The vulnerability is due to memory optimization features in Intel processors.
Once again, a vulnerability has been discovered in the speculative instruction execution system of Intel processors , and this time a Google researcher revealed that he identified a new vulnerability (already cataloged under CVE-2022-40982 ), called "Downfall".
Downfall is a vulnerability that allows the determination of the contents of the XMM, YMM and ZMM vector registers, previously used in other processes when executing AVX instructions on the same CPU core.
About Downfall
Regarding the vulnerability, it is mentioned that an unprivileged attacker with the ability to execute their own code on the system could use the vulnerability to exfiltrate data from other user processes, the system kernel, isolated Intel SGX enclaves, and virtual machines.
Filterable vector registers are widely used in encryption, memory copy functions, and string processing, for example, these registers are used in the Glibc library in the memcpy, strcmp, and strlen functions, among other things. From a practical point of view, the vulnerability could be exploited to determine the data being processed in AES-NI or REP-MOVS instructions (used in the memcpy function) in other processes, which could leak encryption keys, sensitive data and user passwords.
The vulnerability is manifested in Intel processors that support AVX2 and AVX-512 extended instruction sets (i.e., it affects processors from the 6th to the 11th generation), while Intel processors based on the Alder Lake, Raptor Lake, and Sapphire Rapids microarchitectures are not affected.
As with the recently discovered Zenbleed vulnerability affecting AMD Zen2 processors, in Downfall, the reason for the vulnerability is data leakage from log files, which are used to share log content across all applications. tasks on the same CPU core.
The leak is due to speculative data transfer during the execution of the GATHER instruction , available in the AVX2 and AVX-512 extensions, and designed to provide fast access to disparate data in memory. During the execution of the GATHER instruction, old data from the register file is used in the speculative execution of dependent instructions. This data is not directly reflected in the software registers but can be detected using side-channel attack techniques designed for Meltdown attacks, such as analyzing leftover data in the CPU cache.
To exploit Downfall, an attack technique called Gather Data Sampling (GDS) was developed, and prototype exploits have been published for extracting cryptographic keys from another user's process, leaking data after the memcpy function copies it into the Linux kernel, and intercepting printed characters left in vector registers after other processes have run. For example, it demonstrates the ability to define AES keys used to encrypt data in another user's process using the OpenSSL library.
The method demonstrated high efficiency: in an experiment with 100 different keys, it successfully identified 100% of the AES-128 keys and 86% of the AES-256 keys, with each attempt lasting no more than 10 seconds. In cloud systems, this attack can be used to identify data being processed on other virtual machines. The vulnerability can potentially be exploited by executing JavaScript code in a web browser.
It's worth mentioning that Intel learned of the problem last year (specifically in August) and that the vulnerability was only made public this year at the Black Hat USA conference. The fixes to protect against the vulnerability are already included in the various Linux kernel updates ranging from version 6.4.9 to 4.14.321.
In addition to this, among the possible measures to avoid the negative impact of the protection against the Downfall vulnerability on performance, it is mentioned making changes in the compilers to disable the use of the GATHER statement or adding the statement immediately after the GATHER LFENCE, which disables preemptive execution of subsequent statements before all previous commits have completed.
For systems where firmware fixes are not available, support for all AVX extensions has been disabled, while for the Intel microcode update part, it also provides the ability to use the MSR interface to selectively disable the firmware. protection in the context of individual processes.
Finally, if you are interested in learning more about this , you can find the details at the following link.