Speculative Store Bypass (SSB) () is the name given to a hardware security vulnerability and its exploitation that takes advantage of speculative execution in a similar way to the Meltdown and Spectre security vulnerabilities. It affects the ARM, AMD and Intel families of processors. It was discovered by researchers at Microsoft Security Response Center and Google Project Zero (GPZ). After being leaked on 3 May 2018 as part of a group of eight additional Spectre-class flaws provisionally named Spectre-NG, it was first disclosed to the public as "Variant 4" on 21 May 2018, alongside a related speculative execution vulnerability designated "Variant 3a".
Details Speculative execution exploit Variant 4, is referred to as Speculative Store Bypass (SSB), and has been assigned . SSB is named Variant 4, but it is the fifth variant in the Spectre-Meltdown class of vulnerabilities.
Steps involved in exploit: "Slowly" store a value at a memory location "Quickly" load that value from that memory location Utilize the value that was just read to disrupt the cache in a detectable way
Impact and mitigation Intel claims that web browsers that are already patched to mitigate Spectre Variants 1 and 2 are partially protected against Variant 4. Intel said in a statement that the likelihood of end users being affected was "low" and that not all protections would be on by default due to some impact on performance. The Chrome JavaScript team confirmed that effective mitigation of Variant 4 in software is infeasible, in part due to performance impact.
Intel is planning to address Variant 4 by releasing a microcode patch that creates a new hardware flag named Speculative Store Bypass Disable (SSBD). A stable microcode patch is yet to be delivered, with Intel suggesting that the patch will be ready "in the coming weeks". Many operating system vendors will be releasing software updates to assist with mitigating Variant 4; however, microcode/firmware updates are required for the software updates to have an effect.
Speculative execution exploit variants +Summary of speculative execution variantsVulnerability CVE Exploit name Public vulnerability name CVSS v2.0 CVSS v3.0 Spectre 2017-5753 Variant 1 Bounds Check Bypass (BCB) 4.7 5.6 Spectre 2017-5715 Variant 2 Branch Target Injection (BTI) 4.7 5.6 Meltdown 2017-5754 Variant 3 Rogue Data Cache Load (RDCL) 4.7 5.6 Spectre-NG 2018-3640 Variant 3a Rogue System Register Read (RSRRSometimes misspelled "RSRE") 4.7 5.6 Spectre-NG 2018-3639 Variant 4 Speculative Store Bypass (SSB) 4.9 5.5 Spectre-NG 2018-3665 Lazy FP State Restore 4.7 5.6 Spectre-NG 2018-3693 Bounds Check Bypass Store (BCBS) 4.7 5.6 Foreshadow 2018-3615 Variant 5 L1 Terminal Fault (L1TF) 5.4 6.4 Foreshadow-NG 2018-3620 4.7 5.6Foreshadow-NG 2018-3646 4.7 5.6
References
See also Speculative execution CPU vulnerabilities
External links Website detailing the Meltdown and Spectre vulnerabilities, hosted by Graz University of Technology Google Project Zero write-up Meltdown/Spectre Checker Gibson Research Corporation