Keynote: MDS, Fallout, Zombieland & Linux

on YouTube ↗20m

" summary

Year-long survey of speculative-execution CPU flaws (MDS, Fallout, Zombieland, Spectre-class variants) showing concrete mitigations: flush CPU buffers on context switch, apply BIOS/microcode updates, and often disable hyper-threading; measurements report ~1–5% system costs for some fixes, ~15–20% slowdown for heavy kernel builds, and smaller IO-bound impacts (~2%); distro and cloud choices matter (Debian was notified late, Android/LTS adoption increasing), so expect ongoing kernel stable updates and repeated mitigations.

AI-written summary · about

" chapters (10)

1. 0:00Keynote: MDS, Fallout, Zombieland & Linux
2. 1:51MDS == "RIDL", "Fallout", "Zombieload", and others - CPU Hardware bugs • Variants of the same basic problem • Exploits the speculative execution model of Intel CPUs. • Discovered by many different research teams • Kernel and BIOS fixes required to fully solve
3. 3:18One program can read another program's data • Can cross the virtual machine boundary · Exploits "hyper threading" (SMT) issues - SMT are CPUs that usually share TLBs and L1 cache
4. 3:59Guessed more problems would be in this area • Disabled SMT for Intel chips in June 2018 . Repeated the plea to disable this in August 2018 • Prevented almost all MDS issues automatically • Security over performance • Huge respect!
5. 5:01Rogue-Inflight-Data-Load • Exploits CPU Line-fill buffers and Load ports Steal data across applications, virtual machines, secure enclaves . Kernel fix by flushing CPU buffers/ports on context switch
6. 5:57Fallout • Exploits CPU Store Buffers • Read kernel data from userspace Breaks ASLR (random kernel addresses) • "Meltdown" mitigation made this easier to exploit • Kernel fix by flushing CPU buffers on context switch
7. 6:42Exploits CPU Line-Fill buffers . Much like RIDL • Steal data across applications, virtual machines, secure enclaves • Cool logo/name and demo • Kernel fix by flushing CPU buffers on context switch
8. 7:59All of these mitigations slow down the system • No way yet to schedule different security domains on different physical processors (gang scheduling) • Disabling SMT mitigates most problems (not ALL!) • Must disable SMT and enable mitigations to solve completely.
9. 11:36Kernel fixes available on announcement date • Intel notified some kernel developers in advance . Worked together across OS vendors to solve . Much better than Spectre/Meltdown • Process still needs to improve, Debian notified 48 hours before release. • More fixes came after announcement • Update your kernel and BIOS!
10. 18:11If you are not using a supported Linux distribution kernel, or a stable / longterm kernel, you have an insecure system.

" related talks

• 19mKeynote: MDS, Fallout, Zombieland, and LinuxGreg Kroah-Hartman · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 30mSpectre, Meltdown, & LinuxGreg Kroah-Hartman · LinuxCon + ContainerCon + CloudOpen China 2018
• 26mKeynote: The Kernel ReportJonathan Corbet · Embedded Linux Conference + OpenIoT Summit North America 2018
• 06mQ&AGreg Kroah-Hartman · Open Source Summit North America 2018
• 21mPreview: Operating SystemsAdil Ahmad · OSDI '21 / USENIX ATC '21
• 34mGetting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack MitigationsMaxwell Bland · Linux Security Summit North America 2025
• 17mThe Silent Performance Killers: BIOS and Firmware UpdatesDarin E. Langone · SREcon24 Europe/Middle East/Africa
• 05mIgnite: Microcode Updates as Protection Against Spectre & Co.Werner Fischer · OSDC 2019