Altering Intel’s CPU voltages and frequency directly in the operating system is a feature that many users appreciate as it allows them to use all those software-based utilities that aid in overclocking. Now, this feature may not be as secure as previously anticipated.
Recently a team of cybersecurity experts proved that this particular feature can be exploited by threat actors that can cause substantial damage by aiming to hijack Intel SGX. For those who don’t know, Intel SGX
is an extremely critical and hardware-isolated space on new models of Intel CPUs responsible for encrypting sensitive data for protecting it from being stolen in case the system gets compromised.
The research team comprised of six European members from the University of Birmingham, KU Leuven, and the Graz University of Technology. The attack technique is dubbed Plundervolt and classified as
CVE-2019-11157 .
According to the team’s findings, the attack exploits the modern processor’s frequency and voltage adjustment feature, by controlling it in a way to generate errors in the system’s memory through flipping bits. This attack affects almost all those Intel Core Processors that are SGX-enabled including the Skylake generation .
However, the technique was identified and reported to Intel in June 2019 and now that the company has fixed the issue, the findings have been disclosed to the public.
Yesterday, Intel released the BIOS and microcode updates for addressing the Plundervolt issue and 13 other medium to high vulnerabilities. The updates make locking voltage a part of the default setting in the BIOS. Therefore,, if SGX is disabled or the CPU voltage is locked at the default value, the system will be safe from any threat.
The findings were reported first by ZDNet. The report states that using the Plundervolt vulnerability, threat actors can easily access information such as AES encryption keys stored in the chip’s SGX Enclave. This enclave is not separate from CPU’s memory but is protected by software encryption.
Once its security is breached, attackers can extract data from the enclave at a much faster rate than the previous attacks like Spectre and Meltdown. The attack mechanism is quite similar to the concepts behind CLKscrew and VoltJockey attacks, as it alters SGX bits to create errors and uses them to recreate data via a side-channel observation method.
The attack works on Intel’s 6th, 7th, 8th, 9th, and 10th-Gen Core processors as well as Xeon E3, v5, v6, E-2100 and E-2200, and doesn’t need host access with administrative or root privileges to be launched.
Yet, exploiting the vulnerability would have been tough if not impossible but it would need a combination of attacks and specify particular targets, claim the researchers. It is also noted that the attack cannot be launched in virtual environments, which means Intel’s data center customers are not at risk.
Recently a team of cybersecurity experts proved that this particular feature can be exploited by threat actors that can cause substantial damage by aiming to hijack Intel SGX. For those who don’t know, Intel SGX
is an extremely critical and hardware-isolated space on new models of Intel CPUs responsible for encrypting sensitive data for protecting it from being stolen in case the system gets compromised.
The research team comprised of six European members from the University of Birmingham, KU Leuven, and the Graz University of Technology. The attack technique is dubbed Plundervolt and classified as
CVE-2019-11157 .
According to the team’s findings, the attack exploits the modern processor’s frequency and voltage adjustment feature, by controlling it in a way to generate errors in the system’s memory through flipping bits. This attack affects almost all those Intel Core Processors that are SGX-enabled including the Skylake generation .
However, the technique was identified and reported to Intel in June 2019 and now that the company has fixed the issue, the findings have been disclosed to the public.
Yesterday, Intel released the BIOS and microcode updates for addressing the Plundervolt issue and 13 other medium to high vulnerabilities. The updates make locking voltage a part of the default setting in the BIOS. Therefore,, if SGX is disabled or the CPU voltage is locked at the default value, the system will be safe from any threat.
The findings were reported first by ZDNet. The report states that using the Plundervolt vulnerability, threat actors can easily access information such as AES encryption keys stored in the chip’s SGX Enclave. This enclave is not separate from CPU’s memory but is protected by software encryption.
Once its security is breached, attackers can extract data from the enclave at a much faster rate than the previous attacks like Spectre and Meltdown. The attack mechanism is quite similar to the concepts behind CLKscrew and VoltJockey attacks, as it alters SGX bits to create errors and uses them to recreate data via a side-channel observation method.
The attack works on Intel’s 6th, 7th, 8th, 9th, and 10th-Gen Core processors as well as Xeon E3, v5, v6, E-2100 and E-2200, and doesn’t need host access with administrative or root privileges to be launched.
Yet, exploiting the vulnerability would have been tough if not impossible but it would need a combination of attacks and specify particular targets, claim the researchers. It is also noted that the attack cannot be launched in virtual environments, which means Intel’s data center customers are not at risk.
No comments:
Post a Comment