Wednesday, June 10th 2020
CrossTalk is Another Intel-exclusive Security Vulnerability
Intel has had quite a lot of work trying to patch all vulnerabilities discovered in the past two years. Starting from Spectre and Meltdown which exploited speculative execution of the processor to execute malicious code. The entire process of speculative execution relies on the microarchitectural technique for adding more performance called speculative branch prediction. This technique predicts branch paths and prepared them for execution, so the processor spends less time figuring out where and how will instructions flow through the CPU. So far, lots of these bugs have been ironed out with software, but a lot of older CPUs are vulnerable.
However, an attacker has always thought about doing malicious code execution on a CPU core shared with the victim, and never on multiple cores. This is where the new CrossTalk vulnerability comes in. Dubbed Special Register Buffer Data Sampling (SRBDS) by Intel, it is labeled as CVE-2020-0543 in the vulnerability identifier system. The CrossTalk is bypassing all intra-core patches against Spectre and Meltdown so it can attack any CPU core on the processor. It enables attacker-controlled code execution on one CPU core to leak sensitive data from victim software executing on a different core. This technique is quite dangerous for users of shared systems like in the cloud. Often, one instance is shared across multiple customers and until now they were safe from each other. The vulnerability uses Intel's SGX security enclave against the processor so it can be executed. To read about CrossTalk in detail, please visit the page here.
However, an attacker has always thought about doing malicious code execution on a CPU core shared with the victim, and never on multiple cores. This is where the new CrossTalk vulnerability comes in. Dubbed Special Register Buffer Data Sampling (SRBDS) by Intel, it is labeled as CVE-2020-0543 in the vulnerability identifier system. The CrossTalk is bypassing all intra-core patches against Spectre and Meltdown so it can attack any CPU core on the processor. It enables attacker-controlled code execution on one CPU core to leak sensitive data from victim software executing on a different core. This technique is quite dangerous for users of shared systems like in the cloud. Often, one instance is shared across multiple customers and until now they were safe from each other. The vulnerability uses Intel's SGX security enclave against the processor so it can be executed. To read about CrossTalk in detail, please visit the page here.
18 Comments on CrossTalk is Another Intel-exclusive Security Vulnerability
Hasn't Intel stopped using SGX?
I dropped it a couple of years back because it wasn't worth it because you could only play with on Intel CPU's that supported SGX and with Intel Onboard Graphics you couldn't even have a AMD or Nvidia card in the machine and the test and playback with fail.
CROSSTalk will be patched by microcode updates from Haswell to Comet Lake as denoted at Intel's site. Earlier models are vulnerable but WILL NOT be patched.
The worst case scenario is the RdRand instruction that gets its performance reduced by 97% as tested by Phoronix. Normal usage should not be affected apart from some cryptographic loads.
I'm a bit disappointed at the reporting quality for this issue on TPU...
"Intel-only" is another option for news post like this albeit less attractive
Man, that harsh :laugh:
Do you need physical access, admin rights or the stupidest owner, is it remote execute possible etc.
All drama and little substance.
Do I smash my kaby lake CPU up or not? I dunno.
I find it interesting how one knows how an attacker has always thought. :rolleyes:
And then of course, there's the big one where the title that claims CrossTalk is a security "vulnerability". No its not! :(
CrossTalk is a profiler tool developed by the security firm, VUSec (the "good guys"). See here (same link provided by author!) and note the following,Well, that's not true, on both parts.
Part 1 - There are many who blindly believe those attention seeking rumor mongers in the IT media who try to convince everyone that if they own an Intel processor, all the bad guys have immediate access to all their data. So they have been influenced to never ever buy Intel.
Part 2 - While admittedly, there are some who neglect things until it is too late (like keeping regular backups of their data, using strong and unique passwords, wearing masks in crowds :twitch: etc.), there are also many who do their homework to learn the facts before panicking about something that does NOT affect them. See theoneandonlymrk's post above and note, AFAIK, there has not been one report of a Meltdown/Spectre compromise in the wild despite all the sky is falling warnings the world is about to end for all Intel users.
Anyone with two hands can google a list of Intel vulnerabilities and see there are multiple remote access ones:
www.cvedetails.com/vulnerability-list/vendor_id-238/Intel.html
And while you learn to Google, you might want to learn what the difference is between a "vulnerability", and malware that has been developed and released out into the wild that can successfully bypass all other security measures (Windows itself, the router, the firewall, the anti-malware program, the deadbolts on my door, my Rottweiler, and my Glock 17) to gain access to that vulnerability, and "IS" infecting and exploiting that vulnerability.
Just because there is a vulnerability, that does not mean it can, or has been exploited.
Crosstalk is a tool used to expose the vulnerability IN A CONTROLLED ENVIRONMENT! The official name of the vulnerability is, "special register buffer data sampling" or "SRBDS", officially designated CVE-2020-0543.
My point was about illustrating how some in the IT Media love to attract attention to themselves and their bylines with sensationalized, exaggerated or even false headlines that inaccurately paint others in a bad light!
I will not go so far as to call it "fake news", because as noted, it is, more or less, explained correctly later on - or at least includes links to the accurate information. But such irresponsible [so called] "journalism" :twitch: :rolleyes: leads to fake news and rumormongering - and that disgusts me. The IT media (and tech sites like TPU) should be setting the records straight - not simply parroting and "spinning" stories with inaccuracies and exaggerations.
Is the vulnerability real? Yes! Of course? Absolutely! So are Spectre and Meltdown.
But are they being "exploited" by the bad guys? NO!!!!!!! And why? Because like so many vulnerabilities (in processors, operating systems, networks, etc.) the bad guy must have physical access to the computer (or, maybe, be granted specific remote access by an authorized user). And the bad guy must have root (admin) access to the computer. That is, he or she must be in your home, sitting at your computer desk, and have access to an admin account on your computer, or you consciously granted the bad guy remote and admin access to your computer. Then he or she must bypass or disable all your security measures and then install and run special malware on your computer that can then exploit that vulnerability for their evil deeds.
Now if that scenario is likely in your computing environment, then I would say you have much greater security concerns than SRBDS, Spectre or Meltdown - and for sure, you do need to be worried.
However, because such "exploitation" is unlikely, Intel sales are NOT being impacted by those vulnerabilities.
So I say again, "Just because there is a vulnerability, that does not mean it can, or has been exploited." What it does mean, however, is AS ALWAYS, users must "practice safe computing". That is we must:
[INDENT]Keep our computers, operating systems, and security programs updated and current,[/INDENT]
[INDENT]Avoid risky behavior like visiting illegal pornography, gambling, and filesharing sites, [/INDENT]
[INDENT]Avoid public "hotspots" with admin level accounts,[/INDENT]
[INDENT]Use strong and unique passwords and passphrases, [/INDENT]
[INDENT]Ensure other, less "security-aware" users of that computer don't have root/admin access to that computer,[/INDENT]
[INDENT]Avoid being "click-happy" on unsolicited downloads, attachments, links, and popups. [/INDENT]
But of course, those are the same precautions all users must take regardless the processor, browser, OS or security program we use.