Intel processors (shared resource isolation): MULTI-TENANT ISOLATION: Improper isolation of shared processor resources

Impact

MULTI-TENANT ISOLATION: Improper isolation of shared processor resources allowing information disclosure to a local authenticated user. Fixed in the same microcode drop as the associated Atom domain-bypass issue; relevant to any multi-tenant host.

Who can reach it

Local authenticated code on the host.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect.

References