9db7ba
Some Intel Skylake CPU models (SKL-U/Y, family 6, model 78, stepping 3)
9db7ba
have reports of system hangs when revision 0xdc of microcode, that is included
9db7ba
since microcode-20200609 update to address CVE-2020-0543, CVE-2020-0548,
9db7ba
and CVE-2020-0549, is applied[1].  In order to address this, microcode update
9db7ba
to the newer revision has been disabled by default on these systems,
9db7ba
and the previously published microcode revision 0xd6 is used by default
9db7ba
for the OS-driven microcode update.
9db7ba
9db7ba
[1] https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31
9db7ba
9d39cf
For the reference, SHA1 checksums of 06-4e-03 microcode files containing
9db7ba
microcode revisions in question are listed below:
9db7ba
 * 06-4e-03, revision 0xd6: 06432a25053c823b0e2a6b8e84e2e2023ee3d43e
9db7ba
 * 06-4e-03, revision 0xdc: cd1733458d187486999337ff8b51eeaa0cfbca6c
9d39cf
 * 06-4e-03, revision 0xe2: 41f4513cf563605bc85db38056ac430dec948366
cc944f
 * 06-4e-03, revision 0xea: 5a54cab9f22f69b819d663e5747ed6ea2a326c55
fc0a9b
 * 06-4e-03, revision 0xec: d949a8543d2464d955f5dc4b0777cac863f48729
72a479
 * 06-4e-03, revision 0xf0: 37475bac70457ba8df2c1a32bba81bd7bd27d5e8
9db7ba
9db7ba
Please contact your system vendor for a BIOS/firmware update that contains
9db7ba
the latest microcode version.  For the information regarding microcode versions
9db7ba
required for mitigating specific side-channel cache attacks, please refer
9db7ba
to the following knowledge base articles:
9db7ba
 * CVE-2017-5715 ("Spectre"):
9db7ba
   https://access.redhat.com/articles/3436091
9db7ba
 * CVE-2018-3639 ("Speculative Store Bypass"):
9db7ba
   https://access.redhat.com/articles/3540901
9db7ba
 * CVE-2018-3620, CVE-2018-3646 ("L1 Terminal Fault Attack"):
9db7ba
   https://access.redhat.com/articles/3562741
9db7ba
 * CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, and CVE-2019-11091
9db7ba
   ("Microarchitectural Data Sampling"):
9db7ba
   https://access.redhat.com/articles/4138151
9db7ba
 * CVE-2019-0117 (Intel SGX Information Leak),
9db7ba
   CVE-2019-0123 (Intel SGX Privilege Escalation),
9db7ba
   CVE-2019-11135 (TSX Asynchronous Abort),
9db7ba
   CVE-2019-11139 (Voltage Setting Modulation):
9db7ba
   https://access.redhat.com/solutions/2019-microcode-nov
9db7ba
 * CVE-2020-0543 (Special Register Buffer Data Sampling),
9db7ba
   CVE-2020-0548 (Vector Register Data Sampling),
9db7ba
   CVE-2020-0549 (L1D Cache Eviction Sampling):
9db7ba
   https://access.redhat.com/solutions/5142751
501af6
 * CVE-2020-8695 (Information disclosure issue in Intel SGX via RAPL interface),
501af6
   CVE-2020-8696 (Vector Register Leakage-Active),
501af6
   CVE-2020-8698 (Fast Forward Store Predictor):
501af6
   https://access.redhat.com/articles/5569051
f9176a
 * CVE-2020-24489 (VT-d-related Privilege Escalation),
f9176a
   CVE-2020-24511 (Improper Isolation of Shared Resources),
f9176a
   CVE-2020-24512 (Observable Timing Discrepancy),
f9176a
   CVE-2020-24513 (Information Disclosure on Some Intel Atom Processors):
f9176a
   https://access.redhat.com/articles/6101171
fc0a9b
 * CVE-2021-0127 (Intel Processor Breakpoint Control Flow):
fc0a9b
   https://access.redhat.com/articles/6716541
72a479
 * CVE-2022-0005 (Informational disclosure via JTAG),
72a479
   CVE-2022-21123 (Shared Buffers Data Read),
72a479
   CVE-2022-21125 (Shared Buffers Data Sampling),
72a479
   CVE-2022-21127 (Update to Special Register Buffer Data Sampling),
72a479
   CVE-2022-21151 (Optimization Removal-Induced Informational Disclosure),
72a479
   CVE-2022-21166 (Device Register Partial Write):
72a479
   https://access.redhat.com/articles/6963124
9db7ba
9db7ba
The information regarding enforcing microcode update is provided below.
9db7ba
9db7ba
To enforce usage of the latest 06-4e-03 microcode revision for a specific kernel
9db7ba
version, please create a file "force-intel-06-4e-03" inside
9db7ba
/lib/firmware/<kernel_version> directory, run
9db7ba
"/usr/libexec/microcode_ctl/update_ucode" to add it to firmware directory
9db7ba
where microcode will be available for late microcode update, and run
9db7ba
"dracut -f --kver <kernel_version>", so initramfs for this kernel version
9db7ba
is regenerated and the microcode can be loaded early, for example:
9db7ba
9db7ba
    touch /lib/firmware/3.10.0-862.9.1/force-intel-06-4e-03
9db7ba
    /usr/libexec/microcode_ctl/update_ucode
9db7ba
    dracut -f --kver 3.10.0-862.9.1
9db7ba
9db7ba
After that, it is possible to perform a late microcode update by executing
9db7ba
"/usr/libexec/microcode_ctl/reload_microcode" or by writing value "1" to
9db7ba
"/sys/devices/system/cpu/microcode/reload" directly.
9db7ba
9db7ba
To enforce addition of this microcode for all kernels, please create file
9db7ba
"/etc/microcode_ctl/ucode_with_caveats/force-intel-06-4e-03", run
9db7ba
"/usr/libexec/microcode_ctl/update_ucode" for enabling late microcode updates,
9db7ba
and "dracut -f --regenerate-all" for enabling early microcode updates:
9db7ba
9db7ba
    mkdir -p /etc/microcode_ctl/ucode_with_caveats
9db7ba
    touch /etc/microcode_ctl/ucode_with_caveats/force-intel-06-4e-03
9db7ba
    /usr/libexec/microcode_ctl/update_ucode
9db7ba
    dracut -f --regenerate-all
9db7ba
9db7ba
Please refer to /usr/share/doc/microcode_ctl/README.caveats for additional
9db7ba
information.