New "Plundervolt" Intel CPU Vulnerability Exploits vCore to Fault SGX and Steal Protected Data

[btarunr]

A group of cybersecurity researchers have discovered a new security vulnerability affecting Intel processors, which they've craftily named "Plundervolt," a portmanteau of the words "plunder" and "undervolt." Chronicled under CVE-2019-11157, it was first reported to Intel in June 2019 under its security bug-bounty programme, so it could secretly develop a mitigation. With the 6-month NDA lapsing, the researchers released their findings to the public. Plundervolt is described by researchers as a way to compromise SGX (software guard extensions) protected memory by undervolting the processor when executing protected computations, to a level where SGX memory-encryption no longer protects data. The researchers have also published proof-of-concept code.

Plundervolt is different from "Rowhammer," in that it flips bits inside the processor, before they're written to the memory, so SGX doesn't protect them. Rowhammer doesn't work with SGX-protected memory. Plundervolt requires root privileges as software that let you tweak vCore require ring-0 access. You don't need direct physical access to the target machine, as tweaking software can also be remotely run. Intel put out security advisory SA-00298 and is working with motherboard vendors and OEMs to release BIOS updates that pack a new microcode with a mitigation against this vulnerability. The research paper can be read here.



View at TechPowerUp Main Site

 

[Chomiq]

Had to do it:

Come on Intel it's time to rebuild your cpu architecture from the scratch.

 

[Xuper]

Image if you can rise Vcore CPU in department like FBI , Dow jones , or even Airport , Power plant , ......via flash driver.

 

[HD64G]

Not surprised at all from this news. Surprised only by customers that keep buying Intel CPUs...

 

[Logoffon]

I'm downright tired of these vulnerabilities, especially those that has a microcode patch that results in lower performance.
Can't researchers shut up about these and make them confidental?
Also, I don't care about privacy cr4p at all. Just let me have full performance from the processor, please.

 

[ratirt]

Not surprised at all from this news. Surprised only by customers that keep buying Intel CPUs...

Been thinking the same. Although, I see now a change in the winds you know. The big PC vendors like HP for instance are slowly moving towards AMD at least in some areas. At my work we have been refused to purchase same Elitedesk G4's with Intel CPU because HP is not selling these any longer. We had to go with Ryzen. The Intel equipped desktops are still listed but when you want a large number of desktops, the company will not be able to deliver because these are only leftovers I suppose.
What is most important, since the vulnerabilities, companies purchasing Intel desktops from HP or any other vendor, might have an issue with them for selling security flawed equipment. There has to be a response to the vulnerabilities from the market.

 

[Chomiq]

Been thinking the same. Although, I see now a change in the winds you know. The big PC vendors like HP for instance are slowly moving towards AMD at least in some areas. At my work we have been refused to purchase same Elitedesk G4's with Intel CPU because HP is not selling these any longer. We had to go with Ryzen. The Intel equipped desktops are still listed but when you want a large number of desktops, the company will not be able to deliver because these are only leftovers I suppose.

They have to divert some of their production to AMD simply because Intel has continued supply shortages.

 

[R0H1T]

At this point you have to wonder if Intel's holes vulnerabilities are more interesting than their (upcoming) products themselves

Intel Launches Horse Ridge Chip for Quantum Computing Systems

 

[londiste]

Plundervolt requires root privileges as software that let you tweak vCore require ring-0 access.

 

[ratirt]

They have to divert some of their production to AMD simply because Intel has continued supply shortages.

Well this is just as possible as what I said. Maybe the vulnerabilities and supply issues are both correct. For the companies going Ryzen is simply killing 2 birds with one stone
BTW. A cheaper stone

 

[Imsochobo]

I'm downright tired of these vulnerabilities, especially those that has a microcode patch that results in lower performance.
Can't researchers shut up about these and make them confidental?
Also, I don't care about privacy cr4p at all. Just let me have full performance from the processor, please.

it's quite easy, buy something else and it's no problem.
also, I think you care if your credit card details were stolen

 

[R-T-B]

Image if you can rise Vcore CPU in department like FBI , Dow jones , or even Airport , Power plant , ......via flash driver.

I mean, you always could with root. Root-requiring vulnerabilities like this bore me, and are being majorly sensationalized.

 

[hat]

I mean, you always could with root. Root-requiring vulnerabilities like this bore me, and are being majorly sensationalized.

I agree, though I remain tired of all these vulnerabilities, and the patches that follow them that further reduce performance each time (and sometimes, cause worse things to happen).

 

[R00kie]

 

[windwhirl]

Another vulnerability?

*Sigh*

 

[freeagent]

That just means you actually have to overclock your cpu, rather than letting it oc automatically. Straight voltage, 1 multiplyer, and your silent pc is ruined lol.

 

[Deleted member 50521]

I mean, you always could with root. Root-requiring vulnerabilities like this bore me, and are being majorly sensationalized.

The sound of reasoning in a sea of sensationalized replies.

 

[newtekie1]

So another "vulnerability" that requires you to basically hand your system over to the attacker before they can even exploit it?

Exploits like these are like saying your car is vulnerable to being stolen...if you give the car thief your car keys and walk him to your car.

 

[Super XP]

So this adds to the already 250+ CPU Vulnerabilities. And those that did get patched need repatching which still don't work, because the issue is a design flaw.
And why are people still buying Intel CPU's? When AMD has the best processors on the planet. lol

 

[windwhirl]

I think the only "remarkable" feature about this vulnerability is that they are using voltage, of all things, to exploit it. That's new, at least for me.

 

[Super XP]

The company [INTEL] tried to downplay the problems early on, with confusing and carefully worded statements. We’re now approaching two years since these key processor flaws were discovered, and Intel is still misleading its customers over the status of fixes.

“There are tons of vulnerabilities still left, we are sure,” says Herbert Bos, a professor at Vrije Universiteit Amsterdam, in an interview with The New York Times. “And they [INTEL] don’t intend to do proper security engineering until their reputation is at stake.”

Intel claimed issues were fixed, but they weren’t..

 

[newtekie1]

And why are people still buying Intel CPU's? When AMD has the best processors on the planet. lol

One thing that needs to be asked is, are there more vulnerabilities being found on Intel processors because Intel processors are actually less secure OR are their more vulnerabilities being found because Intel pays a bounty to people that find vulnerabilities and AMD doesn't?

I think the only "remarkable" feature about this vulnerability is that they are using voltage, of all things, to exploit it. That's new, at least for me.

I agree, I think that's pretty interesting actually. I couldn't care less about the actual vulnerability.

 

[windwhirl]

One think that needs to be asked is, are there more vulnerabilities being found on Intel processors because Intel processors are actually less secure OR are their more vulnerabilities being found because Intel pays a bounty to people that find vulnerabilities and AMD doesn't?

Well, a quick Google search about "AMD bounty" doesn't reveal anything. On AMD's site there is a page about how to report bugs, but no mention of bounties.

Intel does have a bug bounty program on HackerOne, though, at the very least.

 

[newtekie1]

Well, a quick Google search about "AMD bounty" doesn't reveal anything. On AMD's site there is a page about how to report bugs, but no mention of bounties.

Intel does have a bug bounty program on HackerOne, though, at the very least.

That's my point. There is an actual financial incentive to find and report bugs on Intel processors. So it only makes sense that there are more found and reported on the Intel side.

 

[londiste]

One think that needs to be asked is, are there more vulnerabilities being found on Intel processors because Intel processors are actually less secure

Intel processors are much better known in terms of microarchitectural functionality.