• United States
Unix Dweeb

How the L1 Terminal Fault vulnerability affects Linux systems

Aug 15, 20183 mins

The L1 Terminal Fault (L1TF) affects Intel processors and thereby Linux systems. Learn what this vulnerability is all about and what Linux users should do about it.

Credit: Sandra Henry-Stocker

Announced just yesterday in security advisories from Intel, Microsoft and Red Hat, a newly discovered vulnerability affecting Intel processors (and, thus, Linux) called L1TF or “L1 Terminal Fault” is grabbing the attention of Linux users and admins. Exactly what is this vulnerability and who should be worrying about it?

L1TF, L1 Terminal Fault, and Foreshadow

The processor vulnerability goes by L1TF, L1 Terminal Fault, and Foreshadow. Researchers who discovered the problem back in January and reported it to Intel called it “Foreshadow”. It is similar to vulnerabilities discovered in the past (such as Spectre).

This vulnerability is Intel-specific. Other processors are not affected. And like some other vulnerabilities, it exists because of design choices that were implemented to optimize kernel processing speed but exposed data in ways that allowed access by other processes.

Three CVEs have been assigned to this issue:

  • CVE-2018-3615 for Intel Software Guard Extensions (Intel SGX)
  • CVE-2018-3620 for operating systems and System Management Mode (SMM)
  • CVE-2018-3646 for impacts to virtualization

An Intel spokesman made this statement regarding this issue: “L1 Terminal Fault is addressed by microcode updates released earlier this year, coupled with corresponding updates to operating system and hypervisor software that are available starting today. We’ve provided more information on our web site and continue to encourage everyone to keep their systems up-to-date, as it’s one of the best ways to stay protected. We’d like to extend our thanks to the researchers at imec-DistriNet, KU Leuven, Technion- Israel Institute of Technology, University of Michigan, University of Adelaide and Data61 and our industry partners for their collaboration in helping us identify and address this issue.”

Does L1TF affect your Linux system?

The short answer is “probably not.” You should be safe if you’ve patched your system since the earlier Spectre and Meltdown vulnerabilities were exposed back in January. As with Spectre and Meltdown, Intel claims that no real-world cases of systems being affected have been reported or detected. They also have said that the changes are unlikely to incur noticeable performance hits on individual systems, but they might represent significant performance hits for data centers using virtualized operating systems.

Even so, frequent patches are always recommended. To check your current kernel level, use the uname -r command:

$ uname -r

More resources

Please check out the following resources to get a detailed understanding of L1TF and why it exists:

Unix Dweeb

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as "USL" (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she's chasing the bears away from her bird feeders.

The opinions expressed in this blog are those of Sandra Henry-Stocker and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author