Researchers have discovered another security flaw in Intel security chips – the third one this year after Spectre and Meltdown.
The flaw allows an attacker to steal sensitive information stored on personal computers or third-party clouds.
According to their research report, Foreshadow has two versions, the original attack designed to extract data from Intel SGX enclaves and a Next-Generation version which affects Virtual Machines (VMs), hypervisors (VMM), operating system (OS) kernel memory, and System Management Mode (SMM) memory.
The flaw was discovered by researchers from the Israel Institute of Technology, University of Michigan, the University of Adelaide, and the Catholic University of Leuven.
The report says that mitigations against Meltdown and Spectre are not effective against Foreshadow and Foreshadow-NG.
On its website, Intel says it has "worked with operating system vendors, equipment manufacturers, and other ecosystem partners to develop platform firmware and software updates that can help protect systems from these methods.
"This includes the release of updated Intel microprocessor microcode to our customers and partners.
Affected CPUsIntel confirmed that Foreshadow affects all SGX-enabled Core processors (Skylake and Kaby Lake), while Atom family processors with SGX support remain unaffected. Intel confirmed that Foreshadow-NG affects the following processes:
· Intel Core i3/i5/i7/M processor (45nm and 32nm)
· 2nd/3rd/4th/5th/6th/7th/8th generation Intel Core processors
· Intel Core X-series Processor Family for Intel X99 and X299 platforms
· Intel Xeon processor 3400/3600/5500/5600/6500/7500 series
· Intel Xeon Processor E3 v1/v2/v3/v4/v5/v6 Family
· Intel® Xeon Processor E5 v1/v2/v3/v4 Family
· Intel® Xeon Processor E7 v1/v2/v3/v4 Family
· Intel® Xeon Processor Scalable Family
· Intel® Xeon Processor D (1500, 2100)
Cloud threat defence company RedLock's Cloud Security VP Matthew Chiodi says, "What's interesting about the Intel disclosure is that researchers simply followed the thread left by Spectre and Meltdown—this isn't a completely new class of vulnerabilities.
"This means that while Intel is not officially aware of any exploits that take advantage of this today, certainly advanced nation-states have been working on them.
"Interestingly enough, back in June, the OpenBSD project announced plans to disable support for Intel CPU hyper-threading (HT) due to security concerns around more 'Spectre-class bugs' - Their announcement has proved prescient.
Chiodi adds that public cloud titans Google, Microsoft and AWS quickly responded to Foreshadow by updating their respective infrastructure and services.
"Enterprise cloud consumers tangibly benefited as the vast majority of them are not operating multi-tenant workloads on the same VM.
"That doesn't mean there's nothing to do on the end-user side, but the cloud providers have already done a lot of the heavy lifting.
He concludes," The bottom line is that even the best and fastest fixes aren't effective unless all stakeholders do their part—this is especially relevant in public cloud given the shared responsibility model.
"It only takes one party, one weak link in the chain, for the exposure to remain.
