MDS & TAA Buffer Clearing (VERW) ZombieLoad / RIDL / Fallout

Interactive Microarchitectural Data Sampling Simulator v2.0
Speed:
SIMULATION RUNNING
INTEL X86_64 CPU EXECUTION CORE & MICROARCHITECTURAL BUFFERS 1. Privileged Context (Ring 0) Kernel Syscall Execution: Processing Secret: 0x46 ('F') Transition: SYSRET to Ring 3 2. Internal CPU Hardware Buffers Line Fill Buffers (LFB - 12 Entries) Entry 0: Stale Residue = 0x46 ('F') Store Buffers (SB - 56 Entries) Pending Write Data: Cleared / Flushed Load Ports (LP - Ports 2/3) Read Bus Registers: Neutral 3. Attacker Process (Ring 3) Speculative Faulting Load: val = *(faulting_addr); Samples LFB before page fault! SIGSEGV caught or TSX aborted 4. Flush+Reload Probe Array Line 0x00 (Neutral): FLUSHED (MISS) Line 0x46 ('F' Secret): FLUSHED (MISS) 5. VERW Defense Engine X86_FEATURE_MD_CLEAR Instruction: verw %[ds] Invoked on sysret / iret / ctx-sw 6. Microarchitectural Sampling & Mitigation State Machine Step 1: Kernel Workload Secret in memory Leaves LFB residue Step 2: Kernel Exit Transition to Userland Buffers dirty or clean? Step 3: Faulting Load Pipeline stalls on fault Speculative buffer sample Step 4: Cache Encoding probe_array[val * 512] Warms cache line Step 5: Flush+Reload Timing measurement Secret leak or safe 0s
CURRENT PHASE: MDS & TAA SPECULATIVE SAMPLING STATUS: INITIALIZING
MDS(Microarchitectural Data Sampling - ZombieLoad/RIDL/Fallout)๋Š” ๋น„์ˆœ์ฐจ์  CPU๊ฐ€ ํŽ˜์ด์ง€ ํดํŠธ, TSX ์–ด๋ณดํŠธ ๋“ฑ ๋น„์ •์ƒ์  ๋กœ๋“œ๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๋™์•ˆ ํŒŒ์ดํ”„๋ผ์ธ ์ง€์—ฐ์„ ๋ฉ”์šฐ๊ธฐ ์œ„ํ•ด Line Fill Buffer(LFB) ๋“ฑ ๋‚ด๋ถ€ ๋งˆ์ดํฌ๋กœ์•„ํ‚คํ…์ฒ˜ ๋ฒ„ํผ์˜ ์ž”์—ฌ ๋ฐ์ดํ„ฐ๋ฅผ ๋ฌด๋ถ„๋ณ„ํ•˜๊ฒŒ ์ฝ์–ด๋“ค์ด๋Š” ์ทจ์•ฝ์ ์ž„. ๋ฆฌ๋ˆ…์Šค ์ปค๋„์€ VERW ๋ช…๋ น์–ด๋ฅผ ์œ ์ € ๊ณต๊ฐ„ ๋ณต๊ท€ ์ง์ „์— ์‹คํ–‰ํ•˜์—ฌ CPU ๋ฒ„ํผ๋ฅผ 0์œผ๋กœ ๊ฐ•์ œ ์†Œ๊ฑฐํ•จ์œผ๋กœ์จ ์ด ๊ณต๊ฒฉ์„ ์™„๋ฒฝํžˆ ์ฐจ๋‹จํ•จ.
// [MDS Speculative Sampling Gadget] // Faulting load triggers speculative fill from Line Fill Buffer (LFB) val = *(char *)faulting_unmapped_address; // Page Fault ๋ฐœ์ƒ ์ง์ „ ํˆฌ๊ธฐ ์‹คํ–‰! probe_array[val * 512] = 1; // LFB์— ๋‚จ์•„์žˆ๋˜ ์ปค๋„ ๋น„๋ฐ€ ๋ฐ”์ดํŠธ ์บ์‹œ ์ ์žฌ!

