Vulnerability: Intel Processors

On May 14 2019, HackerNews announced that academic researchers released the newest class of speculative execution side-channel attacks against Intel chips. The new class of vulnerability affects nearly all processors since 2011. Former side-channel attacks against speculative execution only potentially leaked data within CPU caches. However, the new attack can leak arbitrary data from internal CPU buffers, which can potentially leak arbitrary data. Some vendors have released patches to combat this vulnerability and more are expected imminently. No in-the-wild variants of this attack have been found to date.

Recommendations

• A tool has been released for Windows and Linux to test a system for speculative execution attacks.
• Updates have been released for macOS, Windows, ChromeOS, and Linux.
• Intel has released patches for some of its hardware, but others will have to wait until motherboard vendors release updates.
• Continue to install relevant operating system updates and patches because various vendors responsible for patching this vulnerability will respond at different rates.

Details

Researchers announced a new speculative execution attack against Intel processors. Speculative execution attacks rely on the fact that modern processors use speculative execution to determine if certain code paths are likely to be taken or not. When a processor speculatively executes a branch instruction, it may cross certain privileged barriers and cause the CPU's cache to speculatively load the target of that branch. When this happens, critical data that should only be available to a privileged processor can be potentially leaked by comparing the length of time it takes to do a load which was speculatively executed versus a load in the cache line that was not preemptively loaded. Using statistical sampling methods and enough time, arbitrary data can be leaked from the cache line.

This new class of attack can not only read cache lines but can sample internal CPU buffers for in flight data, which can potentially leak arbitrary data, given enough time on the end system. The CVEs associated with these attacks are: Fallout (CVE-2018-12126), Zombieload/RIDL (CVE-2018-12130), Microarchitectural Load Port Data Sampling (CVE-2018-12127), and this advisory, CVE-2019-11091 (Microarchitectural Data Sampling Uncacheable Memory, a RIDL variant).The researchers demonstrated a proof-of-concept attack that can break Kernel Address Space Layout Randomization as well as leak sensitive kernel data. However, these attacks are in their infancy and no in-the-wild variants have been discovered so far. Patches for this exploit flush caches and in flight buffers if a context switch to privileged code occurs from unprivileged code.