Wednesday, July 11th 2018
New "Spectre" Variant Hits Intel CPUs, Company Promises Quarterly Microcode Updates
A new variant of the "Spectre" CPU vulnerability was discovered affecting Intel processors, by security researchers Vladimir Kiriansky and Carl Waldspurger, who are eligible to bag a USD $100,000 bounty by Intel, inviting researchers to sniff out vulnerabilities from its processors. This discovery, chronicled under CVE-2018-3693, is among 12 new CVEs Intel will publish later this week. The company is also expected to announce quarterly CPU microcode updates to allay fears of its enterprise customers.
The new vulnerability, like most other "Spectre" variants, targets the speculative execution engine of the processor, in a bounds-check bypass store attack. A malicious program already running on the affected machine can alter function pointers and return addresses in the speculative execution engine, thereby redirecting the flow of data out of protected memory address-spaces, making it visible to malware. This data could be anything, including cryptographic keys, passwords, and other sensitive information, according to "The Register." Intel chronicled this vulnerability in section 2.2.1 of its revised speculative execution side-channel attacks whitepaper. You can also catch a more detailed whitepaper from the researchers themselves.
Source:
The Register
The new vulnerability, like most other "Spectre" variants, targets the speculative execution engine of the processor, in a bounds-check bypass store attack. A malicious program already running on the affected machine can alter function pointers and return addresses in the speculative execution engine, thereby redirecting the flow of data out of protected memory address-spaces, making it visible to malware. This data could be anything, including cryptographic keys, passwords, and other sensitive information, according to "The Register." Intel chronicled this vulnerability in section 2.2.1 of its revised speculative execution side-channel attacks whitepaper. You can also catch a more detailed whitepaper from the researchers themselves.
73 Comments on New "Spectre" Variant Hits Intel CPUs, Company Promises Quarterly Microcode Updates
I'd be very happy if Zen 2 reaches 4.5 GHz... The 1700 in my server can't even do 4 GHz stable
If they want to attract gamers, they need the clockspeed boost instead of adding more cores, preferably both
8C/16T with single/duo core boost at 4.5 GHz boost out of the box and 4.6-4.8 GHz max OC would be very good. Dream scenario
TSMC should be better for high clocks compared to GloFo
The only reason that they were ever phrased as being solely AMD-relevant was that the company that publicised them, was making an attempt to manipulate AMD stocks. That's why the legal disclaimer on their site states: "CTS reserves the right to refrain from updating this website even as it becomes outdated or inaccurate. "
They're also linked to Viceroy Research (Who published a HYSTERICAL hit piece on AMD within hours of the CTS publication), and who have done this before, even going as far as to say "We take a financial position in our research and our readers should assume we have a position on the stock."
www.businesslive.co.za/bd/companies/financial-services/2017-12-15-how-did-short-seller-viceroy-dig-out-the-info-to-make-a-killing-on-steinhoff/
Yes, when you move between CCXs there's a difference, but especially with Ryzen 2, users won't see any difference at all until they move beyond 4 cores for a task. I'd also note that while Intel's monolithic design helps them to have 6 cores with low latency on the 8700K, the 7820X actually sees a dramatic jump in Ring Bus latency.
This was tested with DDR-2933 RAM by Tom's Hardware. The OC'd 2700X result used 3466.
If you had a program on your machine that had no admin-level access, and was capable of doing very little malicious without that access, that's one thing. Some low-level adware or whatever.
This vulnerability would enable a program running in such restricted conditions, to access data beyond those restrictions. That's potentially quite significant.