Intel CPU: a new patch is coming for Zombieload, the third

Intel has announced the arrival of one on its official blog new patch that it should finally fix the Zombieload vulnerability, an important series of security holes revealed to the public last May but still not definitively resolved by the US manufacturer. Zombieload (or RIDL) is the name by which security researchers named these vulnerabilities, defined instead by Intel as Microarchitectural Data Sampling (MDS); this further mitigation would be Intel's third attempt after patches released in May and November last year.

Going into more detail, the mitigation concerns two specific attacks that would still be possible despite the updates released in 2019, it is respectively Transactional Synchronization Extensions (TSX) Asynchronous Abort (TAA) (also known as Zombieload 2) and di L1D Eviction Sampling (L1DES).

Like Meltdown and Specter these are side-channel attacks related to speculative action and which can potentially have direct access to processor data. For example, of the two attacks in question, L1DES (simplifying) leverages its own flaw which in particular conditions allows it to "write" data on Cache L1 in order to saturate it and subsequently "move" excess data to a buffer (line- fill buffer) to recover space, thus making the processor vulnerable.

The new patch is expected to arrive in the coming weeks, a this address find the list of processors (consumer and server) affected by these vulnerabilities.