More Speculative Execution Vulnerabilities Discovered

[Guest_Jim_*]

Though the public revelation of the Spectre and Meltdown vulnerabilities was many months ago, the impact is still being felt as more attack vectors on speculative execution are discovered. The latest discoveries go after the L1 cache in CPUs, and can even break into Intel's Software Guard Extensions (SGX). These L1 Terminal Fault (L1TF) vulnerabilities do not appear to affect AMD CPUs, Intel Xeon Phi processors, and older Intel chips. Also, two of the variants of L1TF vulnerabilities can also be mitigated via patches and updates released earlier this year, but the third is still an issue.

What these vulnerabilities involve is how CPUs handle virtual memory combined with speculative execution. Normally there is a page table that keeps track of the location of all items in memory, but as a lot of work is done and some pieces of data are not so needed, they will be taken out of physical memory and dumped onto a disc as virtual memory. When this happens the page table has that entry set as Not Present, and if the information is then requested, it has to be read into physical memory from the virtual memory location. With speculative execution though, this reading of the information into memory can occur earlier than the request, pulling it into memory. The vulnerability comes from an instruction trying to access an entry in the page table that has an invalid Present bit set, which then causes the information to be loaded by speculative execution, if it is in the L1 cache.

While the first two versions of the vulnerability can reportedly be mitigated by already existing patches, the third needs extra work, and current approaches can impact performance. This third involves virtualization and Intel Hyper-Threading, so it can be an issue for cloud platforms. Luckily there are no known examples of these vulnerabilities being used maliciously. Still, the security of speculative execution is continuing to be challenged. Intel has stated its next generation of Intel Xeon Scalable processors (Cascade Lake) will have the hardware-level changes necessary to address these and other issues.

The video below covers the vulnerabilities and is from Red Hat.

 

 

Source: Intel, Phoronix, and The Register

Back to original news post