Academic researchers at the Vrije Universiteit Amsterdam have discovered a new Spectre-based flaw in several major upcoming CPU chips, but hardware manufacturers are seemingly unfazed by the findings.
As reported by BleepingComputer Researchers from the Systems and Network Security Group (VUSec Group) discovered a side-channel attack and named it SLAM. It takes advantage of hardware features introduced in upcoming Intel, AMD and Arm chips, allowing them to obtain root password hashes from kernel memory.
SLAM, abbreviation(ish) for “Spectre based on LAM”, is described as a transient execution attack that uses a memory feature that causes software to use untranslated address bits in 64-bit linear addresses for storing metadata. All CPU manufacturers have this feature: on Intel devices it is Linear Address Masking (LAM), on AMD it is Upper Address Ignore (UAI), and on ARM it is Top Byte Ignore (TBI).
Specter v2 has already been mitigated, OEMs say
To carry out the attack, the researchers took advantage of a previously unanalyzed class of Specter disclosure gadgets: code instructions that can be manipulated to trigger speculative execution that exposes sensitive information. The information generated in this way is usually discarded, but there are traces (changed cache states and the like) that can be observed to extract important data.
To observe the traces, the academics built a scanner and used it to find “hundreds” of exploitable gadgets on the Linux kernel.
But hardware manufacturers don't seem to be too impressed with the findings, with the majority thinking they've already addressed the problem. ARM said its systems already mitigate the vulnerabilities in Specter v2 and Specter-BHB and as such do not require additional checks. AMD's comment was along the same lines and didn't bother to release new updates.
However, Intel said it would provide software guidance before publishing new LAM-supported chips.