SoylentNews
SoylentNews is people
https://soylentnews.org/

RS3 writes:

Security researchers have found a new class of vulnerabilities in Intel chips which, if exploited, can be used to steal sensitive information directly from the processor.,

The bugs are reminiscent of Meltdown and Spectre, which exploited a weakness in speculative execution, an important part of how modern processors work. Speculative execution helps processors predict to a certain degree what an application or operating system might need next and in the near-future, making the app run faster and more efficient. The processor will execute its predictions if they're needed, or discard them if they're not.

Both Meltdown and Spectre leaked sensitive data stored briefly in the processor, including secrets — such as passwords, secret keys and account tokens, and private messages.

Now some of the same researchers are back with an entirely new round of data-leaking bugs.

"ZombieLoad," as it's called, is a side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws rather than injecting malicious code. Intel said ZombieLoad is made up of four bugs, which the researchers reported to the chip maker just a month ago.

Almost every computer with an Intel chips dating back to 2011 are affected by the vulnerabilities.

ZombieLoad takes its name from a "zombie load," an amount of data that the processor can't understand or properly process, forcing the processor to ask for help from the processor's microcode to prevent a crash. Apps are usually only able to see their own data, but this bug allows that data to bleed across those boundary walls. ZombieLoad will leak any data currently loaded by the processor's core, the researchers said. Intel said patches to the microcode will help clear the processor's buffers, preventing data from being read.

So far ARM and AMD are not known to be affected.

https://techcrunch.com/2019/05/14/zombieload-flaw-intel-processors/

Original Submission

1. "RS3" - https://soylentnews.org/~RS3/
2. "Intel " - https://crunchbase.com/organization/intel
3. "Meltdown and Spectre" - https://techcrunch.com/2018/01/03/kernel-panic-what-are-meltdown-and-spectre-the-bugs-affecting-nearly-every-computer-and-device/
4. "Meltdown " - https://crunchbase.com/organization/meltdown
5. "Spectre " - https://crunchbase.com/organization/spectra-2445
6. "it's called" - https://zombieloadattack.com/
7. "Original Submission" - https://soylentnews.org/submit.pl?op=viewsub&subid=33765

printed from SoylentNews, Yet Another Intel Vulnerability: "ZombieLoad" on 2024-04-19 08:17:19