[German]The newly discovered vulnerabilities in CPUs continue. Intel is again affected after security researchers discovered vulnerabilities in CPUs that allow data theft.
Advertising
Various research teams have identified another serious vulnerability in current Intel processors and described it in white papers. Using a new attack method called "Load Value Injection in the Line Fill Buffers" (LVI-LFB), attackers can selectively steal data in data centers without leaving any traces.
LVI-LFB side channel attack
The LVI-LFB attack – like the side channel attacks Meltdown, Spectre and MDS (Microarchitectural Data Sampling) discovered in 2018 and 2019 – is made possible by manipulating performance-enhancing hardware functions of the processors. In contrast to the security gaps mentioned above, however, LVI-LFB allows targeted access to these data for the first time.
All modern Intel processors affected
The newly discovered method of attack affects all modern Intel processors in servers, desktops and laptops produced between 2012 and 2020 – including those manufactured after Meltdown, Spectre and MDS were announced.
According to Bitdefender, this attack can be particularly devastating in data centres and public and private clouds. In environments where departments and organizations share hardware, an attacker with minimal privileges can spy on sensitive information from another user or virtual environment.
Previous defensive measures insufficient
Bogdan Botezatu, senior threat analyst at Bitdefender, is quoted as saying that existing defenses for already known side-channel attacks are not sufficient to close the vulnerability: "The only way to fully close the vulnerability is to replace the hardware or disable features such as hyperthreading, which causes significant performance degradation.
Advertising
Bitdefender reported the vulnerability to Intel on 10 February 2020. However, the processor manufacturer had previously been informed by the researchers in April 2019: Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss and Frank Piessens.
In a coordinated disclosure the vulnerability was published on 10 March 2020 under code CVE-2020-0551. Bob Botezatu: "The fact that different teams independently discovered this attack path speaks volumes about the danger of its use for cyber espionage now and in the future".
Whitepaper describes four scenarios
Bitdefender's detailed white paper on LVI-LFB entitled "Load Value Injection in the Line Fill Buffers: How to Hijack Control Flow without Spectre" contains four threat scenarios resulting from the vulnerability and is available here for free.
