Intel Responds to ZombieLoad and CacheOut Attacks

By published

And not just with a "what?"

CacheOut Logo
(Image credit: Marina Minkin)

Researchers at the University of Michigan, VUSec and University of Adelaide revealed a new attack they dubbed CacheOut yesterday. The speculative execution attack "is capable of leaking data from Intel CPUs across many security boundaries," according to the researchers, and it offers better targeting than previous attacks of its type.

CacheOut was purportedly inspired by previous speculative execution attacks like Spectre and Meltdown. Its reach extends further than those attacks, however, because it can bypass the hardware-based safeguards implemented by Intel in response to Meltdown's discovery. It can also be used to extract specific data.

The researchers said they "empirically demonstrate that CacheOut can violate nearly every hardware-based security domain, leaking data from the OS kernel, co-resident virtual machines, and even SGX enclaves" in their paper. Intel released microcode updates, and explained how to mitigate the attack on the OS level, in response.

So who's affected? The researchers said that anyone who owns an Intel processor released before the fourth quarter of 2018 is probably affected by CacheOut. (The company "inadvertently managed to partially mitigate this issue while addressing a previous issue," they said.) Intel published a list of affected processors on its website.

More information about CacheOut can be found in the researchers' paper (PDF). Intel offered additional details in a security advisory on its website, too, and the vulnerability exploited by this attack was given the National Vulnerability Database identifier of CVE-2020-0549. It's not believed to have been exploited in the wild.

Intel responded to our request for comment, stating:

"“Since May 2019, starting with Microarchitectural Data Sampling (MDS), and then in November with TAA, we and our system software partners have released mitigations that have cumulatively and substantially reduced the overall attack surface for these types of issues. We continue to conduct research in this area – internally, and in conjunction with the external research community.

More information can be found at https://blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/ (opens in new tab).”"

ZombieLoad Rises Again

CacheOut appears to be related to the ZombieLoad attack that Intel attempted to address with patches for its processors in early 2019. The researchers who discovered ZombieLoad said on January 27 that more information about a previously embargoed side effect of their attack was available via the Intel Security Advisory and CVE-2020-0549 listing that were cited by the CacheOut researchers.

Here's part of the update from ZombieLoad's researchers:

"On January 27th, 2020, an embargo ended showing that the mitigations against MDS attacks released in May 2019 are insufficient. With L1D Eviction Sampling, an attacker can still mount ZombieLoad to leak data that is being evicted from the L1D cache. 

"We disclosed this issue to Intel on May 16th, 2019. However, as microcode updates containing the necessary fixes are not yet available, we are not releasing any proof-of-concept code."

The researchers said additional information about this new attack can be found in the final version of their paper (PDF). While the new CacheOut branding might make this attack seem totally new, it seems like ZombieLoad actually copied its namesake in rising from the dead to continue to munch on the sweet, sweet brains of our PCs.

Nathaniel Mott
Nathaniel Mott

Nathaniel Mott is a freelance news and features writer for Tom's Hardware US, covering breaking news, security, and the silliest aspects of the tech industry.
Topics
CPUs
26 Comments Comment from the forums
  • mitch074
    Every trimester you get a new Intel security problem...
    I'm ever more appreciative of my Ryzen 2700X.
    Reply
  • Groveling_Wyrm
    mitch074 said:
    Every trimester you get a new Intel security problem...
    I'm ever more appreciative of my Ryzen 2700X.

    Just because you hear about Intel's issues, does not mean that your Ryzen is any safer.

    You should notice a few things:

    First, AMD processors are just as vulnerable, in their own way. Some of the same issues that affect Intel also affect AMD. You should be concerned about this, because they will eventually find issues that seriously affect both Intel and AMD.

    Second, you don't hear about issues with AMD because Intel has the majority of the market, and hackers will generally try to influence the majority of the market instead of hacking only a few, they are attacking the majority.

    Third, Because of the popularity of Intel processors in the current market, any headline about Intel carries more weight than a headline about an AMD.
    Reply
  • mitch074
    Groveling_Wyrm said:
    Just because you hear about Intel's issues, does not mean that your Ryzen is any safer.

    You should notice a few things:

    First, AMD processors are just as vulnerable, in their own way. Some of the same issues that affect Intel also affect AMD. You should be concerned about this, because they will eventually find issues that seriously affect both Intel and AMD.

    Second, you don't hear about issues with AMD because Intel has the majority of the market, and hackers will generally try to influence the majority of the market instead of hacking only a few, they are attacking the majority.

