The Patching Friars' AlmanacA calendar of CVE saints

Patron of November 13

FalloutHoly card for fallout, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 store Fallout PLUVIA EX BUFFER
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Fallout, Radioactive Rain From the Store Buffers

Patron of the CPU's store buffers, the MDS attacks, and everyone who gathers the leftovers in memory.

Life

In May 2019, with broader disclosure in November, researchers revealed Fallout, part of the MDS (Microarchitectural Data Sampling) family: using speculative execution one could sample data that had just passed through the processor's store buffers, the small temporary holds for writes. From any program a fallout of other people's fragments rained down, kernel data included. Intel fixed it with microcode and buffer flushing on context switches.

Prayer

O Saint Fallout, who rains down the leftovers of others' writes, let our buffers empty before they change masters. Amen.

How to celebrate

Celebrated by updating the microcode and enabling buffer flushing on context switch.

Where writing is hasty, something rains back down.

Technical record

Disclosed on
November 13 2019
CVE
CVE-2018-12126
CVSS
5.6
Product
Intel Corporation · Central ProcCVE-2018-12126essing Units (CPUs)

Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

Sources: mdsattacks.com

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.