Device Register Partial Write (DRPW)

A successful exploit permits local disclosure of sensitive stale data, with high confidentiality impact. It does not provide integrity modification or availability impact under the documented CVSS assessment. In configurations where stale data is propagated into fill buffers, other unmitigated microarchitectural data-sampling techniques may enable further inference of that data.

Restrict direct MMIO access by untrusted software, particularly in virtualized environments that assign or expose device MMIO to guests. Where an untrusted guest can access MMIO, execute the memory-operand VERW fill-buffer clear before VMENTER on systems not otherwise covered by MDS or TAA mitigations. Where MDS or TAA is present, clear fill buffers with VERW before transitions to untrusted software. Avoid co-scheduling distinct security domains on sibling SMT threads, or use core scheduling/isolation, to reduce race-based extraction and confused-deputy exposure.

Apply current Intel processor microcode or OEM firmware updates and the corresponding operating-system and VMM updates. On Linux and Red Hat Enterprise Linux systems, install the vendor kernel update that incorporates the applicable mitigations, then reboot so the updated kernel and microcode handling take effect. Updated microcode extends the memory-operand form of VERW to clear fill buffers on processors that enumerate FB_CLEAR; OS and VMM software must invoke this mitigation at applicable trust-boundary transitions.