Intel Releases Security Advisory on Lazy FP State Restore Vulnerability: US-CERT

Topic

New Reply

Intel Releases Security Advisory on Lazy FP State Restore Vulnerability
https://www.us-cert.gov/ncas/current-activity/2018/06/13/Intel-Releases-Security-Advisory-Lazy-FP-State-Restore

Original release date: June 13, 2018

 
Intel has released recommendations to address a vulnerability—dubbed Lazy FP state restore—affecting Intel Core-based microprocessors. An attacker could exploit this vulnerability to obtain access to sensitive information.

NCCIC encourages users and administrators to review Intel’s Security Advisory INTEL-SA-00145, apply the necessary mitigations, and refer to software vendors for appropriate patches, when available.

1 user thanked author for this post.

Elly

Reply | Quote

Replies

Lazy FP state restore
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00145.html

Intel ID: INTEL-SA-00145
Product family: Intel® Core-based microprocessors.
Impact of vulnerability: Information Disclosure
Severity rating: Moderate
Original release: 06/13/2018
Last revised: 06/13/2018

Summary:
System software may utilize the Lazy FP state restore technique to delay the restoring of state until an instruction operating on that state is actually executed by the new process. Systems using Intel® Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel.

Description:
System software may opt to utilize Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.

· CVSS – 4.3 Medium CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected Products:
Intel® Core-based microprocessors.

Recommendations:
If an XSAVE-enabled feature is disabled, then we recommend either its state component bitmap in the extended control register (XCR0) is set to 0 (e.g. XCR0[bit 2]=0 for AVX, XCR0[bits 7:5]=0 for AVX512) or the corresponding register states of the feature should be cleared prior to being disabled. Also for relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.

Acknowledgements:
Intel would like to thank Julian Stecklina from Amazon Germany, Thomas Prescher from Cyberus Technology GmbH (https://www.cyberus-technology.de/), Zdenek Sojka from SYSGO AG (http://sysgo.com), and Colin Percival for reporting this issue and working with us on coordinated disclosure.

Revision History
Revision Date Description
1.0 06/13/2018 Initial Release

CVE Name: CVE-2018-3665

1 user thanked author for this post.

Elly

Reply | Quote

Intel chip flaw: Math unit may spill crypto secrets to apps – modern Linux, Windows, BSDs immune
Malware on Cores, Xeons may lift computations, mitigations in place or coming

By Chris Williams | 13 Jun 2018

 
Updated: A security flaw within Intel Core and Xeon processors can be potentially exploited to swipe sensitive data from the chips’ math processing units.

Malware or malicious logged-in users can attempt to leverage this design blunder to steal the inputs and results of computations performed in private by other software.
…
There is, right now, no known exploit code circulating in the wild targeting this security vulnerability, we’re told.

 
Read the full article here

1 user thanked author for this post.

Elly

Reply | Quote

Another day, another Intel CPU security hole: Lazy State
Intel has announced that there’s yet another CPU security bug in its Core-based microprocessors.

By Steven J. Vaughan-Nichols | June 13, 2018

 
Once upon a time, when we worried about security, we worried about our software. These days, it’s our hardware, our CPUs, with problems like Meltdown and Spectre, which are out to get us. The latest Intel revelation, Lazy FP state restore, can theoretically pull data from your programs, including encryption software, from your computer regardless of your operating system.

Like its forebears, this is a speculative execution vulnerability. In an interview, Red Hat Computer Architect Jon Masters explained: “It affects Intel designs similar to variant 3-a of the previous stuff, but it’s NOT Meltdown.” Still, “it allows the floating point registers to be leaked from another process, but alas that means the same registers as used for crypto, etc.” Lazy State does not affect AMD processors.

 
Read the full article here

2 users thanked author for this post.

HiFlyer, columbia2011

Reply | Quote