Intel and AMD again face Spectre-like attacks on some microprocessors

Will we ever be done with Specter-type attacks on microprocessors? Not yet, according to researchers from the Swiss Federal Institute of Technology (ETH) in Zurich, who have discovered a new vulnerability in some Intel and AMD chips. They named it Retbleed:

ETH Zurich researchers have discovered a serious security vulnerability in computer hardware. The vulnerability, called “Retbleed,” affects microprocessors from market leaders @intel and @AMD. @wiknerj @kavehrazavi @GovCERT_CH https://t.co/wVkV3NDmGI

— ETH Zurich (@ETH_en) July 12, 2022

The name Retbleed (bleed meaning to bleed) comes from the fact that this attack concerns certain instructions called returns, used for example when calling functions in a program. In addition, it bypasses the retpoline patch introduced in 2018 to counter attacks concerning predictive execution. Remember that predictive execution allows a processor to try to anticipate a branch linked to a logical condition in a program. It is crucial to ensure good performance during program execution. But a hacker can influence this mechanism and encourage the processor to execute a branch of instructions when it shouldn’t. In this case, this may result in access to areas of the cache memory of the processor, or even of the central memory, comprising sensitive data such as passwords.

The retpoline patch made it possible to counter the attack by transforming certain vulnerable instructions into returns in the program. But these returns can also become vulnerable, as Johannes Wikner of ETH Zurich points out: “We have shown that with speculative execution, a particularly large number of return instructions are vulnerable and can be hacked. In February, researchers provided proof of concept that Retbleed is a serious problem. Their tests show that Intel Kaby Lake and Coffee Lake processors (seventh and eighth generation Core), as well as AMD Zen 1/1+ and Zen 2 chips are vulnerable, even if they are protected by retpoline.

They said that steps to prevent the problem could be taken, but it would slow down computer performance by 12-28%.

For their part, Intel and AMD have confirmed the existence of the vulnerability and published software workaround guides. Intel said it works in particular with the Linux community and virtual machine vendors. The manufacturer specified that the Windows machines were not affected, because the operating system of Microsoft uses by default a modification of the microcode of the processors, baptized Indirect Branch Restricted Speculation (IBRS). The two microprocessor manufacturers finally indicated that they were not aware of any possible use by hackers of the vulnerability discovered by researchers at ETH Zurich.

Source :

ETH Zürich