06-15-2018, 12:49 AM
First details emerge about new batch of Intel processor security flaws
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/06/first-details-emerge-about-new-batch-of-intel-processor-security-flaws.jpg" width="1" height="1" title="" alt="" /></div><div><p><span class="article-leader">Details of the first of the second wave of Spectre-style vulnerabilities in Intel processors has been published earlier than expected, with the “LazyFP” vulnerability potentially allowing an attacker to access sensitive data, such as cryptographic keys. <br /></span></p>
<div align="center">
<div class="article-img"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/06/first-details-emerge-about-new-batch-of-intel-processor-security-flaws.jpg" alt="" class="lazy" /><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/06/first-details-emerge-about-new-batch-of-intel-processor-security-flaws-1.jpg" /></div>
<p><span class="minor2 small gray"></span></div>
<p>Part of a secondary collection of processor vulnerabilities discovered following the Spectre and Meltdown disclosures, LazyFP (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3665">CVE-2018-3665</a>) was originally found by researchers working for <a href="https://aws.amazon.com/security/security-bulletins/">Amazon</a> and <a href="http://blog.cyberus-technology.de/posts/2018-06-06-intel-lazyfp-vulnerability.html">Cyberus Technology</a> earlier this year. As part of the process of responsible disclosure, details of the flaw were provided to Intel and other related firms, with a release to the public scheduled after a defined period of time had taken place. </p>
<p>In May, it was reported Intel had successfully negotiated with researchers to <a href="https://appleinsider.com/articles/18/05/09/spectre-style-intel-chip-vulnerability-disclosures-delayed-patches-not-complete-until-august">delay the release</a> by a few weeks, but wanted to push it further back, potentially until July. According to Cyberus, the embargo was set to lift in August, but rumors of the vulnerability forced an earlier disclosure, possibly to try and pressure Intel and other vendors to work faster in creating and implementing a solution. </p>
<p>While the LazyFP whitepaper explaining the issue is being withheld, following a request by Intel, some details about how the vulnerability works have been issued.</p>
<p>LazyFP centers around the use and abuse of the <a href="https://en.wikipedia.org/wiki/Floating-point_unit">Floating Point Unit</a> (FPU), and associated registers in the processor. To enable multitasking, the FPU needs to be able to store its state in order to switch between tasks. </p>
<p>Using what is described by Intel as a “Lazy FP state restore technique,” the restoration of an FPU’s state can be delayed until an instruction operating on it is executed by a new process. “Eager FPU switching” saves the state on a context switch without any delay, whereas the “lazy” version is an optimized way that accounts for processes that don’t use the FPU all the time. </p>
<p>While the details of the attack are not explained, it is suggested it is based on the manipulation of the FPU and how it holds data while the Lazy FP technique is used. </p>
<p>According to Intel’s <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html">advisory report</a> on the vulnerability, it has a severity rating of “moderate,” and is described as affecting “Intel Core-based microprocessors,” but not specific models. There is also no mention of which operating systems are affected by the vulnerability. </p>
<p>It is unknown if Apple has been affected by the flaw, but as all current Macs and MacBooks use Intel processors and have done for a number of years, it is still plausible. Apple usually posts details about the vulnerabilities it fixes in its software on its security updates page, but there doesn’t appear to be a reference to the latest disclosure as of yet. </p>
<p>Revealed in January, the <a href="https://appleinsider.com/articles/18/01/02/intel-chip-kernel-flaw-requires-os-level-fix-that-could-impact-macos-performance-report-says">Meltdown and Spectre</a> chip flaws in Intel and ARM-based processors allowed the creation of a number of exploits in systems using the components. All Mac and iOS devices were found to be affected by the issue, but Apple advised at the time it had already mitigated the issues for current operating system versions, and was working to develop other fixes. </p>
<p>The more recent batch of <a href="https://appleinsider.com/articles/18/05/04/more-spectre-style-chip-flaws-discovered-in-intel-processors">eight similar security flaws</a> were found to be caused by the same design-related issue, and includes four classified by Intel as “high risk.” While seven of the eight are thought to have the same impact as Spectre, the eighth is thought to be a greater threat against enterprise systems, in being able to allow attackers to exploit a virtual machine to attack the host. </p>