    Third, Because of the popularity of Intel processors in the current market, any headline about Intel carries more weight than a headline about an AMD.
    You're wrong, because I actually followed this topic even since the original SPECTRE and Meltdown vulnerabilities were disclosed. AMD chips have been TESTED AS NON VULNERABLE to most of these exploits. Those that worked have been fixed : proof-of-concept exploits do not work on AMD chips.
    AMD have explained that ever since Bulldozer, they have implemented much stricter memory protection in their chips because console makers were very strict about it - and both Microsoft's and Sony's consoles are using AMD chips and haven't been hacked. This can be further proven with the history of implementing the only workaround currently available to Spectre (the one vulnerability that affects all OOP processors in existence) in the Linux kernel : retpoline. For the latter, kernel developers ended up disabling most of the mitigation when running on AMD chips, because firmware updates plugged most of the holes and those they didn't had low-impact workarounds.
    So, the fact that Intel is easier to crack because they have a bigger slice of the market thus more attempts have been made is <Mod Edit> - AMD's total amount of chips on the market can be counted in the dozens of millions, if their chips were vulnerable they'd have been exploited already, especially the juicy console market where a single exploit would mean that ALL current consoles could be hacked instantly, including user accounts and credentials, often attached to a credit card account and used by people who are absolutely not tech-savvy.
    Finally, considering that AMD is reaching a fifth of the x86 CPU shipments overall and 50% on the DIY market, any hacker worth their salt would try to exploit anything they could on them - and they were close : a vulnerability in the early Ryzen chipsets was found, and worked around quite quickly, for that very reason.
    The only ones who said AMD were affected just as bad were Intel PR, and they were all debunked under 48 hours.
    Reply
  • robwright
    Groveling_Wyrm said:
    Just because you hear about Intel's issues, does not mean that your Ryzen is any safer.

    You should notice a few things:

    First, AMD processors are just as vulnerable, in their own way. Some of the same issues that affect Intel also affect AMD. You should be concerned about this, because they will eventually find issues that seriously affect both Intel and AMD.

    Second, you don't hear about issues with AMD because Intel has the majority of the market, and hackers will generally try to influence the majority of the market instead of hacking only a few, they are attacking the majority.

    Third, Because of the popularity of Intel processors in the current market, any headline about Intel carries more weight than a headline about an AMD.

    Actually, YOU should note a few things:

    First, AMD is not vulnerable to CacheOut. The researchers who discovered this latest speculative execution flaw make that pretty clear.

    Second, hackers didn't discover this, or any of the other speculative execution/side channel attacks. Academic/computer researchers did. And they're not "attacking the majority" -- they've been analyzing chip architectures, including AMD, ARM and others for YEARS.

    Third, and finally, while Intel is obviously the bigger and more well known company, that doesn't change the fact ALL of the previously discovered side channel attacks that were first revealed in January of 2018 (Meltdown, Spectre, Fallout, ZomebieLoad, and their respective variants) affect Intel chips, whereas only Spectre affects some AMD chips. So you can argue about headlines and media coverage, but the fact is the company has designed their chips -- and their subsequent patches -- in a way that makes them vulnerable to data leak attacks like CacheOut.
    Reply
  • Groveling_Wyrm
    mitch074 said:
    You're wrong, because I actually followed this topic even since the original SPECTRE and Meltdown vulnerabilities were disclosed. AMD chips have been TESTED AS NON VULNERABLE to most of these exploits. Those that worked have been fixed : proof-of-concept exploits do not work on AMD chips.
    AMD have explained that ever since Bulldozer, they have implemented much stricter memory protection in their chips because console makers were very strict about it - and both Microsoft's and Sony's consoles are using AMD chips and haven't been hacked. This can be further proven with the history of implementing the only workaround currently available to Spectre (the one vulnerability that affects all OOP processors in existence) in the Linux kernel : retpoline. For the latter, kernel developers ended up disabling most of the mitigation when running on AMD chips, because firmware updates plugged most of the holes and those they didn't had low-impact workarounds.
    So, the fact that Intel is easier to crack because they have a bigger slice of the market thus more attempts have been made is bullsh*t - AMD's total amount of chips on the market can be counted in the dozens of millions, if their chips were vulnerable they'd have been exploited already, especially the juicy console market where a single exploit would mean that ALL current consoles could be hacked instantly, including user accounts and credentials, often attached to a credit card account and used by people who are absolutely not tech-savvy.
    Finally, considering that AMD is reaching a fifth of the x86 CPU shipments overall and 50% on the DIY market, any hacker worth their salt would try to exploit anything they could on them - and they were close : a vulnerability in the early Ryzen chipsets was found, and worked around quite quickly, for that very reason.
    The only ones who said AMD were affected just as bad were Intel PR, and they were all debunked under 48 hours.


    You have totally missed the point of my post.

    The point I was making is don't feel so secure about the processor you have.

    Let me narrow it down to this. Just because they haven't found a vulnerability doesn't mean that there are none. Five years ago, Meltdown and Spectre didn't exist. They do now. Five years from now, who knows what will be discovered.

    I will leave you with this thought. Any computer built by man can be hacked by man.
    Reply
  • Groveling_Wyrm
    robwright said:
    Actually, YOU should note a few things:

    First, AMD is not vulnerable to CacheOut. The researchers who discovered this latest speculative execution flaw make that pretty clear.

