Intel adds Foreshadow to its growing list of CPU vulnerabilities

Intel hasn’t had the best year regarding security, revealing Meltdown and Spectre to be deep rooted hardware vulnerabilities that can only truly be fixed with a complete redesign. Three more flaws have now been revealed which the firm calls L1 Terminal Fault (L1TF) bugs, led by Foreshadow.

The three bugs are known internally as CVE-2018-3615, CVE-2018-3620 and CVE-2018-3646, a new range of speculative execution side channel vulnerabilities that put applications, virtual machines, Intel’s software guard extensions (SGX) and System Management Mode (SMM) at risk from attack. Working in a similar way to the previously established Meltdown and Spectre, attackers can utilise these flaws to attack Intel-based desktops, workstations and servers, accessing sensitive information from within the L1 data cache.

Security researchers at the Usenix Security Symposium made Intel aware of CVE-2018-3615, now dubbed Foreshadow as early as January 3rd, 2018, with Intel’s own staff discovering the subsequent flaws, now called Foreshadow-Next Generation (NG). Foreshadow affects SGX, granting access to “information residing in the L1 data” via “side-channel analysis” according to Intel. CVE-2018-3620 targets the same sensitive information, affecting operating systems and SMM, while CVE-2018-3646 affects hypervisors and virtual machines through a “terminal page fault and side-channel analysis.”

Intel revealed to The Register that these vulnerabilities are serious, as “malicious applications may be able to infer the values of data in the operating system memory, or data from other applications. A malicious guest virtual machine (VM) may be able to infer the values of data in the VMM’s memory, or values of data in the memory of other guest VMs. Malicious software running outside of SMM may be able to infer values of data in SMM memory.” And finally, “malicious software running outside of an Intel SGX enclave or within an enclave may be able to infer data from within another Intel SGX enclave.”

This presents numerous problems for those running cloud systems and data centres running their own virtualised hardware and software, as guest operating systems will also require the mitigations in order to remain safe. Sadly, there is a potential performance hit from these mitigations, but it’s almost a non-negotiable trade-off given the security implications.

Processors affected by Foreshadow can by fixed by a microcode update, while CVE-2018-3620 requires microcode and operating system updates that are already available. While microcode, operating system and hypervisor updates are available for the third and final Foreshadow-NG variant, it is advised that “a subset of customers in this market should take additional steps to protect their systems,” according to the company Intel is expected to launch processors with a design that mitigates the flaws later in the year, presumably within its 9th generation.

KitGuru Says: Ordinary desktops should be safe so long as users keep their system updated regularly, so there’s likely no need to fret. Hopefully this marks a change in the design process for Intel and it’s the last we hear of such wide scale problems.

Become a Patron!