New Spectre variants reportedly affect all Intel and AMD chips

Spectre and meldown
(Image credit: Graz University of Technology)

Update: Intel has provided TechRadar Pro with the following statement.

Intel reviewed the report and informed researchers that existing mitigations were not being bypassed and that this scenario is addressed in our 
secure coding guidance. Software following our guidance already have protections against incidental channels including the uop cache incidental channel. No new mitigations or guidance are needed.”

Researchers have discovered multiple new variants of the Spectre exploits, affecting both Intel and AMD processors, that are not protected by existing mitigations.

Discovered by researchers from the University of Virginia and University of California San Diego, the vulnerabilities leak data via micro-op caches, which are meant to speed up processing by storing simple commands and allowing the processor to fetch them quickly and early in the speculative execution process. 

Worryingly, the researchers note there are currently no known mitigations for these new vulnerabilities. 

TechRadar needs yo...

We're looking at how our readers use VPN for a forthcoming in-depth report. We'd love to hear your thoughts in the survey below. It won't take more than 60 seconds of your time.

>> Click here to start the survey in a new window<<

The team reported its discovery to both Intel and AMD in April, and will now present their findings at the International Symposium on Computer Architecture (ISCA) conference next month.

Harder to mitigate

Venkat’s team discovered that hackers can steal data when a processor fetches commands from the micro-op cache.

“Think about a hypothetical airport security scenario where TSA lets you in without checking your boarding pass because (1) it is fast and efficient, and (2) you will be checked for your boarding pass at the gate anyway,” Venkat said. 

“A computer processor does something similar. It predicts that the check will pass and could let instructions into the pipeline. Ultimately, if the prediction is incorrect, it will throw those instructions out of the pipeline,” explains Venkat. 

He adds that by the time the processor decides to discard the instructions, it might be too late since these instructions might have left “side-effects” in the pipeline that can be exploited by an attacker to infer confidential information such as passwords.

Venkat adds that the current mitigations fail to protect against this new attack vector since all current Spectre defenses kick in at a later stage of speculative execution.

Furthermore, the researchers believe this new attack by way of the micro-op cache will be harder to mitigate.

“Patches that disable the micro-op cache or halt speculative execution on legacy hardware would effectively roll back critical performance innovations in most modern Intel and AMD processors, and this just isn’t feasible,” notes Ren, the lead student author.

Via Tom’s Hardware

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.