Shared Buffers Data Sampling (SBDS)

A successful local attack can disclose confidential data processed through affected microarchitectural buffers. The assessed impact is high confidentiality impact with no integrity or availability impact.

Restrict direct MMIO access by untrusted software and guests. In virtualized environments, do not expose MMIO-capable devices to untrusted guests unless required. Where MDS or TAA exposure remains, execute the microcode-supported memory-operand VERW clearing operation before transitions to untrusted software; for systems not affected by MDS or TAA, perform clearing before VMENTER when untrusted guests can access MMIO. Avoid co-scheduling mutually untrusted workloads on sibling SMT threads or use core scheduling/isolation to reduce race-based extraction risk. Red Hat did not identify a standalone mitigation meeting its general deployment and stability criteria; vendor kernel and microcode updates are the preferred remediation.

Apply current Intel processor microcode or platform firmware together with the corresponding operating-system and VMM updates. On supported processors, the microcode-enhanced memory-operand VERW instruction clears fill-buffer contents; deploy kernel and hypervisor versions that invoke it at relevant privilege, guest, and enclave transitions. For Red Hat Enterprise Linux, install the applicable fixed kernel or kernel-rt update for the deployed product stream and reboot to activate the new kernel and microcode mitigation path. Update dependent container images where affected host or base-image kernel packages are supplied through supported updates.