Google and Microsoft discover new Spectre variant

But patching Speculative Store Bypass flaw could hit performance by up to 8%, warns Intel

A new Spectre and Meltdown variant has been discovered by Google and Microsoft researchers.

The newly-revealed flaw, called Variant 4, or Speculative Store Bypass, affects processors from Intel, ARM and AMD, meaning hundreds of millions of devices are potentially impacted, though no exploits have been seen in the wild.

Intel said that like Spectre, the variant relies on speculative execution, a feature common to most modern processor architectures, to potentially expose certain kinds of data through a side channel. An advisory by US-CERT said that the vulnerability could allow an attacker to access and read older CPU memory either in the CPU stack or other memory locations.

"An attacker who has successfully exploited this vulnerability may be able to read privileged data across trust boundaries," Microsoft Security Center's Security Advisory read.

Hackers could exploit the bug by running JavaScript in web browsers, producing native code that could give rise to an instance of Variant 4 (CVE-2018-3639). Microsoft said that it has strengthend its Edge and Internet Explorer browsers to increase the difficulty of successfully creating such a side channel. Similar steps have been taken for other browsers.

While Intel said some of the Variant 4 exploits were mitigated by previous patches, it has also delivered a microcode update to address the new variant in beta form to OEMs and software vendors, expecting it to be released into production BIOS and software updates over the coming weeks.

However, the patch will be turned off by default, with Intel warning of a 2% to 8% performance hit for those that do enable it.

"We expect most industry software partners will likewise use the default-off option," said Leslie Culbertson, Intel's executive vice president and general manager of product assurance and security.

ARM noted in a blog post that "this method is dependent on malware running locally which means it's imperative for users to practice good security hygiene by keeping their software up-to-date and avoid suspicious links or downloads".

According to blog posts by Google's Project Zero and the , a flaw in the chips can The vulnerability affects processors from Intel, AMD, and ARM.

Featured Resources

Unleashing the power of AI initiatives with the right infrastructure

What key infrastructure requirements are needed to implement AI effectively?

Download now

Achieve today. Plan tomorrow. Making the hybrid multi-cloud journey

A Veritas webinar on implementing a hybrid multi-cloud strategy

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

Recommended

Fears over cyber crime tool that can build phishing pages in real-time
phishing

Fears over cyber crime tool that can build phishing pages in real-time

28 Jan 2021
Your essential guide to internet security
Security

Your essential guide to internet security

27 Jan 2021
Global ransom DDoS extortionists are retargeting companies
distributed denial of service (DDOS)

Global ransom DDoS extortionists are retargeting companies

22 Jan 2021
BEC scammers are using Google Forms to identify easy victims
phishing

BEC scammers are using Google Forms to identify easy victims

21 Jan 2021

Most Popular

How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
Hackers are actively exploiting three Apple iOS flaws
exploits

Hackers are actively exploiting three Apple iOS flaws

27 Jan 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

26 Jan 2021