- Researchers from ETH Zurich found a way around Spectre mitigations on Intel
- The chipmaker released microcode patch
- ARM and AMD chips are not affected this time
Spectre, a series of chip vulnerabilities affecting pretty much all processors today, doesn’t seem to go away, despite multiple vendor efforts to contain and remedy the flaws.
Recently, security researchers at ETH Zurich published a new paper, claiming to have found a way around the protections released by Intel.
Sandro Rüegge, Johannes Wikner, and Kaveh Razavi, the researchers behind the paper, named the vulnerabilities Branch Prediction Race Conditions (BPRC), and claim it only works on Intel’s products (all Intel CPUs since the 9th generation – Coffee Lake Refresh – as well as other chips dating back to the 7th generation Kaby Lake ones). AMD and ARM seem to have dodged this bullet, at least for now.
Slow updates
Spectre and Meltdown were two enormous vulnerabilities that were first spotted in 2018, and which were so severe that they had most OEMs scrambling for a fix. Some fixes were so poorly implemented that they bricked entire devices, while others were “just” slowing the computers down.
At one point, Intel introduced Indirect Brach Restricted Speculation (IBRS/eIBRS), Indirect Branch Predictor Barrier (IBPB), as two techniques to control speculation and mitigate the risk.
This is apparently where the new flaw lies. Branch predictions update slowly and asynchronously (in the background, not instantly). This delay creates a race condition, which means that the CPU is still updating its internal branch prediction data from earlier code while switching to a different privilege level (from user mode to kernel mode, for example).
This timing means that predictions from user code can be mislabeled as coming from kernel mode, allowing the attacker to inject their own predictions. As a result, threat actors could pull sensitive data such as passwords, from the vulnerable device.
Intel has released a microcode update to address the flaw, The Register reports. The chipmaker’s advisory, issued Tuesday, labeled the vulnerability as CVE-2024-45332.
Via The Register
