Support for a new Intel processor feature called MbClear.However, there were two primary hypervisor changes required: Virtual-Processor Address Space IsolationĪs we extended HyperClear to mitigate these new vulnerabilities, the fundamental components of the architecture remained constant.However, we know that many of our customers are also interested to know how we’ve extended the Hyper-V HyperClear architecture to provide protections against these vulnerabilities.Īs we described in the original HyperClear blog post, HyperClear relies on 3 main components to ensure strong inter-VM isolation: We have already shared the technical details of HyperClear and the set of required changes to mitigate this new set of hardware vulnerabilities with industry partners. Just as before, the HyperClear mitigation allows for safe use of hyper-threading in a multi-tenant virtual machine hosting environment. These updates have been deployed to Azure and are available in Windows Server 2016 and later supported releases of Windows and Windows Server.

In fact, HyperClear required a relatively small set of updates to provide strong inter-VM and intra-OS protections for our customers. Fortunately for us and for our customers, HyperClear has proven to be an excellent foundation for mitigating this new set of side channel vulnerabilities. Foreshadow) Intel side channel vulnerability. We originally designed HyperClear as a defense against the L1 Terminal Fault (a.k.a. In a previous blog post, the Hyper-V hypervisor engineering team described our high-performing and comprehensive side channel vulnerability mitigation architecture, HyperClear. This includes intra-OS attacks as well as inter-VM attacks. These vulnerabilities are like other Intel CPU vulnerabilities disclosed recently in that they can be leveraged for attacks across isolation boundaries.

These vulnerabilities are referred to as CVE-2018-12126 Microarchitectural Store Buffer Data Sampling (MSBDS), CVE-2018-12130 Microarchitectural Fill Buffer Data Sampling (MFBDS), CVE-2018-12127 Microarchitectural Load Port Data Sampling (MLPDS), and CVE-2018-11091 Microarchitectural Data Sampling Uncacheable Memory (MDSUM). The list of affected processors includes Intel Xeon, Intel Core, and Intel Atom models. Four new speculative execution side channel vulnerabilities were announced today and affect a wide array of Intel processors.

Kevcam