IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Intel to patch CacheOut flaw

Another ZombieLoad-style flaw hits Intel's processors, but an update is on the way

Intel is to patch two flaws in its chips, both of which could leak data including passwords. 

The two flaws, CVE-2020-0548 and CVE-2020-0549, could allow information disclosure, Intel said in an advisory, saying it would release firmware updates. 

The former, rated as low risk by Intel, takes advantage of cleanup errors in Intel chips that could allow an already authenticated user to nab key data. The latter and more serious of the vulnerabilities was detailed by a team of researchers over the weekend, who dubbed it CacheOut. 

The attack is similar to previous major Intel flaws that also used microarchitectural data sampling (MDS), notably ZombieLoad, which the company has already tried to address with patches. "We show that despite Intel's attempts to address previous generations of speculative execution attacks, CPUs are still vulnerable, allowing attackers to exploit these vulnerabilities to leak sensitive data," the researchers say. 

"Moreover, unlike previous MDS issues, we show in our work how an attacker can exploit the CPU's caching mechanisms to select what data to leak, as opposed to waiting for the data to be available," they added. "Finally, we empirically demonstrate that CacheOut can violate nearly every hardware-based security domain, leaking data from the OS kernel, co-resident virtual machines, and even SGX enclaves."

The researchers said the flaw impacts chips released up until the end of 2018. "For a select number of processors released after Q4 2018, Intel inadvertently managed to partially mitigate this issue while addressing a previous issue called TSX Asynchronous Abort (TAA)," the researchers noted. Intel added that the vulnerability doesn't impact virtual environments that have applied L1 Terminal Fault mitigations. 

Intel is releasing microcode updates to users as part of its regular patching to address the flaw. "As part of our commitment to transparency, the advisory has been released before our planned mitigations can be made available and we expect to release mitigations through our normal Intel Platform Update (IPU) process in the near future," noted Jerry Bryant, director of communications for Intel product assurance and security, in a blog post

The researchers said they hoped the solution would extend to the chips themselves in the longer term. "Software can mitigate these issues at the cost of features and/or performance," the researchers added. "We hope that somewhere in the future Intel will release processors with in-silicon fixes against this issue."

Related Resource

How targeted simulations differ from penetration tests and vulnerability scanning

Stay one step ahead of cyber attackers

Download now

The researchers and Intel have both said they've yet to spot hackers using the flaw in the wild. 

The team of researchers was made up of academics from Vrije Universiteit Amsterdam, the University of Adelaide, and the University of Michigan. 

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022