Intel won’t patch new Spectre-like chip vulnerabilities for another 12 days

Patches for all operating systems and virtual machines may not be ready until later this year - report

Processor

Intel won't patch a new series of Spectre-related flaws in its chips for another 12 days, it is reported.

Fixes for the flaws, known as 'Spectre Next Generation', were scheduled for 7 May, but the chip manufacturer is allegedly having issues getting the updates ready in time, needing another two weeks to do so. This pushes the release date back to 21 May.

This is according to a report in German IT publication Heise, which suggests the patches could take even longer to arrive.

The flaws were originally reported earlier this month and are caused by the same design issue responsible for the original Spectre vulnerabilities. Around eight flaws have been discovered but technical details about them are yet to be published. Each flaw has a CVE number and each requires a patch to fix the issue.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Spectre Next Generation flaws affect Core i processors and their Xeon derivatives as far back as 2010, Heise reports. These are common Intel processors found in desktops, laptops and servers.

The flaws also reportedly affect Atom-based Pentium, Celeron and Atom processors dating back to 2013 as well as those powering tablets, smartphones and embedded devices.

One of the most troublesome flaws affects Core i and Xeon chips, allowing hackers to attack systems and virtual machines from a compromised VM. These flaws may not be fixed until the middle of August.

As well as microcode patches from Intel, fixes for the operating system will also be necessary, the publication said.

An Intel spokeswoman said in a statement sent to IT Pro: "Protecting our customers' data and ensuring the security of our products are critical priorities for us. We routinely work closely with customers, partners, other chipmakers and researchers to understand and mitigate any issues that are identified, and part of this process involves reserving blocks of CVE numbers. We believe strongly in the value of coordinated disclosure and will share additional details on any potential issues as we finalise mitigations. As a best practice, we continue to encourage everyone to keep their systems up to date."

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/business-strategy/mergers-and-acquisitions/354602/xerox-to-nominate-directors-to-hps-board-reports
mergers and acquisitions

Xerox to nominate directors to HP's board – reports

22 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020