Intel continues to get beaten up by their decision to defer access checks in speculation. Meltdown, L1TF, and now LVI-stale-data are all rooted in one mistake. Fortunately, the silicon fix for Meltdown appears to mitigate these issues ("RDCL_NO"). But it also introduces LVI-NULL (which is admittedly more restricted, but still problematic).

The Intel deep dive [0] is a pretty solid addition to the original paper [1].

It looks like Ice Lake processors are going to be the first ones that are not affected [2]. Based on the deep dive, it sounds like these still aren't perfect (they don't completely avoid forwarding values to dependent instructions from faulting loads). They instead exhibit some behavior they call "zero-at-ret", which Intel says is not expoitable in practice.

Intel does not explicitly say Ice Lake is zero-at-ret, but reading between the lines this seems to be the case ("parts generally exhibiting Zero-at-ret behavior... will be documented as 'not affected'.") Only Ice Lake is listed as not affected, so they likely would not put this caveat in there if this did not apply to Ice Lake.

[0] https://software.intel.com/security-software-guidance/insigh... [1] https://lviattack.eu/lvi.pdf [2] https://software.intel.com/security-software-guidance/insigh...