Intel warns of new leak in Core processors that reveal data

Intel has warned of a new vulnerability in its Core processors related to speculative execution, such as Meltdown. The leak, classified by the chipmaker as ‘medium’, reveals information between processes.

Intel has released a brief warning, thanking researchers at Amazon, Cyberus, and Sysgo for reporting the vulnerability. Also thanks to developer Colin Percival, who on Twitter discloses more details about the vulnerability with attribute CVE-2018-3665. The vulnerability is related to a technique known as ‘lazy fp state restore’. Percival explains that an attacker could use the vulnerability to steal data from a processor’s register memory, or more specifically the floating point unit. He mentions the example of encryption keys. To do this, the attacker must be able to execute code on the same CPU as the target.

He further states that it is possible to perform the attack from a browser, but that exploiting the vulnerability is a lot more difficult than with Meltdown. It would have taken Percival about five hours to write an exploit after attending a presentation on the subject. Various organizations have now published advisories, including Microsoft. The company writes that the ‘lazy restore’ technique is activated by default in Windows and cannot be disabled. However, it does not provide information about affected Windows versions and mentions that it is coming with information about it. Users of VMs in Azure are not affected.

The Intel warning states that using ‘eager fp state restore’ prevents exploitation of the vulnerability. The Register notes that this technique has been used in the Linux kernel since 2016, i.e. version 4.9, so recent kernels are not vulnerable. Amazon says in an advisory that its AWS service has not been affected. Systems running Xen are affected, but patches are available. Red Hat is also working on patches for RHEL 6 and below.

Cyberus, one of the companies involved in reporting the leak, writes that it was originally intended to release the details only in August, but that information came out earlier. Speaking to Red Hat’s Jon Masters, ZDNet writes that no microcode patches from Intel are needed to plug the leak. Masters says the leak is “hard to exploit and easy to fix.” There is no indication that Arm or AMD was affected.