If you thought Spectre and Meltdown were going to be the only industry-shaking security flaws to affect nearly every computer, think again. Intel recently revealed three new issues related to its Core and Xeon processors, dubbed collectively as “Foreshadow” by the researchers who discovered the exploits.
Unfortunately for Intel and all of us, Foreshadow doesn’t exactly inspire confidence in the computers we rely on every day. Here’s everything you need to know about the new security flaw.
Meet Foreshadow
Like with Spectre and Meltdown, Foreshadow was first discovered by multiple independent teams outside Intel, in this case as a collaboration between researchers from a few universities.
But the origin story is not where the similarities to the previous security flaws stop. The vulnerabilities revealed in Foreshadow are similar to Meltdown and Spectre in that they take advantage of flaws in the way processors temporarily store data in memory.
In an interview with the BBC, one of the researchers behind the discovery described the attack as targeting a “lock box within Intel’s processors,” which could then leak out any kind of data you wanted.
The “lock box” Wenisch is referring to is known as the Software Guard Extensions (Intel SGX), and this attack method only works on Intel processors with the special feature. Intel SGX is essentially a set of instructions built into Intel’s chips that enable developers to create private caches, aka enclaves, in memory, for applications such as secure web browsing and digital rights management for streaming video.
This alone was already a dangerous vulnerability waiting to be exploited — but unfortunately, it was only the first of three methods of attack. Upon further investigation, Intel discovered two other related problems, which researchers have named “Foreshadow-NG” (aka next generation).
Foreshadow, the Next Generation
These two vulnerabilities are still based on a processor core’s L1 cache, which is where an individual core of the processor stores the information it will need next. But these newly-discovered issues affect memory uses other than just Intel’s SGX technology.
The first vulnerability in the Foreshadow-NG group can grab data from memory used by the core of an operating system, aka the kernel. This core has access to all data stored in memory, including every app and program installed on the machine. The good news here is that a hacker must have access to your PC and use a malicious program to actually steal that data.
This vulnerability also enables access to data used by the System Management Mode (SMM) installed in all modern processors. This mode is used by the PC’s firmware to control the hardware, manage power, and so on. Again, to steal this data, a hacker must have access to your PC with guest privileges to run malicious software.
The second Foreshadow-NG vulnerability can be used to attack virtual machines. These aren’t real PCs, but rather software-emulated PCs running in memory on a datacenter server. Virtual machines are typically managed by a hypervisor so that data doesn’t leak between these virtual PC instances.
But according to the researchers, a malicious virtual machine could break through those boundaries. “A malicious virtual machine running inside the cloud can potentially read data belonging to other virtual machines as well as data belonging to the cloud’s hypervisor,” the researchers claim.
Who’s affected by Foreshadow?
The original Foreshadow vulnerability, specifically pertains only to SGX-enabled Intel processors. These include all sixth- and seventh-generation Core processors but exclude Atom processors that support SGX. Processors manufactured by AMD are not affected, nor are chips based on ARM’s processor core design (Tegra, Snapdragon, Enyos, etc.).
Foreshadow-NG is a different story. As of now, chips based on ARM’s architecture and x86-based CPUs from AMD are still under investigation. Processors produced by Intel that fall prey to Foreshadow-NG can be found here in a very long list. It essentially covers second- to eighth-generation Intel Core processors, X-Series chips for the X99 and X299 platforms, Xeon processors spanning from the 32400 Series to the Xeon Processor Scalable Family, and so on.
“We are not aware of reports that any of these methods have been used in real-world exploits …”
Intel was quick to report that microcode updates were already issued earlier this year to protect customers against possible attacks. These updates built a foundation for the current mitigations introduced on Tuesday by operating system providers, hypervisor software developers and the open source community.
Changes will also be made on a hardware level in Intel’s next-generation “Cascade Lake” Xeon Scalable processors and “client processors” launching by the end of 2018.
“We are not aware of reports that any of these methods have been used in real-world exploits, but this further underscores the need for everyone to adhere to security best practices,” Intel says. “This includes keeping systems up-to-date and taking steps to prevent malware.”