MDS & TAA Vulnerability Variants & Mitigation Matrix

์ทจ์•ฝ์  ๋ช…์นญ (Variant) ๊ณต๊ฒฉ ๋Œ€์ƒ ๋งˆ์ดํฌ๋กœ์•„ํ‚คํ…์ฒ˜ ๋ฒ„ํผ ์˜ํ–ฅ๋ฐ›๋Š” CPU ์•„ํ‚คํ…์ฒ˜ ํ•˜๋“œ์›จ์–ด ์™„ํ™”์ฑ… ๋ฆฌ๋ˆ…์Šค ์ปค๋„ ์™„ํ™”์ฑ…
MFBDS (ZombieLoad v1)
CVE-2018-12130		 Line Fill Buffer (LFB)
์ฝ”์–ด ๊ฐ„ ๋ฐ์ดํ„ฐ ๋กœ๋“œ/์บ์‹œ ๋ผ์ธ ํ•„๋ง		 Intel Sandy Bridge ~ Coffee Lake (x86_64) ๋งˆ์ดํฌ๋กœ์ฝ”๋“œ ์—…๋ฐ์ดํŠธ (MD_CLEAR ์ง€์›) ์ปค๋„-์œ ์ € ๊ณต๊ฐ„ ๋ณต๊ท€ ์‹œ VERW ์‹คํ–‰ + SMT ๋น„ํ™œ์„ฑํ™”
MSBDS (Fallout)
CVE-2018-12126		 Store Buffer (SB)
์Šคํ† ์–ด-๋กœ๋“œ ํฌ์›Œ๋”ฉ ์ฃผ์†Œ ๊ณ„์‚ฐ ์ง€์—ฐ		 Intel Haswell ~ Cascade Lake (x86_64) ๋งˆ์ดํฌ๋กœ์ฝ”๋“œ ์—…๋ฐ์ดํŠธ (MD_CLEAR) VERW ๋ฒ„ํผ ์†Œ๊ฑฐ + mds=full
MLPDS (RIDL)
CVE-2018-12127		 Load Ports (LP)
์ž„์‹œ ๋กœ๋“œ ๋ฒ„ํผ ๋ ˆ์ง€์Šคํ„ฐ		 Intel Nehalem ~ Whiskey Lake (x86_64) ๋งˆ์ดํฌ๋กœ์ฝ”๋“œ ์—…๋ฐ์ดํŠธ (MD_CLEAR) VERW ๋ฒ„ํผ ์†Œ๊ฑฐ
TAA (ZombieLoad v2)
CVE-2019-11135		 TSX Transactional Abort ์ค‘ LFB ์ž”์—ฌ ๋ฐ์ดํ„ฐ ์šฐํšŒ Intel TSX ์ง€์› ํ”„๋กœ์„ธ์„œ (Skylake, Cascade Lake) TSX ๋น„ํ™œ์„ฑํ™” (IA32_TSX_CTRL) / Microcode tsx_async_abort=full + VERW ๋ฒ„ํผ ์†Œ๊ฑฐ
MMIO Stale Data
CVE-2022-21123 ๋“ฑ		 Device MMIO ์ฝ๊ธฐ ๋ฒ„ํผ ์ž”์—ฌ ๋ฐ์ดํ„ฐ Intel ์ „๋ฐ˜ (x86_64) ๋งˆ์ดํฌ๋กœ์ฝ”๋“œ ๋ฒ„ํผ ์†Œ๊ฑฐ ๊ธฐ๋Šฅ ํ™•์žฅ mmio_stale_data=full (VERW ์—ฐ๋™)
ARM64 Status ํ•ด๋‹น ์—†์Œ (ARM Core๋Š” ๊ณต์œ  LFB ์šฐํšŒ ๋ฏธ๊ตฌํ˜„) ARMv8 / ARMv9 (Cortex-A, Neoverse) ํ•˜๋“œ์›จ์–ด ์ž์ฒด ๋ฉด์—ญ (Not affected) ๋ณ„๋„ ๋ฒ„ํผ ์†Œ๊ฑฐ ๋ถˆํ•„์š”