INFRA
INFRA
INFRA
New Spectre vulnerability exploits software guard extensions in Intel chips
Just when Intel Corp. was addressing the Spectre security vulnerabilities first revealed in January, researchers have spoiled the party by revealing a new, previously unknown variant.
Dubbed SgxPectre, the vulnerability allows an attacker to undertake a so-called side-channel attack via Intel’s SGX secure environments. SGX, short for Software Guard Extensions, is a set of central processing unit chip instructions that can be used by developers to create applications to set aside private regions of code and data.
Using SGX, application code can be put into an “enclave,” an isolated execution environment to protect sensitive data from unauthorized access or modification by rogue software running at higher privilege levels. But as it turns out, that same access can also be exploited.
Detailed in a paper published last week by researchers at Ohio State University, the attack exploits software supported via software development kits for SGX, including Intel SGX Software Development Kit, Rust-SGX and Graphene-SGX. Using those SDKs, attackers can create their own SGX enclaves that are designed to create repetitive code executions — the same way previous Spectre variants can confuse a CPU to steal data from it.
Although that sounds bad, there is a good news: Intel has already promisedg a fix.
“We are aware of the research paper from Ohio State and have previously provided information and guidance online about how Intel SGX may be impacted by the side channel analysis vulnerabilities,” Intel said in a statement reported by Neowin. “We anticipate that the existing mitigations for Spectre and Meltdown, in conjunction with an updated software development toolkit for SGX application providers — which we plan to begin making available on March 16th — will be effective against the methods described in that research. We recommend customers make sure they are always using the most recent version of the toolkit.”
Intel last released a microcode update to address Spectre Variant 2 on Feb. 21, and Microsoft released a Windows variant of the same code March 1.
Image: Wikimedia Commons
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
