Impact

Gather Data Sampling (GDS) is a transient execution side channel vulnerability affecting certain Intel processors.
This issue may allow a local attacker using gather instruction (load from memory) to infer stale data from previously used vector registers on the same physical core.

Patches

Intel has released microcode updates and Talos extensions has been updated to the latest Intel microcode available as of August 8th, 2023. The main advisories fixed by the microcode are:

• INTEL-SA-00828
• INTEL-SA-00836
• INTEL-SA-00837

Talos would also be shipping 6.1.44 version of the upstream Linux kernel (6.1 is the upstream Kernel long term version Talos ships with). Talos >= v1.4.8 is shipped with Linux Kernel 6.1.44 providing a software workaround if the microcode has not been updated.

Note: If microcode update is not possible updating Talos would not be enough to enforce GDS mitigations. The kernel command line mentioned below needs to be set, if microcode is not set this will disable AVX. It is recommended to have both the microcode and Talos updated. Read the notes below:

Add a kernel parameter gather_data_sampling=force that will enable the
microcode mitigation if available, otherwise it will disable AVX on
affected systems.

This option will be ignored if cmdline mitigations=off.

This is a *big* hammer.  It is known to break buggy userspace that
uses incomplete, buggy AVX enumeration.

Workarounds

All users running Talos with untrusted or shared workloads on affected Intel CPU's must upgrade both Talos and install the latest Intel ucode Talos extension based on the threat model.

References

• https://downfall.page/
• https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/gather-data-sampling.html