CPU Design Flaw Leaves Billions of Devices Vulnerable to Attack

A team of security researchers discovered that a method used to increase the speed of CPUs called “speculative execution” could be used to gain access to passwords, encryption keys and other sensitive information. Called Meltdown, which has been shown to to affect Intel processors and certain ARM devices, and Spectre, which has been verified on Intel, AMD and ARM processors, the vulnerabilities affect billions of devices. While Spectre affects more processor types, Meltdown is easier to exploit and affects almost every modern Intel-based device.

The researchers were working with chipmakers to devise patches and workarounds to the design flaw that was discovered last year. A full report was planned to be released Jan. 9. However, on Jan. 2, news of the flaw was made public, prompting a flurry of activity to fix the issues before they are exploited.

The Software Engineering Institute, a U.S.-government funded body that researches cybersecurity problems, issued a statement on the vulnerabilities that explains how they could be used to gather sensitive data from computers.

“Both Spectre and Meltdown take advantage of the ability to extract information from instructions that have executed on a CPU using the CPU cache as a side channel,” according to the Software Engineering Institute. “These attacks are described in detail by Google Project Zero, the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz) and Anders Fogh.”

While unpatched individual workstations are vulnerable, the exploits require an attacker to have local access to the targeted system. However, that access could come from a computer user inadvertently running JavaScript code on a malicious web page. Still, the more pressing concern is for computer networks and cloud services providers, as one attack could quickly spread and cause the most damage.

“Testing also showed that an attack running on one virtual machine was able to access the physical memory of the host machine, and through that, gain read-access to the memory of a different virtual machine on the same host,” according to the Google blog post on the exploits.

Some patches are available now, and more are coming next week. Unfortunately, the patches appear to affect the speculative execution performance gains in some cases. The impact on performance for many applications is expected to be negligible, but certain applications that call into the operating system extensively could be slowed significantly by the patches.

More information, including how to patch and mitigate risks, is available via Intel, AMD, ARM, Microsoft, Google, Amazon Web Services, and Apple websites devoted to the issue.