Intel® Processors Software Developer Guidance Advisory

Summary:

Potential security vulnerabilities in some Intel® Processors may allow information disclosure.** **Intel is releasing updated software developer prescriptive guidance to address these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2021-0086

Description: Observable response discrepancy in floating-point operations for some Intel® Processors may allow an authorized user to potentially enable information disclosure via local access.

CVSS Base Score: 6.5 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVEID: CVE-2021-0089

Description: Observable response discrepancy in some Intel® Processors may allow an authorized user to potentially enable information disclosure via local access.

CVSS Base Score: 6.5 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Products:

All Intel® Processor families.

Recommendations:

For CVE-2021-0086 Intel recommends that affected software including web browser JavaScript engine that runs on Intel® Processors follow one of the below guidelines:

• Process isolation.

• Use alternatives to NaN-boxing techniques (eg. Dedicated type tag).

• Constraining FP results before potential type-confused usage.

Additional technical details can be found here.

For CVE-2021-0089 Intel recommends that affected software that runs on Intel® Processors follow one of the below guidelines:

• Process isolation.

• Place serializing operations between code gen and execution.

• Place LFENCE-semantic operations between code gen and execution.

• Options include LFENCE, SYSCALL/SYSRET

Additional technical details can be found here.

Acknowledgements:

Intel would like to thank Enrico Barberis, Hany Ragab, Herbert Bos, and Cristiano Giuffrida from the VUSec group at VU Amsterdam for reporting these issues.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.