A new Spectre class of vulnerability has been found in CPUs it has been coined Spectre 1.1 and Spectre 1.2, it has many parallels to Meltdown and Spectre as it takes advantage of speculative execution, this is a feature found in all modern CPUs. The New Spectre 1.1 delivers the payload to the CPU store cache buffers in order to override and run the malicious code on the client’s machine.
The researchers who have discovered the bug state there is no effective static analysis or compiler instrumentation to detect the Spectre 1.1 vulnerability
For Spectre 1.2, the vulnerability can be exploited by writing to CPU memory sectors which are protected by the read-only flags in the computer.
“As a result [of malicious Spectre 1.2 writes], sandboxing that depends on hardware enforcement of read-only memory is rendered ineffective,” researchers say.
The current exploit is the same as the original Meltdown and Spectre bugs, both of these vulnerabilities require malicious code present on the machine in order for the vulnerability to be able to execute.
ARM and Intel have publicly acknowledged that their CPUs are vulnerable to the Spectre 1.1. Advanced Micro Devices (AMD) have not yet made a statement as they have been slower than the others in reviewing the security issues, however all the original Spectre attacks were affecting AMD CPUs hence one can assume that all AMD CPUs will be too. Researchers have not yet released any further information about the CPU models that are affected by this issue. While Microsoft, Oracle and Redhat have issued a statement that they are still investigating the issue.
