Downfall / Gather Data Sampling (GDS) in Intel Processors

CVE-2022-40982, also known as Downfall or Gather Data Sampling (GDS), is a transient execution side-channel vulnerability affecting certain Intel processors, broadly described as Skylake through Ice Lake/Tiger Lake-era parts, while newer families such as Alder Lake, Raptor Lake, and Sapphire Rapids are described as not affected. The flaw is rooted in speculative execution behavior associated with AVX GATHER instructions in certain vector execution units. During transient execution, stale data from previously used vector registers or an internal gather data buffer can be forwarded to dependent instructions, enabling inference of data across security boundaries. Reported contexts indicate leakage can occur across user/kernel boundaries, between processes, across sibling SMT threads on the same physical core, between virtual machines, and even from trusted execution environments such as SGX. Public research also described a related technique, Gather Value Injection (GVI), built on the same underlying behavior.