New Variants of Spectre Exploit Discovered

  • 147
  •  
  •  
  •  
  • 1
  •  
  •  
  •  
    148
    Shares

A new Spectre class of vulnerability has been found in CPUs  it has been coined Spectre 1.1 and Spectre 1.2, it has many parallels to Meltdown and Spectre as it takes advantage of speculative execution, this is a feature found in all modern CPUs. The New Spectre 1.1 delivers the payload to the CPU store cache buffers in order to override and run the malicious code on the client’s machine.

The researchers who have discovered the bug state there is no effective static analysis or compiler instrumentation to detect the Spectre 1.1 vulnerability

For Spectre 1.2, the vulnerability can be exploited by writing to CPU memory sectors which are protected by the read-only flags in the computer.

“As a result [of malicious Spectre 1.2 writes], sandboxing that depends on hardware enforcement of read-only memory is rendered ineffective,” researchers say.

The current exploit is the same as the original Meltdown and Spectre bugs, both of these vulnerabilities require malicious code present on the machine in order for the vulnerability to be able to execute.

ARM and Intel have publicly acknowledged that their CPUs are vulnerable to the Spectre 1.1. Advanced Micro Devices (AMD) have not yet made a statement as they have been slower than the others in reviewing the security issues, however all the original Spectre attacks were affecting AMD CPUs hence one can assume that all AMD CPUs will be too. Researchers have not yet released any further information about the CPU models that are affected by this issue. While Microsoft, Oracle and Redhat have issued a statement that they are still investigating the issue.

The following two tabs change content below.
I am a programmer and tech enthusiast who loves to use my creative skills to solve complex problems. I also love to stay abreast of what is happening in the world of technology, reach me at: [email protected]

Harikrishna Mekala

I am a programmer and tech enthusiast who loves to use my creative skills to solve complex problems. I also love to stay abreast of what is happening in the world of technology, reach me at: [email protected]

Leave a Reply