Recent research has uncovered a critical hardware-level vulnerability affecting Intel processors, continuing a troubling trend in security flaws that have notably hampered performance through necessary patches. Two independent research groups disclosed to The Hacker News that these Intel CPUs are susceptible to a novel attack that exploits Meltdown-type vulnerabilities, bypassing established security defenses.
Identified as CVE-2020-0551, this vulnerability, referred to as “Load Value Injection in the Line Fill Buffers” (LVI-LFB), poses significant risks, allowing attackers with lower privileges to extract sensitive information such as encryption keys and passwords from protected memory. This breach could lead to considerable control over targeted systems.
Experts from Bitdefender and several academic institutions have highlighted the attack’s severity, particularly in multi-tenant environments, including enterprise workstations and cloud servers, where it could permit unauthorized access to sensitive data across various virtualized settings. A lower-privileged user may exploit this vulnerability to extract information from a more privileged user through the hypervisor.
Unlike previously reported vulnerabilities such as Meltdown and Spectre, which involve speculative access to memory or data sniffing when a victim accesses data, the LVI-LFB attack centers on injecting malicious data into processor buffers employed unwittingly by the victim’s applications during speculative execution. This method allows an attacker to manipulate memory access in ways that were previously deemed secure.
The attack requires a systematic approach, initiating with the poisoning of the processor buffer with values controlled by the attacker. By causing the victim program to experience a fault or assisted load, the attacker’s data can be transiently introduced into the victim’s execution pathway. Although the processor typically detects errors and rolls back the operations, side channels might still expose sensitive traces before the rollback occurs.
Researchers have not only demonstrated this methodology but have also articulated various scenarios wherein LVI-LFB could disrupt control flow, potentially influencing data access and execution paths. This exploits speculative execution tactics, akin to techniques outlined in the MITRE ATT&CK framework, encompassing initial access and privilege escalation, among others.
Both research teams have developed proof-of-concept exploits, with tools now publicly available for testing, reaffirming the validity of these findings. Although the full ramifications of this attack on other architectures such as ARM or AMD remain untested, the researchers postulate that any processor vulnerable to Meltdown-like leaks could theoretically succumb to similar LVI-style injections.
Intel acknowledges the vulnerability and has released information on affected products alongside microcode security patches. However, as existing hardware flaws cannot be completely mitigated through software, experts recommend that organizations either disable performance features like hyper-threading or consider hardware replacements to shield against exploitation.
The ongoing landscape of vulnerabilities plaguing Intel processors highlights the necessity for continuous vigilance in cybersecurity practices. As business owners navigate these risks, aligning strategies with the MITRE ATT&CK framework will facilitate better preparedness against evolving threats.