Secure Your Chrome OS: Understanding and Mitigating Microarchitectural Data Sampling (MDS) Vulnerabilities

Microarchitectural Data Sampling (MDS) vulnerabilities (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091) pose a risk to sensitive data on Chrome OS devices. This article breaks down these vulnerabilities, their impact, and how to mitigate them to protect your information.

What are Microarchitectural Data Sampling (MDS) Vulnerabilities?

MDS is a class of security flaws that could allow attackers to access sensitive data stored in your device's memory. These vulnerabilities exploit how CPUs handle data, potentially exposing information like:

Website content
Passwords
Credit card numbers
Cookies
Data from virtual machines or privileged processes

How MDS Impacts Chrome OS Users

MDS vulnerabilities can impact Chrome OS users in several ways:

Data breaches: Attackers could potentially steal sensitive information stored on your device.
Virtual machine compromise: MDS can be exploited to read host memory from inside a virtual machine.
Android app security: Android apps could potentially access privileged process memory, such as keymaster data.

Chrome OS's Defense Against MDS: Disabling Hyper-Threading

To address MDS vulnerabilities, Chrome OS 74 and later versions implement key security measures:

Hyper-Threading Disabled: Chrome OS 74 disables Hyper-Threading by default, reducing the attack surface without significantly impacting performance for most users.
Ongoing Mitigations: Chrome OS 75 includes additional security improvements to further mitigate MDS risks.

Re-enabling Hyper-Threading: A Performance vs. Security Trade-off

For users with CPU-intensive workloads, Hyper-Threading can be re-enabled, but at a security risk. This setting can be adjusted via:

chrome://flags#scheduler-configuration: Set to "performance" to enable or "conservative" to disable Hyper-Threading.
Enterprise Policy: Organizations can manage Hyper-Threading settings using the “SchedulerConfiguration” enterprise policy.

Enabling Hyper-Threading may improve performance but also increases the risk of MDS exploitation. Weigh the performance benefits against the potential security risks based on your specific needs and data sensitivity.

Understanding the Specific MDS Vulnerabilities

MDS encompasses several specific vulnerabilities related to speculative execution and CPU microarchitecture:

MSBDS (Microarchitectural Store Buffer Data Sampling) & MFBDS (Microarchitectural Fill Buffer Data Sampling): (CVE-2018-12126 and CVE-2018-12130) Exploit the fill buffer and store buffer within Intel CPUs, allowing concurrent threads to potentially access data from previous operations.
MLPDS (Microarchitectural Load Port Data Sampling): (CVE-2018-12127) Leverages load ports used for memory and I/O operations, where residual data can be leaked through speculative execution.
MDSUM (Microarchitectural Data Sampling Uncacheable Memory): (CVE-2019-11091) Targets uncacheable memory (UC), which, despite bypassing the CPU cache, still traverses buffers and load ports, making it vulnerable to data leaks.

Should You Disable Hyper-Threading?

Google's guidance is clear: disabling Hyper-Threading is a security-performance trade-off. As of May 14th, 2019, there's no known active exploitation of these vulnerabilities. However, if you're handling highly sensitive data, disabling Hyper-Threading is a recommended precaution.

The decision hinges on your specific use case. Are you processing financial transactions, medical records, or other highly confidential information? If so, the performance hit of disabling Hyper-Threading is likely worth the added security.

List of Affected Chrome OS Devices

As of May 14th, 2019, the following Chrome OS devices with affected Intel CPUs are impacted; It's important to check the manufacturer's website for the latest information on your specific model:

AOpen Chromebase Commercial
AOpen Chromebox Commercial
ASI Chromebook
ASUS Chromebook C200MA
ASUS Chromebook C300MA
ASUS Chromebook Flip C302
ASUS Chromebox 3
ASUS Chromebox CN60
ASUS Chromebox CN62
Acer C720 Chromebook
Acer Chromebase 24
Acer Chromebook 11 (C740)
Acer Chromebook 11 (C771 / C771T)
Acer Chromebook 13 (CB713-1W )
Acer Chromebook 15 (C910 / CB5-571)
Acer Chromebook 15 (CB3-531)
Acer Chromebook Spin 13 (CP713-1WN)
Acer Chromebox
Acer Chromebox CXI2
Acer Chromebox CXI3
Bobicus Chromebook 11
CTL Chromebox CBx1
CTL N6 Education Chromebook
Chromebook 11 (C730 / CB3-111)
Chromebook 11 (C735)
Chromebook 14 for work (CP5-471)
Chromebox Reference
Consumer Chromebook
Crambo Chromebook
Dell Chromebook 11
Dell Chromebook 11 (3120)
Dell Chromebook 13 3380
Dell Chromebook 13 7310
Dell Chromebox
Dell Inspiron Chromebook 14 2-in-1 7486
Education Chromebook
eduGear Chromebook R
Edxis Chromebook
Edxis Education Chromebook
Google Chromebook Pixel (2015)
Google Pixelbook
HEXA Chromebook Pi
HP Chromebook 11 2100-2199 / HP Chromebook 11 G3
HP Chromebook 11 2200-2299 / HP Chromebook 11 G4/G4 EE
HP Chromebook 13 G1
HP Chromebook 14
HP Chromebook 14 ak000-099 / HP Chromebook 14 G4
HP Chromebook x2
HP Chromebook x360 14
HP Chromebox CB1-(000-099) / HP Chromebox G1/ HP Chromebox for Meetings
HP Chromebox G2
Haier Chromebook 11 G2
JP Sa Couto Chromebook
LG Chromebase 22CB25S
LG Chromebase 22CV241
Lenovo 100S Chromebook
Lenovo N20 Chromebook
Lenovo N21 Chromebook
Lenovo ThinkCentre Chromebox
Lenovo ThinkPad 11e Chromebook
Lenovo Thinkpad X131e Chromebook
M&A Chromebook
Pixel Slate
RGS Education Chromebook
Samsung Chromebook 2 11 - XE500C12
Samsung Chromebook Plus (LTE)
Samsung Chromebook Plus (V2)
Samsung Chromebook Pro
Senkatel C1101 Chromebook
Thinkpad 13 Chromebook
Toshiba Chromebook
Toshiba Chromebook 2
Toshiba Chromebook 2 (2015 Edition)
True IDC Chromebook
Videonet Chromebook
ViewSonic NMP660 Chromebox
Yoga C630 Chromebook

Stay Informed and Secure

Microarchitectural Data Sampling vulnerabilities represent a potential security risk to Chrome OS devices. By understanding these vulnerabilities and taking appropriate mitigation steps, such as disabling Hyper-Threading when handling sensitive data, you can significantly enhance your device's security posture. Keep your Chrome OS updated and stay informed about the latest security advisories for optimal protection.