Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

New Intel Vulnerabilities Bring Fresh CPU Attack Dangers

Four newly discovered vulns from the speculative-execution family bring Meltdown-like threats to Intel's processors.

A new family of speculative execution side-channel vulnerabilities has been found in Intel CPUs and researchers and vendors are split over how severe the flaws are and how easy they are to exploit.

Even the name of the vuln family is a subject of disagreement among researchers, ranging from colorful to prosaic: ZombieLoad, Fallout, RIDL (Rogue In-Flight Data Load), YAM (Yet Another Meltdown), and Intel's name for the family of flaws, MDS (Microarchitectural Data Sampling). 

Researchers from security firms Cyberus, BitDefender, Qihoo360, and Oracle, along with academic researchers from TU Graz, Vrije Universiteit Amsterdam, the University of Michigan, the University of Adelaide, KU Leuven, Worcester Polytechnic Institute, and Saarland University, discovered the flaws and came up with the related exploits. All of the researchers were exploring the same conceptual issues - side-channel vulnerabilities - but found the new family in a different area of the CPU than where the previously identified side-channel vulns, Spectre and Meltdown, operate.

The researchers followed responsible disclosure practices and held on publicly releasing their work - some for as much as a year - while Intel developed firmware to remediate the issues.

Bogdan (Bob) Botezatu, director of threat research and reporting for Bitdefender, says the difference between these MDS vulnerabilities and those exploited by earlier speculative-execution flaws like Spectre and Meltdown, is the difference between a buffer and a cache.

"A buffer is an area of the CPU where operations are executed in transit," he explains, while a cache is memory where data or instructions are stored in anticipation of being called. This difference in the affected CPU area is why the phrase "data in transit" is being used with the new vulnerabilities: Data in a buffer is being being used in an operation while data in a cache is at rest and waiting to be called into use. 

While Spectre and Meltdown could look at data sitting in a special part of storage, this latest generation can grab data that's in the middle of a process.

As with all examples of this type of vulnerability, user programs are not supposed to be able to access this data except through very specific calls through the operating system, and then only to the buffers associated with their defined and assigned user space. Researchers have found, though, that carefully constructed calls can gain access to the data — and in doing so can side-step security layers put in place to protect users from one another.

"It's leaking all the data that user space should not have access to," says Botezatu. For example, in a multi-tenant environment - such as on servers at a cloud-hosting provider - it would be possible for software running as part of one user's space to gain access to data in another user's space, he says.

An Intel spokesperson confirmed the nature of the vulnerability but noted that exploiting MDS, like exploiting any Meltdown-category vulnerability, is quite complex and likely beyond the capability of most malware developers.

The software exploiting the vulnerability would have to be running on the same core as the targeted victim, execute in an adjacent thread, and then either exfiltrate large quantities of data hoping for a useful byte, the spokesperson said, or repeatedly load and flush the desired data.

Botezatu concurred that the attack would be difficult to pull off by the average hacker. "These kinds of attacks are not something that I would expect that your average ransomware operator would use to infect millions of people. This is mostly the kind of attack that a very, very determined threat actor with a pretty big target will use to gain information or to gain access," he says.

While most of the "use cases" for this type of exploit involve multi-tenancy environments in cloud or virtualized server data centers, MDS is subject to other exploit types. Chris Wysopal, CTO at Veracode, says it could also be exploited in browsers. "Another case is browsers running untrusted JavaScript. A malicious website could compromise private data on a system that renders a page with malicious JavaScript," Wysopal says.

Some vendors, including Microsoft, have suggested that disabling hyper- threaded execution on servers might be required for remediating the vulnerability, but Intel says this should not be the case since simply disabling hyper-threading doesn't provide protection.

Intel released a patch for MDS this week. Microsoft and Apple also have included microcode patches in recent Windows and MacOS, updates, and Linux patches also have been issued. Intel also fixed the flaw in new CPUs it released last month. 

One near certainty is that there will be a continuing stream of speculative execution side-channel vulnerabilities found now that academia has discovered the category of issues that exists as part of the CPU architecture.

"Expect to see more of this class of vulnerabilities. Meltdown and Spectre sparked a new area of research, and there are most likely more architectural flaws waiting to be discovered," says Jimmy Graham, senior director product management, vulnerability management at Qualys.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1817
PUBLISHED: 2019-11-20
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
CVE-2013-2091
PUBLISHED: 2019-11-20
SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
CVE-2012-1257
PUBLISHED: 2019-11-20
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
CVE-2013-1816
PUBLISHED: 2019-11-20
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
CVE-2011-4455
PUBLISHED: 2019-11-20
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-removepage.php, or (4) tiki-rename_page.php.