Intel adds to the woes of their processors

Remember the Spectre and Meltdown CPU vulnerabilities discovered early last year?  Well, hold onto your hat, because they've got company.

Recently, researchers discovered a new class of side-channel vulnerabilities in Intel processors that impact every modern chipset the company makes, including those used in Apple devices.

The new vulnerabilities exploit weaknesses in something called 'speculative execution' which is a core design feature of modern processors. This feature allows them to speculatively execute instructions based on conditions the system has 'learned' are likely to be true.  If those assumptions are proved to be valid, then the execution continues.  If not, it is discarded. The net effect of this design is to increase overall system performance speed, but it also opens up the door for the additional risk.

Look at last year's blog posts for Spectre and Meltdown

The researchers had this to say:

"The new vulnerabilities can be used by motivated hackers to lead privileged information data from an area of the memory that hardware safeguards deem off-limits.  It can be weaponized in highly targeted attacks that would normally require system-wide privileges or deep subversion of the operating system."

Collectively, these new vulnerabilities are being referred to as 'MDS speculative execution' flaws, and have been identified as follows:

  • CVE-2019-11091 - Microarchitectural Data Sampling Uncacheable Memory (MDSUM), part of the RIDL class of attacks.
  • CVE-2018-12127 - Microarchitectural Load Port Data Sampling (MLPDS), also part of the RIDL class of attacks.
  • CVE-2018-12130 - Microarchitectural Fill Buffer Data Sampling (MFBDS), also called 'Zombieload' or RIDL (Rogue In-Flight Data Load).
  • CVE-2018-12126 - Microarchitectural Store Buffer Data Sampling (MSBDS), also known as a Fallout

Our perspective

Of these, the ZombieLoad attacks seem to be the most worrisome of the lot.  They impact the largest number of chips, encompassing everything Intel has produced from 2011 onwards, but all of these are considered serious security flaws.  Worse, there are no fixes yet, and no word yet on when a fix might be forthcoming.

Meanwhile, check out this report

Free Executive Report: 10 Hidden IT Risks That Might Threaten Your Business

The author

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPia Blogs. I am also available at dwpia on LinkedIn, at dwpia on Facebook, and @dwpia on Twitter.

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT SupportI am Denis Wilson, President and Principal Consultant for DWP Information Architects. We specialize in managed IT support for smaller healthcare practices, financial services firms, and nonprofits in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance. I am also a published author and speaker, working extensively with a variety of organizations. As well as providing small business technology education programs through business and professional associations.

Contact me if you would like me to speak at your association.