2 ms·
New Plundervolt Attack Impacts Intel CPUs
- rvz 7y ago> Plundervolt can't be exploited remotely, such as luring a user to a website and executing the attack via JavaScript. It may be a nasty vulnerability, but it's no Spectre/Meltdown-level one that is worthy of the name. > Intel has also released microcode (CPU firmware) and BIOS updates today that address the Plundervolt attack. Hit 'Microcode Update' reboot, and it's fixed. Move along now, nothing significant (or remotely exploitable) here.
- NicoJuicy 7y agoPrevious microcode updates slowed Intel processors with >20%.
- ngneer 7y agoNot this. This is merely a configuration issue. Intel left an interface open that should not have been left open. A processor is a large distributed system and undervolting does not go well with secure computation.
- dnautics 7y agoit's not nasty in the same way as Spectre/Meltdown, but it's still nasty. Spectre/Meltdown is bad because of the trust model. As a tenant of a cloud platform, you somewhat implicitly trust your cloud provider, but you distrust your neighbor, and Spectre/Meltdown can be used to breach that trust guarantee. With the Spectre JS attacks, it's a similar situation where a user can't necessarily trust tenant code, and that security layer is breached. SGX is "secure" in the other direction. The executing code presumes to not be able to trust the hosting hardware. For example, you are a copyright-happy media company and you want to deliver DRM'd content to a customer who might be trying to crack your keys, you might want to run code inside of an enclave that is "protected", from even ring 0 or ring -1, -2, etc. from ever getting at your code. I was wondering why a BIOS patch would work, but I guess your SGX-using software could pretest if the patch exists.