Google and Microsoft discover new Spectre variant
But patching Speculative Store Bypass flaw could hit performance by up to 8%, warns Intel
A new Spectre and Meltdown variant has been discovered by Google and Microsoft researchers.
The newly-revealed flaw, called Variant 4, or Speculative Store Bypass, affects processors from Intel, ARM and AMD, meaning hundreds of millions of devices are potentially impacted, though no exploits have been seen in the wild.
Intel said that like Spectre, the variant relies on speculative execution, a feature common to most modern processor architectures, to potentially expose certain kinds of data through a side channel. An advisory by US-CERT said that the vulnerability could allow an attacker to access and read older CPU memory either in the CPU stack or other memory locations.
"An attacker who has successfully exploited this vulnerability may be able to read privileged data across trust boundaries," Microsoft Security Center's Security Advisory read.
While Intel said some of the Variant 4 exploits were mitigated by previous patches, it has also delivered a microcode update to address the new variant in beta form to OEMs and software vendors, expecting it to be released into production BIOS and software updates over the coming weeks.
However, the patch will be turned off by default, with Intel warning of a 2% to 8% performance hit for those that do enable it.
"We expect most industry software partners will likewise use the default-off option," said Leslie Culbertson, Intel's executive vice president and general manager of product assurance and security.
ARM noted in a blog post that "this method is dependent on malware running locally which means it's imperative for users to practice good security hygiene by keeping their software up-to-date and avoid suspicious links or downloads".
What you need to know about migrating to SAP S/4HANA
Factors to assess how and when to begin migrationDownload now
Your enterprise cloud solutions guide
Infrastructure designed to meet your company's IT needs for next-generation cloud applicationsDownload now
Testing for compliance just became easier
How you can use technology to ensure compliance in your organisationDownload now
Best practices for implementing security awareness training
How to develop a security awareness programme that will actually change behaviourDownload now