Exploit bypasses all previous speculative-execution fixes:
LAS VEGAS — Microsoft last month secretly fixed a serious security flaw in Intel chips that could have reversed all the fixes made by either company in the wake of the Spectre and Meltdown vulnerabilities.
The flaw, discovered a year ago by Bitdefender researchers, was initially dismissed by Intel until Bitdefender provided a proof-of-concept attack that showed how the vulnerability could be exploited.
Bitdefender disclosed the flaw in conjunction with Microsoft today (Aug. 6) here at the Black Hat security conference, almost one year to the day after Bitdefender's researchers told Intel of the flaw.
"Every machine using newer Intel processors which leverage speculative execution and [run] Windows is affected, including servers and laptops," Bitdefender said in a press release.
Update your Windows system now
Windows users who installed Microsoft's July Patch Tuesday round of updates are protected from this vulnerability. The flaw is less serious on Linux machines running Intel chips, and Bitdefender were not able to provide a proof-of-concept exploit for Linux.
It was not immediately clear whether or how AMD chips might be affected. Apple machines using Intel chips are not thought to be vulnerable when running macOS, but are vulnerable when they run Windows.
MORE: Meltdown and Spectre: How to Protect Your PC, Mac and Phone
The flaw affects a system instruction in 64-bit Windows called SWAPGS, a kernel-level instruction set introduced with Intel's Ivy Bridge processors in 2012 that can be speculatively executed in user mode. That's a no-no, because system and user functions are meant to be walled off from one another.
By manipulating this error in SWAPGS's design, an attacker can glean what the system kernel is doing and thereby see a lot of information that should be secret, such as passwords, encryption keys, session tokens and other data meant to be kept within individual applications and processes.
Most importantly, the SWAPGS flaw allows attackers to completely bypass kernel page table isolation (KPTI), the most widely used method of staving off Meltdown and Spectre attacks, as well as all other mitigations for speculative-execution flaws.
It's likely that Bitdefender researchers were the first to discover this flaw, but as the Bitdefender press release stated, "It is possible that an attacker with knowledge of the vulnerability could have exploited it to steal confidential information."
Speculative execution: An educated guess
Speculative execution is a microprocessing shortcut first deployed more than 20 years ago. Since most CPU tasks are actually repetitive and predictable, chip designers at Intel and other chipmakers discovered they could speed up chips by anticipating and executing commands before the commands were actually received.
In other words, if the user or an application asks for something, the chip can already have done it before the request even comes in. If the actual request doesn't come, the executed code is rolled back, but in most cases, the pre-executed code is actually what ends up being requested and everyone is happy.
However, in January 2018, several groups of researchers simultaneously revealed that speculative execution can leak data that's supposed to be secret. The two most prominent flaws were called Meltdown and Spectre, but several subsequent vulnerabilities and exploits have been found since then. The real fix for all these problems is to completely redesign chips, but to fix the chips already out there, Microsoft, Intel and AMD have issued a series of patches.
The SWAPGS flaw that Bitdefender found allows attackers to bypass all those patches for all those previously disclosed speculative-execution flaws and steal data again.
New Intel Flaw Exposes Secrets on Windows Machines: What to Do | Tom's Guide
