Yet another Intel CPU security vulnerability!

Rainmaker · 28 Jan 2020 at 12:08

welshrat said:
So many vulnerabilities I can't keep track, so unsure if this new one was posted.

https://www.overclock3d.net/news/cpu_mainboard/intel_cpus_hit_by_new_cacheout_attack/1

Yep, CacheOut is a ZombieLoad variant renamed for presenting at ENIGMA yesterday.

We present CacheOut, a new speculative execution attack that is capable of leaking data from Intel CPUs across many security boundaries. We show that despite Intel's attempts to address previous generations of speculative execution attacks, CPUs are still vulnerable, allowing attackers to exploit these vulnerabilities to leak sensitive data.

Moreover, unlike previous MDS issues, we show in our work how an attacker can exploit the CPU's caching mechanisms to select what data to leak, as opposed to waiting for the data to be available. Finally, we empirically demonstrate that CacheOut can violate nearly every hardware-based security domain, leaking data from the OS kernel, co-resident virtual machines, and even SGX enclaves.

Further attacks, L1DES and Vector Registry Sampling, had their embargo end today as well. They just keep on coming! It also seems to go without saying that the latest required fixes even further impact performance of existing CPUs. I'm so glad I switched to Threadripper. At this rate my prevous 8700K may as well have been an i3.

jigger · 28 Jan 2020 at 12:39

And many more to come.

Rroff · 29 Jan 2020 at 19:08

jigger said:
And many more to come.

You'll get endless variants of speculative execution attacks but they are for the most part variants of the same kind of root issue. I'm surprised so far there doesn't seem to have been a significant remote vulnerability with the IME as that really would be game over.

Rainmaker said:
Yep, CacheOut is a ZombieLoad variant renamed for presenting at ENIGMA yesterday.

Further attacks, L1DES and Vector Registry Sampling, had their embargo end today as well. They just keep on coming! It also seems to go without saying that the latest required fixes even further impact performance of existing CPUs. I'm so glad I switched to Threadripper. At this rate my prevous 8700K may as well have been an i3.

Pretty nasty one in a shared user/server environment as in cases where the user has authentication at some level they can skip a lot of steps needed to try and get anything useful into a position to leak which made stuff like MDS more interesting from an academic perspective than anything that could realistically be used.

Orange Nexus · 30 Jan 2020 at 07:36

jigger said:
And many more to come.

At this point, the patches/mitigation hurt more than the actual vulnerabilities.

IT Troll · 30 Jan 2020 at 20:10

Orange Nexus said:
At this point, the patches/mitigation hurt more than the actual vulnerabilities.

There is some truth to this as I don't think a real exploit has been found in the wild which uses any of these vulnerabilities. I suspect the only entity with the resources and motivation to leverage them would be a state actor going after a very specific target.

pete910 · 30 Jan 2020 at 21:51

IT Troll said:
There is some truth to this as I don't think a real exploit has been found in the wild which uses any of these vulnerabilities. I suspect the only entity with the resources and motivation to leverage them would be a state actor going after a very specific target.

The scary bit is They could have already been exploited, We just know about it :confused:

kitfit1 · 30 Jan 2020 at 22:59

pete910 said:
The scary bit is They could have already been exploited, We just know about it

Of course it's been exploited. The NSA has been exploiting it for years and years. That is the main reason that Tump is going after Huaewi. Because they won't be using Intel chips, which renders the NSA useless.

Rroff · 31 Jan 2020 at 02:42

kitfit1 said:
Of course it's been exploited. The NSA has been exploiting it for years and years. That is the main reason that Tump is going after Huaewi. Because they won't be using Intel chips, which renders the NSA useless.

Other way around really - Huawei is a risk of Chinese state backdoors besides if such functionality existed then the NSA would likely discover it and use it themselves potentially anyhow. Also most Huawei devices don't exist in situations where otherwise an Intel processor would be used - the alternative is still likely something based on ARM.

