Intel ‘Spoiler’ Chip Flaw Uncovered By Researchers
Return of the Spectre scare? Spoiler flaw could allow attacker to exploit how a PC’s memory works
Intel is once again at the centre of a security scare after researchers uncovered a flaw that could affect nearly every single modern processor Intel has made.
The researchers Worcester Polytechnic Institute and the University of Lübeck revealed that the flaw is caused by a “weakness in the address speculation of Intel’s proprietary implementation of the memory subsystem.”
The researchers pointed out that the vulnerability, which they’ve called ‘Spoiler’, is similar to the Spectre flaw that rocked the world this time last year, but the researchers said that it is not the same.
Spoiler flaw
“Spoiler is not a Spectre attack,” stressed the researchers in their white paper. “The root cause for Spolier is a weakness in the address speculation of Intel’s proprietary implementation of the memory subsystem which directly leaks timing behaviour due to physical address conflicts. Existing spectre mitigations would therefore not interfere with Spoiler.”
And the researchers warned that the flaw affects all operating systems, as it is a ‘microarchitectural attack’ and not an OS related one.
It also only affects Intel chips (not AMD or ARM), but worryingly can even work from within a virtual machine and sandboxed environments.
“Spoiler can be executed from user space and requires no special privileges,” said the researchers. “Broadly put, the leakage described in this paper will enable attackers to perform existing attacks more efficiently, or to devise new attacks using the novel knowledge.”
The researchers said they had informed Intel in December about the flaw.
The flaw cannot be fixed with a software patch, and a redesign of the silicon itself is apparently needed, but this could likely impact performance.
And it seems that Intel is not overly concerned at the vulnerability.
“Intel received notice of this research, and we expect that software can be protected against such issues by employing side channel safe software development practices,” an Intel spokesperson told Techradar. “This includes avoiding control flows that are dependent on the data of interest.
“We likewise expect that DRAM modules mitigated against Rowhammer style attacks remain protected,” Intel reportedly said. “Protecting our customers and their data continues to be a critical priority for us and we appreciate the efforts of the security community for their ongoing research.”
Spectre flaw
This time last year, Intel was rocked by the Spectre and Meltdown vulnerabilities, discovered in early January 2018.
Straight away there was concern that the fix for those design flaws would likely to have a big impact on the performance of patched computers.
At first Intel did not deny that the fixes would have a performance impact, but downplayed talk of a slowdown despite expert warnings.
The Meltdown and Spectre exploits affected just about every single processor made over the past 20 years. Chips made by ARM manufacturers and AMD are also impacted.
