Forum Moderators: open

Message Too Old, No Replies

Intel CPUs Affected by LVI (Load Value Injection) Vulnerability

         

engine

2:27 pm on Mar 11, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



A security flaw, LVI (Load Value Injection) is a new type of theoretical threat on Intel processors. The company has patched it with firmware on current models, and hardware fixes are planned for new processors model.
LVI's position in all these attacks is, technically, of a reverse-Meltdown. While the original Meltdown bug allowed attackers to read an app's data from inside a CPU's memory while in a transient state, LVI allows the attacker to inject code inside the CPU and have it executed as a transient "temporary" operation, giving attackers more control over what happens.


[zdnet.com...]

Previous stories
Unfixable flaw in Intel CPU [webmasterworld.com]
Intel ZombieLoad Vulnerability Bug Fix May Slow Computers and Datacenters [webmasterworld.com]
Google Engineers Say, Spectre Vulnerability is Here to Stay [webmasterworld.com]
Intel Says, Stop Deploying Current Spectre Patch [webmasterworld.com]
Linus Torvalds Criticises Intel's "Patches" for Meltdown and Spectre [webmasterworld.com]
CPU Vulnerabilities Named Meltdown and Spectre [webmasterworld.com]

lammert

6:15 pm on Mar 12, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



This flaw--together with Meltdown and Spectre--is present due to a basic design problem in the Intel CPUs where processes are fully separated on a CPU level, but temporary storage for prediction of future CPU instructions and results is not. It won't impact systems which are dedicated to one process or owner, but in our current virtual world where virtualization of processes is the norm rather than the exception, these type of flaws can be used to cause significant havoc. It is possible to peek over virtualization borders into other separated environments on the same physical server.

I don't hear of comparable problems on AMD processors. Are they so different in design or is Intel with their 69% market share in Q4 of 2019 just an easier target for security analysts?