Update: Intel has provided TechRadar Pro with the following statement.
“Intel reviewed the report and informed researchers that existing mitigations were not being bypassed and that this scenario is addressed in our secure coding guidance. Software following our guidance already have protections against incidental channels including the uop cache incidental channel. No new mitigations or guidance are needed.”
Researchers have discovered multiple new variants of the Spectre exploits, affecting both Intel and AMD processors, that are not protected by existing mitigations.
Discovered by researchers from the University of Virginia and University of California San Diego, the vulnerabilities leak data via micro-op caches, which are meant to speed up processing by storing simple commands and allowing the processor to fetch them quickly and early in the speculative execution process.
Worryingly, the researchers note there are currently no known mitigations for these new vulnerabilities.
- We've put together a list of the best endpoint protection software
- Here’s our collection of the best disaster recovery services
- And, these are the best firewall apps and services
The team reported its discovery to both Intel and AMD in April, and will now present their findings at the International Symposium on Computer Architecture (ISCA) conference next month.
Harder to mitigate
Venkat’s team discovered that hackers can steal data when a processor fetches commands from the micro-op cache.
“Think about a hypothetical airport security scenario where TSA lets you in without checking your boarding pass because (1) it is fast and efficient, and (2) you will be checked for your boarding pass at the gate anyway,” Venkat said.
“A computer processor does something similar. It predicts that the check will pass and could let instructions into the pipeline. Ultimately, if the prediction is incorrect, it will throw those instructions out of the pipeline,” explains Venkat.
He adds that by the time the processor decides to discard the instructions, it might be too late since these instructions might have left “side-effects” in the pipeline that can be exploited by an attacker to infer confidential information such as passwords.
Venkat adds that the current mitigations fail to protect against this new attack vector since all current Spectre defenses kick in at a later stage of speculative execution.
Furthermore, the researchers believe this new attack by way of the micro-op cache will be harder to mitigate.
“Patches that disable the micro-op cache or halt speculative execution on legacy hardware would effectively roll back critical performance innovations in most modern Intel and AMD processors, and this just isn’t feasible,” notes Ren, the lead student author.
- We've also highlighted the best antivirus solutions
Via Tom’s Hardware
