Connect with us

Hi, what are you looking for?


Cloud Security

Intel MDS Vulnerabilities: What You Need to Know

Advisories from tech companies for Intel MDS vulnerabilities

Advisories from tech companies for Intel MDS vulnerabilities

Tech giants have published security advisories and blog posts in response to the Microarchitectural Data Sampling (MDS) vulnerabilities affecting most Intel processors made in the last decade.

The vulnerabilities are related to speculative execution and they can be exploited for side-channel attacks. Researchers started reporting the flaws to Intel in June 2018, but the chip maker said its own researchers found them first. Nevertheless, in addition to its own employees, Intel has credited researchers from several universities and companies for the security holes.

Researchers named the new attack methods ZombieLoad, RIDL (Rogue In-Flight Data Load), Fallout, and Store-to-Leak Forwarding. Intel has assigned them the following names and CVEs: Microarchitectural Fill Buffer Data Sampling (MFBDS, CVE-2018-12130), Microarchitectural Store Buffer Data Sampling (MSBDS, CVE-2018-12126), Microarchitectural Load Port Data Sampling (MLPDS, CVE-2018-12127), and Microarchitectural Data Sampling Uncacheable Memory (MDSUM, CVE-2018-11091).

The attack methods pose a threat to both PCs and cloud environments, and they allow hackers to get applications, the operating system, virtual machines and trusted execution environments to leak information, including passwords, website content, disk encryption keys and browser history. Attacks can be launched both by a piece of malware present on the targeted system and from the internet.

However, Intel says exploitation in a real-world attack is not an easy task and the attacker may not be able to obtain valuable information even if the exploit is successful.

The products of several major tech companies are impacted by the flaws and most of them have already published blog posts and advisories providing information on their impact and the availability of patches and mitigations.


Intel says its newer products, such as some 8th and 9th generation Core processors and 2nd generation Xeon Scalable processors, address these vulnerabilities at hardware level. Some of the other affected products have received or will receive microcode updates that should mitigate the flaws. The company has published a technical deep dive and a list that users can check to see if their processors will receive microcode updates.

Advertisement. Scroll to continue reading.

Intel says the mitigations should have minimal performance impact for a majority of PCs, but performance may be impacted in the case of data center workloads.

Disabling hyper-threading on vulnerable CPUs should prevent exploitation of the vulnerabilities.


Apple informed customers that macOS Mojave 10.14.5 and Security Update 2019-003 for Sierra and High Sierra include the option to enable full mitigation for the MDS attacks. Mojave 10.14.5 also includes a Safari update that should prevent exploitation from the internet.


Microsoft has started releasing software updates for Windows and deployed server-side fixes to its cloud services to mitigate the vulnerabilities. The company has pointed out that in addition to software updates, firmware updates are also required for full protection against attacks.

Microsoft has also released a PowerShell script that users can run on their systems to check the status of speculative execution mitigations.


Google has made available a page where users are informed about the actions they need to take depending on the products they have. The internet giant says its infrastructure, G Suite, and Google Cloud Platform products and services are protected against attacks, but some cloud users may need to take action.

The company says a vast majority of Android devices are not impacted. In the case of Chrome OS devices, Google has disabled hyper-threading by default starting with version 74 and additional mitigations will be available in Chrome OS 75.


VMware told users that the vulnerabilities impact its VMware vCenter Server
, vSphere ESXi, Workstation, Fusion, vCloud Usage Meter, Identity Manager, vCenter Server, vSphere Data Protection, vSphere Integrated Containers, and vRealize Automation products.

The company provides hypervisor-specific mitigations and hypervisor-assisted guest mitigations for the impacted products. These mitigations involve software updates and patches from VMware.

VMware pointed out that exploitation of the flaws requires local access to the targeted virtual machine and the ability to execute code.


IBM says it’s rolling out the microcode updates from Intel and mitigations to its cloud services. The company told users that its POWER processors are not impacted by the MDS vulnerabilities.


Citrix says full mitigation of the Intel chip vulnerabilities involves updates to the Citrix hypervisor and updates to the CPU microcode. The company has released a hotfix for XenServer 7.1, which includes both hypervisor and CPU microcode updates, and it plans on releasing similar hotfixes for other affected products.


A blog post from Oracle describes the impact of the flaws on the company’s hardware, operating systems, and cloud services. X86-based systems need to be assessed by their administrators and Oracle Engineered Systems customers will receive specific guidance from the company.

Oracle SPARC servers and Solaris on SPARC are not impacted, but Solaris on x86 systems is affected. Patches have been released by Oracle for Oracle Linux and VM Server products.


Amazon Web Services (AWS) said on Tuesday that it had deployed protections for MDS attacks to all its infrastructure and no action is required from users. The company has released updated kernels and microcode packages for Amazon Linux AMI 2018.3 and Amazon Linux 2.

Xen Project

The Xen Project says systems running all versions of Xen are affected by the vulnerabilities if they use x86 Intel processors.

Linux distributions

Advisories for the MDS vulnerabilities in Intel processors have been published by Linux kernel developers, Red Hat, Debian, Ubuntu and SUSE. Linux distributions have already started rolling out updates that should mitigate the flaws.

Hardware manufacturers

Many hardware manufacturers whose products use Intel processors are likely affected by the ZombieLoad and RIDL vulnerabilities. However, so far, only Lenovo and HP appear to have started releasing firmware patches for their devices.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...