Global InformationLazy FP state restore information
Lazy FPU state leak (CVE-2018-3665), also referred to as Lazy FP State Restore[1] or LazyFP,[2][3] is a security vulnerability affecting Intel Core CPUs.[1][4] The vulnerability is caused by a combination of flaws in the speculative execution technology present within the affected CPUs[1] and how certain operating systems handle context switching on the floating point unit (FPU).[2] By exploiting this vulnerability, a local process can leak the content of the FPU registers that belong to another process. This vulnerability is related to the Spectre and Meltdown vulnerabilities that were publicly disclosed in January 2018.
It was announced by Intel on 13 June 2018, after being discovered by employees at Amazon, Cyberus Technology and SYSGO.[1][a]
Besides being used for floating point arithmetic, the FPU registers are also used for other purposes, including for storing cryptographic data when using the AES instruction set, present in many Intel CPUs.[3] This means that this vulnerability may allow for key material to be compromised.[3]
- ^ a b c d "Lazy FP state restore". Intel. 2018-06-13. Retrieved 2018-06-18.
- ^ a b Stecklina, Julian; Prescher, Thomas (2018-06-19). "LazyFP: Leaking FPU Register State using Microarchitectural Side-Channels". arXiv:1806.07480 [cs.OS].
- ^ a b c Prescher, Thomas; Stecklina, Julian; Galowicz, Jacek. "Intel LazyFP vulnerability: Exploiting lazy FPU state switching". Cyberus Technology. Retrieved 2018-06-18.
- ^ "Xen Security Advisory CVE-2018-3665 / XSA-267, version 3". 2018-06-13. Retrieved 2018-06-18.
- ^ de Raadt, Theo (2018-06-14). "Inflamation by Bryan Cantrill". openbsd-tech (Mailing list). Retrieved 2018-06-18 – via marc.info.
Cite error: There are <ref group=lower-alpha> tags or {{efn}} templates on this page, but the references will not show without a {{reflist|group=lower-alpha}} template or {{notelist}} template (see the help page).