    Second, hackers didn't discover this, or any of the other speculative execution/side channel attacks. Academic/computer researchers did. And they're not "attacking the majority" -- they've been analyzing chip architectures, including AMD, ARM and others for YEARS.

    Third, and finally, while Intel is obviously the bigger and more well known company, that doesn't change the fact ALL of the previously discovered side channel attacks that were first revealed in January of 2018 (Meltdown, Spectre, Fallout, ZomebieLoad, and their respective variants) affect Intel chips, whereas only Spectre affects some AMD chips. So you can argue about headlines and media coverage, but the fact is the company has designed their chips -- and their subsequent patches -- in a way that makes them vulnerable to data leak attacks like CacheOut.


    I was attempting to generalize. I am not saying that they are vulnerable to one specific vulnerability or another. I am stating that they do have their own weaknesses. I will say the same to you as I just did to Mitch. Just because they haven't found a vulnerability doesn't mean that there are none. Five years ago, Meltdown and Spectre didn't exist. They do now. Five years from now, who knows what will be discovered.

    You might want to learn how the "Academics/computer researchers" are researching a vulnerability. It might surprise you on why they find issues with chip architectures, then you will understand a bit better. How long did it take them to find Spectre, Meltdown and the others?

    And you should remember...its not the Academics/computer researchers" that you have to worry about. It is the people who take advantage of the vulnerabilities, aka, the hackers, that you do have to worry about.

    I never said anything about Intel NOT making their stuff vulnerable. That is not my argument, and never was. You are misunderstanding.

    Regardless of what Intel has done, AMD processors been proven to have vulnerabilities, such as Spectre. Who knows what others they will find in the future?

    The one thing that DOES worry me is that these people know where to look, they know what to look for, courtesy of a few white papers, and now that the Ryzen line is growing in the market, is that these hackers WILL attempt to identify vulnerabilities in them and utilize that. They will do it because it's a challenge.
    Reply
  • robwright
    Groveling_Wyrm said:
    You might want to learn how the "Academics/computer researchers" are researching a vulnerability. It might surprise you on why they find issues with chip architectures, then you will understand a bit better. How long did it take them to find Spectre, Meltdown and the others?

    Bro, I'm a tech journalist and I cover cybersecurity for a living. I've written and edited a number of stories about these side channel attacks, and I've interviewed members of the some of the research teams of these flaws. I know the history of Meltdown and Spectre, from the six-month-plus disclosure process to the research into ASLR bypasses that preceded the speculative execution findings. And more importantly, I know how quickly post-Meltdown & Spectre other researchers beyond Google's Project Zero and Graz University found additional side channel and speculative execution attacks for Intel chips.

    Try again.
    Reply
  • Groveling_Wyrm
    robwright said:
    Bro, I'm a tech journalist and I cover cybersecurity for a living. I've written and edited a number of stories about these side channel attacks, and I've interviewed members of the some of the research teams of these flaws. I know the history of Meltdown and Spectre, from the six-month-plus disclosure process to the research into ASLR bypasses that preceded the speculative execution findings. And more importantly, I know how quickly post-Meltdown & Spectre other researchers beyond Google's Project Zero and Graz University found additional side channel and speculative execution attacks for Intel chips.

    Try again.

    Quoting your occupation doesn't give you credibility on the internet.

    You misunderstood, and we don't need to continue this. You are just trying to argue against point that I was never trying to make.

    We are getting to the point of hijacking this thread. We will just agree to disagree.
    Reply
  • Makaveli
    Groveling_Wyrm said:
    Just because you hear about Intel's issues, does not mean that your Ryzen is any safer.

    You should notice a few things:

    First, AMD processors are just as vulnerable, in their own way. Some of the same issues that affect Intel also affect AMD. You should be concerned about this, because they will eventually find issues that seriously affect both Intel and AMD.

    Second, you don't hear about issues with AMD because Intel has the majority of the market, and hackers will generally try to influence the majority of the market instead of hacking only a few, they are attacking the majority.

    Third, Because of the popularity of Intel processors in the current market, any headline about Intel carries more weight than a headline about an AMD.

    Citation needed for all for this.

    Please post your proof.
    Reply
  • wownwow
    Who cares? With 245 security vulnerabilities, Intel has been pumping $Bs Q after Q, so what does it matter?
    People seem to be happy with paying more for MORE security vulnerabilities and the FREE patches!

    But facts are facts!AMD: No partial address, no related security vulnerabilities.
    Intel: Partial addresses inside, more related security vulnerabilities.
    AMD: 16 security vulnerabilities.
    Intel: 243 (including 1 added in 10/2019) security vulnerabilities, a 15:1 difference in AMD’s favor.
    The gap is just too large to ignore!

    About using partial addresses, a cheap design shortcut:
    People who live on a street with 4-digit addresses can get in each other's houses as long as having addresses with the same last three digits, amazing!
    Reply