I can believe some of these vulnerabilities exist so as to give the likes of the NSA covert entry into devices in foreign countries though - while not particularly useful against the average desktop user some are peculiarly useful for cross normal hard boundaries in server and infrastructure, etc. type environments given enough time and resources to work at it while leaving very little to no trace it ever happened.

kitfit1 · 31 Jan 2020 at 15:24

Rroff said:
Other way around really - Huawei is a risk of Chinese state backdoors besides if such functionality existed then the NSA would likely discover it and use it themselves potentially anyhow. Also most Huawei devices don't exist in situations where otherwise an Intel processor would be used - the alternative is still likely something based on ARM.

I can believe some of these vulnerabilities exist so as to give the likes of the NSA covert entry into devices in foreign countries though - while not particularly useful against the average desktop user some are peculiarly useful for cross normal hard boundaries in server and infrastructure, etc. type environments given enough time and resources to work at it while leaving very little to no trace it ever happened.

Of course there is a risk of backdoors in Huawei kit, that is all there is though, a risk. There is absolute certainty there are backdoors in Intel kit though.

IT Troll · 1 Feb 2020 at 00:15

Isn’t it a bit late to be worrying about Huawei? Aren’t they already in half the broadband cabs around the UK?

Harlequin · 1 Feb 2020 at 08:28

IT Troll said:
Isn’t it a bit late to be worrying about Huawei? Aren’t they already in half the broadband cabs around the UK?

Only as worrying as Intel tbh

Rofflay · 1 Feb 2020 at 14:06

kitfit1 said:
Of course there is a risk of backdoors in Huawei kit, that is all there is though, a risk. There is absolute certainty there are backdoors in Intel kit though.

The battle of the backdoors China and America i am glad i care nothing about my security as nothing ever was or is secure on a pc.

Is Russia losing out then? Britain? It seems like there are only two players but the USA is the dominant backdoor player.

jigger · 2 Feb 2020 at 13:27

Rofflay said:
The battle of the backdoors China and America i am glad i care nothing about my security as nothing ever was or is secure on a pc.

Is Russia losing out then? Britain? It seems like there are only two players but the USA is the dominant backdoor player.

Do you have other devices on the same network?

Rofflay · 3 Feb 2020 at 12:05

jigger said:
Do you have other devices on the same network?

No and unsure what they could ever find out anyways, I simply game and browse i have no info or money anyone could find useful. So for me it has little consequence but for others with data senitive info it might be a nightmare.

But i still have to DL all the patches and lose my performance.

Grim5 · 3 Feb 2020 at 23:08

Rofflay said:
No and unsure what they could ever find out anyways, I simply game and browse i have no info or money anyone could find useful. So for me it has little consequence but for others with data senitive info it might be a nightmare.

But i still have to DL all the patches and lose my performance.

Or you can buy amd and not worry about someone at the nsa watching you through your webcam masturbating to midget tranny porn. Just a thought

rxodium · 4 Feb 2020 at 06:53

AMD has PSP which is their equivalent of IME. If you're really concerned about platform security, you would want something that isn't x86 and doesn't contain closed source hardware and firmware. Open Power being the only real alternative that operates at a speed close to x86.

LoadsaMoney · 4 Feb 2020 at 12:41

https://www.guru3d.com/news_story/microsoft_offers_microcode_updates_for_intel_processors.html

Rofflay · 4 Feb 2020 at 13:01

Grim5 said:
Or you can buy amd and not worry about someone at the nsa watching you through your webcam masturbating to midget tranny porn. Just a thought

I like the extra kink from them watching me. But seriously even then it makes zero difference to my life but yes i will be buying Ryzen in 2021 Q1.

BigEars · 5 Feb 2020 at 08:54

LoadsaMoney said:
https://www.guru3d.com/news_story/microsoft_offers_microcode_updates_for_intel_processors.html

Most of those DT microcode patches from MS seem to be dated from Feb/April last year while there are quite a few newer ones by Intel from Oct for 6700k and upwards.

chrcoluk · 12 Feb 2020 at 10:31

Microsoft had to patch all this stuff to avoid a PR disaster, the fact they have a registry override gives an indicator of what they really think of the risk factor.