Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/22/2018
06:16 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Intel Says to Stop Applying Problematic Spectre, Meltdown Patch

Cause of reboot problems with its Broadwell and Haswell microprocessor patching now identified, the chipmaker said.

Intel is now advising its customers and partners to halt the installation of patches for its Broadwell and Haswell microprocessor systems in the wake of recent reports of reboot problems. 

Navin Shenoy, executive vice president and general manager of the Data Center Group at Intel, today said in a post that Intel soon will be issuing a fix for the patch. In the meantime, he says customers should refrain from applying the problematic patches.

"We recommend that OEMs, cloud service providers, system manufacturers, software vendors, and end users stop deployment of current versions, as they may introduce higher than expected reboots and other unpredictable system behavior," he said.

Word that customers were experiencing higher system reboot problems began circulating earlier this month, and Intel issued an advisory  about the problem on Jan. 11.

"We have now identified the root cause for Broadwell and Haswell platforms, and made good progress in developing a solution to address it. Over the weekend, we began rolling out an early version of the updated solution to industry partners for testing, and we will make a final release available once that testing has been completed," he said.

Intel early this month issued updates for most of its modern microprocessors after researchers from Google's Project Zero Team, Cyberus Technology, Graz University of Technology, University of Pennsylvania, the University of Maryland, Rambus, and University of Adelaide and Data61, all discovered critical flaws in a method used for performance optimization that could allow an attacker to read sensitive system memory, which could contain passwords, encryption keys, and emails, for example. The vulnerabilities affect CPUs from Intel, AMD, and ARM.

The so-called Meltdown and Spectre hardware vulnerabilities allow for so-called side-channel attacks: in the case of Meltdown, that means sensitive information in the kernel memory is at risk of being accessed nefariously, and for Spectre, a user application could read the kernel memory as well as that of another application. So an attacker could read sensitive system memory, which could contain passwords, encryption keys, and emails – and use that information to help craft a local attack.

Intel recommends that customers and OEMs refer to its Intel.com Security Center site for more details on the fix for the Spectre and Meltdown fix.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/23/2018 | 1:10:27 AM
What's the score?
The DR staff are better informed than I am; but has any of the cost and chaos of Meltdown/Spectre mitigation yet been shown to have thwarted a single attempted explotation?  Put another way, have those that haven't bothered to lift a finger to prevent M/S exploitation paid the price for their indifference?  One more question: how would you rate the handling of the M/S issue, from first discovery of the vulnerabilities, to the press leaks, public announcement, vendor reaction and community response - so far?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/23/2018 | 8:20:21 AM
Re: What's the score?
That's a good question that I would be interested in as well. Although this vulnerability affects a majority of devices the greatest risk, outside of affected DMZ devices, are users already inside of your network. Essentially it allows for persistent listeners to take advantage of an easy exploit when it may have taken them a while to figure out how to traverse the network.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/23/2018 | 11:08:16 PM
Re: What's the score?
@Ryan: Yeah, but the thing is that many attacks really are "insider attacks" because even so many "outsider" attacks require compromising "insider" credentials. So it's a matter of treating this holistically and in depth as opposed to an "M&M security" approach (hard on the outside, soft in the middle).
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/23/2018 | 11:06:31 PM
Re: What's the score?
@Brian: The chaos stems more from the fact of the existence of the vulnerability. I'm not really sure that the question is well-founded given that the flaw is desperately serious.

Sure, risk management is all about assessing likelihood just as well as severity, but in this case severity is so high that it overshadows any probability rating that any accepted threat model could slap on it.
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/24/2018 | 12:38:29 AM
Re: What's the score?
@Joe: "The chaos stems more from the fact of the existence of the vulnerability." From the existence, or the manner of itheir being made public?  The vulnerabilities (or the design decisions which would become vulnerabilities once cyber-technologies and use patterns would make them such), existed for decades.  Not being an insider, I only became aware of the issue with the media disclosure (and via sites like DR).  That's when the chaos began.

I wasn't talking about balancing likelihood against severity (akin to gambling, in my opinion), but the realized cost of the uncoordinated efforts at mitigation, against as yet unobserved exploitation.  It didn't have to play out like this. 

To your other points: agreed - the bungled and disjointed patches and updates are unfortunate, for the reasons you mentioned. 

Your comments @Ryan: also agreed - a holistic approach is required; especially as attacks become more sophisticated and use multiple vectors. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/24/2018 | 9:48:30 PM
Re: What's the score?
@Brian: Well, sure, technically, it is the awareness of an issue that presents a problem more directly than the problem itself. Scrodinger's Vulnerability, I suppose.

But, of course, for all anyone knows, the vulnerability has already been exploited in the wild (and, if so, very possibly even by nation-state actors, who would probably be the best poised to have known about the vulnerability and have done so -- especially without you finding out about it).

Sure, good coordination has to go into vulnerabilty announcements and patch processes, but because this particular vulnerability is so disastrous and severe, it would be hard for much of the population to not take a Chicken Little approach here. It's a pretty bad vulnerability.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/23/2018 | 11:10:08 PM
Patches beget patches
This is grossly unfortunate because the very reason many people are wary of updates that are non-security or partial-security related is because of severe bugs that are usually hiding in a rushed rollout (q.v. iOS). To see this in the strictly security patch context where the severity is so high is particularly disheartening and may cause people to take the issue less seriously, I wonder.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13552
PUBLISHED: 2019-09-18
In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution.
CVE-2019-15301
PUBLISHED: 2019-09-18
A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value parameter.
CVE-2019-5042
PUBLISHED: 2019-09-18
An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free. An attacker can send a malicious PDF to trigger this vulnerability.
CVE-2019-5066
PUBLISHED: 2019-09-18
An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer, resulting in a use-after-free condition. To trigger this vulnerability, a specifically crafted PDF document needs ...
CVE-2019-5067
PUBLISHED: 2019-09-18
An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can cause a read and write from uninitialized memory, resulting in memory corruption and possibly arbitrary code execution. To trigger this vulnerabi...