Cybersecurity experts have recently unveiled a series of side-channel vulnerabilities in modern CPUs that could potentially lead to data breaches. These vulnerabilities are identified as Collide+Power (CVE-2023-20583), Downfall (CVE-2022-40982), and Inception (CVE-2023-20569), following the revelation of Zenbleed (CVE-2023-20593), a separate flaw impacting AMD’s Zen 2 architecture-based processors.
Daniel Moghimi, a senior research scientist at Google, highlighted that Downfall attacks exploit a significant flaw present in a vast number of contemporary processors used in both personal and cloud computing. This vulnerability allows a user to intrude and extract data from other users on the same system.
The Downfall attack, specifically, can circumvent Intel’s Software Guard Extensions (SGX) by exploiting memory optimization features in processors with AVX2 and AVX-512 instruction sets. It employs transient execution attack techniques like Gather Data Sampling (GDS) and Gather Value Injection (GVI), which could potentially let untrusted applications bypass isolation barriers and access data from other programs.
Intel has acknowledged Downfall as a medium severity issue leading to potential information disclosure and has proposed a microcode update for mitigation. However, this fix might reduce system performance by up to 50%. The company also notes that newer processors like Alder Lake and Sapphire Rapids are not impacted.
Inception, another attack method, targets AMD Zen CPUs, including Zen 4 processors, by leaking kernel memory. This method is based on Phantom speculation and Training in Transient Execution (TTE), similar to Spectre-V2 and Retbleed attacks.
Additionally, a new approach named Collide+Power poses a threat across various processor types. It works by combining attacker data with other application data in the CPU’s internal memory system, causing a leakage in power consumption. This technique can leak data across different programs and security domains, although the current leakage rates are relatively low.
These discoveries underscore the ongoing challenge in the tech industry of maintaining a balance between optimizing performance and ensuring robust security. As processors become more advanced, they also become more vulnerable to sophisticated attacks, making it crucial for manufacturers and users to stay vigilant and employ necessary security measures.