L1 Terminal Fault

L1 Terminal Fault
Natascha Eibl · CC0 · source
Name	L1 Terminal Fault
Aliases	MDS family, L1TF
Affected	Intel, x86-64, Data Center, Cloud computing
Discovered	2018
Disclosed	2018
Cve	CVE-2018-3615, CVE-2018-3620, CVE-2018-3646
Severity	High
Mitigations	Microcode updates, OS patches, hypervisor updates, firmware

L1 Terminal Fault L1 Terminal Fault is a speculative-execution side-channel vulnerability disclosed in 2018 that affects Intel processors and has implications for Data Center operators, Cloud computing providers, and security researchers. It enables an attacker with local or virtualized code-execution capabilities to infer privileged data by abusing the L1 cache behavior on certain x86-64 implementations. The vulnerability prompted coordinated disclosure among vendors including Intel Corporation, cloud providers like Amazon Web Services, Microsoft Azure, and organizations such as Google and Red Hat.

Background and technical details

L1 Terminal Fault exploits interactions between speculative execution hardware and microarchitectural elements such as the L1 cache, Translation Lookaside Buffer, and page-table handling implemented by Intel microarchitectures. Researchers who analyzed speculative execution vulnerabilities that followed Spectre and Meltdown—work involving teams at Google Project Zero, University of Pennsylvania, Graz University of Technology, and UC Berkeley—identified that page fault and permission checks could be speculatively bypassed, transiently allowing access to data tagged as inaccessible. The root cause lies in microcode and design choices in families of Intel Xeon and Intel Core processors where speculative paths can use stale or unvalidated translations stored in microarchitectural caches.

The engineering analysis drew on prior investigations by groups at ETH Zurich, Imperial College London, and industry labs at ARM Ltd. and AMD to compare microarchitectural mitigations. Coordinated vulnerability disclosure involved the CERT Coordination Center, ENISA, and vendor security teams to align CVE assignments and advisories.

Vulnerability mechanics and exploitability

Attackers leverage transient execution windows created when the processor speculatively services memory accesses during page-table or permission faults. The exploit pattern typically uses microarchitectural covert channels—such as cache-timing techniques exemplified by Flush+Reload and Prime+Probe—to exfiltrate data from privileged contexts like kernel memory, hypervisor pages, or other virtual machines. Proof-of-concept work by security researchers at TU Graz, Microsoft Research, and Google Project Zero demonstrated cross-process and cross-VM leakage without relying on software bugs in Linux, Windows, or Xen itself.

Exploitability depends on attacker capabilities: local unprivileged code, guest VM execution on shared hardware in Amazon EC2 or Google Compute Engine, or co-resident containers when processor features are shared. Successful exploitation also requires bypassing or avoiding mitigations like kernel page-table isolation techniques implemented by Linus Torvalds-led maintainers in the Linux kernel and analogous mitigations in Windows Server and hypervisors such as KVM and Xen.

Affected systems and software

The vulnerability affects generations of Intel microarchitectures including some Intel Skylake, Intel Broadwell, Intel Haswell, and Intel Sandy Bridge derivatives deployed across desktops, laptops, and servers. Affected software stacks include operating systems and hypervisors that rely on shared physical cores: Linux kernel, Microsoft Windows, VMware ESXi, Xen Project, and KVM-based platforms. Major cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud Platform issued advisories because multi-tenant deployments such as Amazon EC2, Azure Virtual Machines, and Google Compute Engine could be vectors for cross-tenant data leakage.

Embedded and edge devices using vulnerable Intel Atom or mobile Intel Core parts may also be impacted, prompting firmware and BIOS updates from vendors including Dell, HP, Lenovo, and Supermicro.

Mitigations and patches

Mitigation required coordinated microcode updates from Intel Corporation, operating system patches from Linux kernel maintainers and Microsoft Corporation, and hypervisor changes in VMware, Xen Project, and KVM. Typical mitigations include disabling hyper-threading on affected systems, implementing kernel page-table isolation (KPTI), applying microcode to change speculative behavior, and enforcing stronger process and VM isolation policies. Cloud providers performed live migration, host remediation, and tenant isolation steps guided by advisories from NIST and the CERT Coordination Center.

Vendors released staged updates: firmware and microcode from Intel, kernel updates from Red Hat and Canonical, and hypervisor patches from VMware and Citrix Systems. Some mitigations impose performance overheads, especially on I/O-heavy and context-switch-intensive workloads, motivating guidance from SPEC and performance analysis by teams at Google and Microsoft Research.

Security impact and real-world incidents

The disclosure raised concerns for multi-tenant environments such as shared Data Center racks in large providers like Amazon, Microsoft, and Google, where cross-VM confidentiality is critical for customers including NASA, Department of Defense, and large financial firms like JPMorgan Chase. While public reports documented research demonstrations and coordinated mitigations, there were no widely confirmed, attributed large-scale data breaches directly linked to exploitation of this vulnerability in production clouds. Incident response teams at vendors including Cisco Systems, Intel Corporation, and IBM included L1 Terminal Fault in audit and patch campaigns alongside other speculative-execution vulnerabilities disclosed in 2018.

Detection and remediation guidance

Organizations are advised to inventory hardware to identify affected Intel CPU models, apply vendor microcode and firmware updates, and install operating system and hypervisor patches from distributors such as Red Hat, Canonical, and Microsoft. For cloud tenants, recommendations include requesting host remediation from providers like Amazon Web Services and Google Cloud Platform, and avoiding co-residency with untrusted tenants when possible. Security teams should monitor advisories from US-CERT, NIST, and vendor security advisories, test performance impacts in staging environments using benchmarks from SPEC, and consider disabling simultaneous multithreading in threat-sensitive deployments.

Administrators can use vendor tooling from Intel and system inventories maintained by Red Hat Satellite or Microsoft System Center to verify applied mitigations. Combined defenses—microcode updates, OS patches, hypervisor hardening, and operational controls—constitute the primary remediation strategy to reduce residual risk.

Category:CPU security vulnerabilities