New Spectre V1 Variant Known As SWAPGS [CVE-2019-1125]

A new Spectre V1 variant, known as SWAPGS, has been identified by security researchers. The SWAPGS variant targets specific 64-bit registers (FS and GS) which store memory pointer locations.

The x86 family of microprocessors implements a feature known as memory “segmentation” in which all memory addresses are formed from a segment base address, plus an offset within that segment. The architecture defines segment registers (CS, DS, SS, ES, FS, GS) that may be used in building a complete memory address, with some used implicitly by certain instructions.

The “FS” and “GS” registers can be used in 64-bit mode to provide an offset into memory ranges reserved for specific data. For example, Linux uses “GS” to store TLS (Thread Local Storage) pointers in userspace (user) applications, and to serve as an offset into per_cpu data for a given processor when in-kernel. The SWAPGS instruction is used on 64-bit entry into kernel code to swap the current user space value of “GS” with the value intended to be used during kernel operations.

Under specific circumstances, these registers can be forced to leave their contents, which can then be used to extract sensitive information.

In Windows an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further.

This has been assigned CVE-2019-1125

Further information:

• CVE-2019-1125
• Microsoft Security Vulnerability CVE-2019-1125
• Red Hat Knowledge Base Article CVE-2019-1125