5 ms·
The newest Intel CVE seems tied to some legacy handling of duplicate prefixes, where it usually ignores duplicate prefixes since they were used to pad memory re
by I_Am_Nous 3y ago
The newest Intel CVE seems tied to some legacy handling of duplicate prefixes, where it usually ignores duplicate prefixes since they were used to pad memory registers sometimes. A newer feature added onto x86 is the underlying problem (FSRM), but it's mishandling those "battle tested" instructions/improperly reading them.
So really, it's a combination of things that led to this CVE, and the longer we stay on an old platform the more strange combinations we might find!
- adrian_b 3y agoI have looked at the file "icebreak.asm" that is the reproducer for the Intel bug, and it contains a double REX prefix on a movsb instruction. According to all documents that have ever been published by either Intel or AMD for x86-64, it is forbidden to have more than one REX prefix in an instruction. Therefore, the instruction from "icebreak.asm" should have generated an undefined instruction exception. While in this case the behavior of the bug is extreme, by completely crashing the computer, if there are other Intel or AMD CPUs which just ignore the duplicated REX prefix, without generating the undefined instruction exception, according to their CPU architecture documentation, that is already an extremely severe bug and such lax implementations are very likely to lead to more damaging bugs, like this.