On May 14, 2019, Intel published information about a new subclass of speculative execution side channel vulnerabilities known as Microarchitectural Data Sampling. An attacker who successfully exploited these vulnerabilities may be able to read privileged data across trust boundaries. In shared resource environments (such as exists in some cloud services configurations), these vulnerabilities could allow one virtual machine to improperly access information from another. In non-browsing scenarios on standalone systems, an attacker would need prior access to the system or an ability to run a specially crafted application on the target system to leverage these vulnerabilities. These vulnerabilities are known as: Important: These vulnerabilities may affect other operating systems and service providers. We advise customers to seek guidance from their respective vendors. Microsoft has released software updates to help mitigate these vulnerabilities. To get all available protections, firmware (microcode) and software updates are required. This may include microcode from device OEMs. In some cases, installing these updates will have a performance impact. We have also acted to secure our cloud services. Microsoft has no information to indicate that these vulnerabilities have been used to attack customers at this time. Microsoft continues working closely with industry partners including chip makers, hardware OEMs, and app vendors to protect customers. To protect your system from these vulnerabilities, Microsoft recommends that you take the following actions, and refer to the subsequent sections for links to further information for your specific situation: Customers using Windows client operating systems need to apply both firmware (microcode) and software updates. See Microsoft Knowledge Base Article 4073119 for additional information. Microsoft is making available Intel-validated microcode updates for Windows 10 operating systems. Please see Microsoft Knowledge Base Article 4093836 for the current Intel microcode updates. In addition, customers should check to see if their OEM is providing additional guidance on updates and mitigations. Surface Support Article 4073065 provides more information to Surface customers. Customers using Windows server operating systems listed in the Affected Products table need to apply firmware (microcode) and software updates as well as to configure protections. See Microsoft Knowledge Base Article 4072698 for additional information, including workarounds. Microsoft Azure has taken steps to address the security vulnerabilities at the hypervisor level to protect Windows Server VMs running in Azure. More information can be found here . Microsoft has already deployed mitigations across our cloud services. More information is available here . In scenarios running Microsoft SQL Server, customers should follow the guidance outlined in Microsoft Knowledge Base Article 4073225 . Updates to Windows 10 for HoloLens are available to HoloLens customers through Windows Update. After applying the February 2018 Windows Security Update HoloLens customers do not need to take any additional action to update their device firmware. These mitigations will also be included in all future releases of Windows 10 for HoloLens. Specific performance impact varies by hardware generation and implementation by the chip manufacturer. For most consumer devices, impact on performance may not be noticeable. Some customers may have to disable Hyper-Threading (SMT) to fully address the risk from MDS vulnerabilities. In testing Microsoft has seen some performance impact with these mitigations, in particular when hyperthreading is disabled. Microsoft values the security of its software and services and has made the decision to implement certain mitigation strategies in an effort to better secure our products. In some cases, mitigations are not enabled by default to allow users and administrators to evaluate the performance impact and risk exposure before deciding to enable the mitigations. We continue to work with hardware vendors to improve performance while maintaining a high level of security. See the following for further information from Intel: 1. When will the firmware updates be available? If you have a non-Microsoft device, we suggest contacting your OEM for this information. 2. Will there be updates for Windows operating systems? Yes. Please see the Security Updates table. 3. I am running Windows 10 for 32-bit Systems. In the September 2019 release, updates have been made available for all other 32-bit versions of Windows. Is one available for my system? UPDATE: With the release of the October 2019 security updates, protections are now available for Windows 10 for 32-bit Systems. Please see the Security Updates table for links to download and install the update. Protections for Windows 10 for 32-bit Systems are not included in the September 2019 release, but will be made available in a near-future release. When the update is available, customers will be notified through a revision to this advisory. If you wish to be notified when the update is released, Microsoft recommends that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications . 4. Where can I find information regarding other speculative side-channel execution vulnerabilities?

No EPSS score available for this CVE.

Lei Shi, Qihoo 360 CERT
Volodymyr Pikhur
Dan Horea Lutas
Ke Sun, Henrique Kawakami, Kekai Hu and Rodrigo Branco – Intel
Matt Miller – Microsoft
Brandon Falk – Microsoft Windows Platform Security Team
Giorgi Maisuradze – Microsoft Research
Andrei Lutas – Bitdefender
Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida – VUSec group at VU Amsterdam
Marina Minkin, Daniel Genkin – University of Michigan
Daniel Moghimi, Berk Sunar – Worcester Polytechnic Institute
Moritz Lipp, Michael Schwarz Daniel Gruss – Graz University of Technology
Jo Van Bulck, Frank Piessens – imec-DistriNet, KU Leuven
Yuval Yarom – University of Adelaide