Researchers have discovered multiple new variants of the Spectre exploits, affecting both Intel and AMD processors, that are not protected by existing mitigations.
Discovered by researchers from the University of Virginia and University of California San Diego, the vulnerabilities leak data via micro-op caches, which are meant to speed up processing by storing simple commands and allowing the processor to fetch them quickly and early in the speculative execution process.
Worryingly, the researchers note there are currently no known mitigations for these new vulnerabilities.
We’re looking at how our readers use VPN for a forthcoming in-depth report. We’d love to hear your thoughts in the survey below. It won’t take more than 60 seconds of your time.
The team reported its discovery to both Intel and AMD in April, and will now present their findings at the International Symposium on Computer Architecture (ISCA) conference next month.
Harder to mitigate
Venkat’s team discovered that hackers can steal data when a processor fetches commands from the micro-op cache.
“Think about a hypothetical airport security scenario where TSA lets you in without checking your boarding pass because (1) it is fast and efficient, and (2) you will be checked for your boarding pass at the gate anyway,” Venkat said.
“A computer processor does something similar. It predicts that the check will pass and could let instructions into the pipeline. Ultimately, if the prediction is incorrect, it will throw those instructions out of the pipeline,” explains Venkat.
He adds that by the time the processor decides to discard the instructions, it might be too late since these instructions might have left “side-effects” in the pipeline that can be exploited by an attacker to infer confidential information such as passwords.
Venkat adds that the current mitigations fail to protect against this new attack vector since all current Spectre defenses kick in at a later stage of speculative execution.
Furthermore, the researchers believe this new attack by way of the micro-op cache will be harder to mitigate.
“Patches that disable the micro-op cache or halt speculative execution on legacy hardware would effectively roll back critical performance innovations in most modern Intel and AMD processors, and this just isn’t feasible,” notes Ren, the lead student author.
Via Tom’s Hardware
