Remember the Spectre and Meltdown CPU vulnerabilities discovered early last year? Well, hold onto your hat, because they've got company.
Recently, researchers discovered a new class of side-channel vulnerabilities in Intel processors that impact every modern chipset the company makes, including those used in Apple devices.
The new vulnerabilities exploit weaknesses in something called 'speculative execution' which is a core design feature of modern processors. This feature allows them to speculatively execute instructions based on conditions the system has 'learned' are likely to be true. If those assumptions are proved to be valid, then the execution continues. If not, it is discarded. The net effect of this design is to increase overall system performance speed, but it also opens up the door for the additional risk.
Look at last year's blog posts for Spectre and Meltdown
- 12/04/2018 - Graphics Processing Units (GPUs) Vulnerable To Hacking?
- 11/12/2018 - Intel Has Another Processor Vulnerability
- 10/16/2018 - Finally Spectre Security Built Into New Intel Chips
- 6/26/2018 - Yet Another Flaw Found In Intel CPU’s
- 3/31/2018 - Chip-maker Intel Taking Steps To Prevent Security Flaws
- 3/20/2018 - Just What We Needed, Another Intel Vulnerability
- 3/17/2018 - Microsoft Tosses Intel A Life-Preserver
The researchers had this to say:
"The new vulnerabilities can be used by motivated hackers to lead privileged information data from an area of the memory that hardware safeguards deem off-limits. It can be weaponized in highly targeted attacks that would normally require system-wide privileges or deep subversion of the operating system."
Collectively, these new vulnerabilities are being referred to as 'MDS speculative execution' flaws, and have been identified as follows:
- CVE-2019-11091 - Microarchitectural Data Sampling Uncacheable Memory (MDSUM), part of the RIDL class of attacks.
- CVE-2018-12127 - Microarchitectural Load Port Data Sampling (MLPDS), also part of the RIDL class of attacks.
- CVE-2018-12130 - Microarchitectural Fill Buffer Data Sampling (MFBDS), also called 'Zombieload' or RIDL (Rogue In-Flight Data Load).
- CVE-2018-12126 - Microarchitectural Store Buffer Data Sampling (MSBDS), also known as a Fallout
Of these, the ZombieLoad attacks seem to be the most worrisome of the lot. They impact the largest number of chips, encompassing everything Intel has produced from 2011 onwards, but all of these are considered serious security flaws. Worse, there are no fixes yet, and no word yet on when a fix might be forthcoming.
Meanwhile, check out this report
Free Executive Report: 10 Hidden IT Risks That Might Threaten Your Business
Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPia Blogs. I am also available at dwpia on LinkedIn, at dwpia on Facebook, and @dwpia on Twitter.
I am Denis Wilson, President and Principal Consultant for DWP Information Architects. We specialize in managed IT support for smaller healthcare practices, financial services firms, and nonprofits in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance. I am also a published author and speaker, working extensively with a variety of organizations. As well as providing small business technology education programs through business and professional associations.
Contact me if you would like me to speak at your association.