Intel is definitely the one being hit the hardest at the moment.