Skip to main content

New Security Vulnerabilities Found In Intel Processors

By June 5, 2019May 17th, 2022Cybersecurity

Remember the Spectre and Meltdown CPU vulnerabilities discovered early last year?  Well, hold onto your hat, because they’ve got company.

Recently, researchers discovered a new class of side-channel vulnerabilities in Intel processors that impact every modern chipset the company makes, including those used in Apple devices.

The new vulnerabilities exploit weaknesses in something called ‘speculative execution’ which is a core design feature of modern processors. This feature allows them to speculatively execute instructions based on conditions the system has ‘learned’ are likely to be true.  If those assumptions are proved to be valid, then the execution continues.  If not, it is discarded. The net effect of this design is to increase overall system performance speed, but it also opens up the door for additional risk.

The researchers had this to say about their latest discoveries:

“The new vulnerabilities can be used by motivated hackers to lead privileged information data from an area of the memory that hardware safeguards deem off-limits.  It can be weaponized in highly targeted attacks that would normally require system-wide privileges or deep subversion of the operating system.”

Collectively, these new vulnerabilities are being referred to as ‘MDS speculative execution’ flaws, and have been identified as follows:

  • CVE-2019-11091 – Microarchitectural Data Sampling Uncacheable Memory (MDSUM), part of the RIDL class of attacks.
  • CVE-2018-12127 – Microarchitectural Load Port Data Sampling (MLPDS), also part of the RIDL class of attacks.
  • CVE-2018-12130 – Microarchitectural Fill Buffer Data Sampling (MFBDS), also called ‘Zombieload’ or RIDL (Rogue In-Flight Data Load).
  • CVE-2018-12126 – Microarchitectural Store Buffer Data Sampling (MSBDS), also known as a Fallout

Of these, the ZombieLoad attacks seem to be the most worrisome of the lot.  They impact the largest number of chips, encompassing everything Intel has produced from 2011 onwards, but all of these are considered serious security flaws.  Worse, there are no fixes yet, and no word yet on when a fix might be forthcoming.

Chris Forte

Chris Forte, President and CEO of Olmec Systems, has been in the MSP workspace for the past 25 years. Chris earned his Master’s Degree from West Virginia University, graduating Magna Cum Laude. He was a past member of the Entrepreneurs’ Organization, a current member of the New Jersey Power Partners and Executive Association of New Jersey, where he has previously served on its board of directors. In his spare time, Chris enjoys traveling with his family. He also admits to being a struggling golfer and avid watcher of college football and basketball. He currently lives in Boonton Township, NJ with his wife, two daughters, son, and black lab Luna.