CVE-2024-21823

Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access

Weakness

The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.

Affected Software

Extended Description

Many high-performance on-chip bus protocols and processor data-paths employ separate channels for control and data to increase parallelism and maximize throughput. Bugs in the hardware logic that handle errors and security checks can make it possible for data to be forwarded before the completion of the security checks. If the data can propagate to a location in the hardware observable to an attacker, loss of data confidentiality can occur. ‘Meltdown’ is a concrete example of how de-synchronization between data and permissions checking logic can violate confidentiality requirements. Data loaded from a page marked as privileged was returned to the cpu regardless of current privilege level for performance reasons. The assumption was that the cpu could later remove all traces of this data during the handling of the illegal memory access exception, but this assumption was proven false as traces of the secret data were not removed from the microarchitectural state.

Potential Mitigations

• Thoroughly verify the data routing logic to ensure that any error handling or security checks effectively block illegal dataflows.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/233.html
• https://cwe.mitre.org/data/definitions/663.html

References

• http://www.openwall.com/lists/oss-security/2024/05/15/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01084.html