</div>
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/06/first-details-emerge-about-new-batch-of-intel-processor-security-flaws.jpg" width="1" height="1" title="" alt="" /></div><div><p><span class="article-leader">Details of the first of the second wave of Spectre-style vulnerabilities in Intel processors has been published earlier than expected, with the “LazyFP” vulnerability potentially allowing an attacker to access sensitive data, such as cryptographic keys. <br /></span></p>
<div align="center">
<div class="article-img"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/06/first-details-emerge-about-new-batch-of-intel-processor-security-flaws.jpg" alt="" class="lazy" /><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/06/first-details-emerge-about-new-batch-of-intel-processor-security-flaws-1.jpg" /></div>
<p><span class="minor2 small gray"></span></div>
<p>Part of a secondary collection of processor vulnerabilities discovered following the Spectre and Meltdown disclosures, LazyFP (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3665">CVE-2018-3665</a>) was originally found by researchers working for <a href="https://aws.amazon.com/security/security-bulletins/">Amazon</a> and <a href="http://blog.cyberus-technology.de/posts/2018-06-06-intel-lazyfp-vulnerability.html">Cyberus Technology</a> earlier this year. As part of the process of responsible disclosure, details of the flaw were provided to Intel and other related firms, with a release to the public scheduled after a defined period of time had taken place. </p>
<p>In May, it was reported Intel had successfully negotiated with researchers to <a href="https://appleinsider.com/articles/18/05/09/spectre-style-intel-chip-vulnerability-disclosures-delayed-patches-not-complete-until-august">delay the release</a> by a few weeks, but wanted to push it further back, potentially until July. According to Cyberus, the embargo was set to lift in August, but rumors of the vulnerability forced an earlier disclosure, possibly to try and pressure Intel and other vendors to work faster in creating and implementing a solution. </p>
<p>While the LazyFP whitepaper explaining the issue is being withheld, following a request by Intel, some details about how the vulnerability works have been issued.</p>
<p>LazyFP centers around the use and abuse of the <a href="https://en.wikipedia.org/wiki/Floating-point_unit">Floating Point Unit</a> (FPU), and associated registers in the processor. To enable multitasking, the FPU needs to be able to store its state in order to switch between tasks. </p>
<p>Using what is described by Intel as a “Lazy FP state restore technique,” the restoration of an FPU’s state can be delayed until an instruction operating on it is executed by a new process. “Eager FPU switching” saves the state on a context switch without any delay, whereas the “lazy” version is an optimized way that accounts for processes that don’t use the FPU all the time. </p>
<p>While the details of the attack are not explained, it is suggested it is based on the manipulation of the FPU and how it holds data while the Lazy FP technique is used. </p>
<p>According to Intel’s <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html">advisory report</a> on the vulnerability, it has a severity rating of “moderate,” and is described as affecting “Intel Core-based microprocessors,” but not specific models. There is also no mention of which operating systems are affected by the vulnerability. </p>
<p>It is unknown if Apple has been affected by the flaw, but as all current Macs and MacBooks use Intel processors and have done for a number of years, it is still plausible. Apple usually posts details about the vulnerabilities it fixes in its software on its security updates page, but there doesn’t appear to be a reference to the latest disclosure as of yet. </p>
<p>Revealed in January, the <a href="https://appleinsider.com/articles/18/01/02/intel-chip-kernel-flaw-requires-os-level-fix-that-could-impact-macos-performance-report-says">Meltdown and Spectre</a> chip flaws in Intel and ARM-based processors allowed the creation of a number of exploits in systems using the components. All Mac and iOS devices were found to be affected by the issue, but Apple advised at the time it had already mitigated the issues for current operating system versions, and was working to develop other fixes. </p>
<p>The more recent batch of <a href="https://appleinsider.com/articles/18/05/04/more-spectre-style-chip-flaws-discovered-in-intel-processors">eight similar security flaws</a> were found to be caused by the same design-related issue, and includes four classified by Intel as “high risk.” While seven of the eight are thought to have the same impact as Spectre, the eighth is thought to be a greater threat against enterprise systems, in being able to allow attackers to exploit a virtual machine to attack the host. </p>
</div>