New Intel Vulnerabilities Bring Fresh CPU Attack Dangers

A new family of speculative execution side-channel vulnerabilities has been found in Intel CPUs and researchers and vendors are split over how severe the flaws are and how easy they are to exploit.

Even the name of the vuln family is a subject of disagreement among researchers, ranging from colorful to prosaic: ZombieLoad, Fallout, RIDL (Rogue In-Flight Data Load), YAM (Yet Another Meltdown), and Intel's name for the family of flaws, MDS (Microarchitectural Data Sampling). 

Researchers from security firms Cyberus, BitDefender, Qihoo360, and Oracle, along with academic researchers from TU Graz, Vrije Universiteit Amsterdam, the University of Michigan, the University of Adelaide, KU Leuven, Worcester Polytechnic Institute, and Saarland University, discovered the flaws and came up with the related exploits. All of the researchers were exploring the same conceptual issues - side-channel vulnerabilities - but found the new family in a different area of the CPU than where the previously identified side-channel vulns, Spectre and Meltdown, operate.

The researchers followed responsible disclosure practices and held on publicly releasing their work - some for as much as a year - while Intel developed firmware to remediate the issues.

Bogdan (Bob) Botezatu, director of threat research and reporting for Bitdefender, says the difference between these MDS vulnerabilities and those exploited by earlier speculative-execution flaws like Spectre and Meltdown, is the difference between a buffer and a cache.

"A buffer is an area of the CPU where operations are executed in transit," he explains, while a cache is memory where data or instructions are stored in anticipation of being called. This difference in the affected CPU area is why the phrase "data in transit" is being used with the new vulnerabilities: Data in a buffer is being being used in an operation while data in a cache is at rest and waiting to be called into use. 

While Spectre and Meltdown could look at data sitting in a special part of storage, this latest generation can grab data that's in the middle of a process.

As with all examples of this type of vulnerability, user programs are not supposed to be able to access this data except through very specific calls through the operating system, and then only to the buffers associated with their defined and assigned user space. Researchers have found, though, that carefully constructed calls can gain access to the data — and in doing so can side-step security layers put in place to protect users from one another.

"It's leaking all the data that user space should not have access to," says Botezatu. For example, in a multi-tenant environment - such as on servers at a cloud-hosting provider - it would be possible for software running as part of one user's space to gain access to data in another user's space, he says.

An Intel spokesperson confirmed the nature of the vulnerability but noted that exploiting MDS, like exploiting any Meltdown-category vulnerability, is quite complex and likely beyond the capability of most malware developers.

The software exploiting the vulnerability would have to be running on the same core as the targeted victim, execute in an adjacent thread, and then either exfiltrate large quantities of data hoping for a useful byte, the spokesperson said, or repeatedly load and flush the desired data.

Botezatu concurred that the attack would be difficult to pull off by the average hacker. "These kinds of attacks are not something that I would expect that your average ransomware operator would use to infect millions of people. This is mostly the kind of attack that a very, very determined threat actor with a pretty big target will use to gain information or to gain access," he says.

While most of the "use cases" for this type of exploit involve multi-tenancy environments in cloud or virtualized server data centers, MDS is subject to other exploit types. Chris Wysopal, CTO at Veracode, says it could also be exploited in browsers. "Another case is browsers running untrusted JavaScript. A malicious website could compromise private data on a system that renders a page with malicious JavaScript," Wysopal says.

Some vendors, including Microsoft, have suggested that disabling hyper- threaded execution on servers might be required for remediating the vulnerability, but Intel says this should not be the case since simply disabling hyper-threading doesn't provide protection.

Intel released a patch for MDS this week. Microsoft and Apple also have included microcode patches in recent Windows and MacOS, updates, and Linux patches also have been issued. Intel also fixed the flaw in new CPUs it released last month. 

One near certainty is that there will be a continuing stream of speculative execution side-channel vulnerabilities found now that academia has discovered the category of issues that exists as part of the CPU architecture.

"Expect to see more of this class of vulnerabilities. Meltdown and Spectre sparked a new area of research, and there are most likely more architectural flaws waiting to be discovered," says Jimmy Graham, senior director product management, vulnerability management at Qualys.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.