Microsoft researchers have teamed with groups from Red Hat and Intel to announce a new side-channel attack mode called “Foreshadow”. Interestingly, Intel has known about the issue for eight months and did not disclose it. This is a similar situation to Meltdown and Spectre, and the comparisons do not end there.
Back in January, Google disclosed Meltdown and Spectre and it emerged Intel had kept the major kernel-level flaw secret for months. Incidentally, Jan. 3 (the same day the Meltdown and Spectre disclosure) saw researchers tell Intel about Foreshadow.
Also known as the “L1 Terminal Fault” (L1TF), the vulnerability is another speculative execution problem. This time researchers found the feature can be exploited for disclosure attacks. While Meltdown and Spectre affected all major processor companies, Foreshadow only affects Intel chips.
Indeed, Intel’s Core and Xeon processors are vulnerable, although an attacker will need to have access to the system they want to attack. That’s because they will need to run code on the machine. Researchers say the vulnerability can be mitigated through firmware patches and OS updates.
Common vulnerability and exposures identifications (CVE) have already been gives to the vulnerabilities.
- CVE-2018-3615 “for attacking SGX”
- CVE-2018-3620 “for attacking the OS Kernel and SMM mode”
- CVE-2018-3646 “for attacking virtual machines”
The researchers describe the flaw in its paper which was published recently:
“While it was previously believed that SGX is resilient to speculative execution attacks (such as Meltdown and Spectre), Foreshadow demonstrates how speculative execution can be exploited for reading the contents of SGX-protected memory as well as extracting the machine’s private attestation key. Making things worse, due to SGX’s privacy features, an attestation report cannot be linked to the identity of its signer. Thus, it only takes a single compromised SGX machine to erode trust in the entire SGX ecosystem.”
Solving the Problem
This makes Foreshadow particularly dangerous because security teams in a company will not be able to detect an attack.
Embarking on its own research, Intel found what it describes as a “next-generation” attack situation which relies on the L1 memory cache. However, the company says no active exploits are in the wild. Additionally, a description document shows previously released firmware patches can prevent the flaw being exploited.
“The microcode updates released earlier this year when coupled with operating system and hypervisor software available from our industry partners, ensure consumers, IT professionals and cloud service providers have access to the protections they need. Intel recommends people keep their systems up to date to protect against the evolving threat landscape.”
