Intel fixes high-severity CPU bug that causes “very unusual conduct”

Intel on Tuesday pushed microcode updates to repair a high-severity CPU bug that has the potential to be maliciously exploited in opposition to cloud-based hosts.

The flaw, affecting nearly all trendy Intel CPUs, causes them to “enter a glitch state the place the conventional guidelines don’t apply,” Tavis Ormandy, one in all a number of safety researchers inside Google who found the bug, reported. As soon as triggered, the glitch state leads to surprising and doubtlessly severe conduct, most notably system crashes that happen even when untrusted code is executed inside a visitor account of a digital machine, which, below most cloud safety fashions, is assumed to be protected from such faults. Escalation of privileges can be a risk.

Very unusual conduct

The bug, tracked below the widespread identify Reptar and the designation CVE-2023-23583, is said to how affected CPUs handle prefixes, which change the conduct of directions despatched by working software program. Intel x64 decoding usually permits redundant prefixes—that means those who don’t make sense in a given context—to be ignored with out consequence. Throughout testing in August, Ormandy observed that the REX prefix was producing “surprising outcomes” when working on Intel CPUs that help a more moderen characteristic generally known as quick quick repeat transfer, which was launched within the Ice Lake structure to repair microcoding bottlenecks.

The surprising conduct occurred when including the redundant rex.r prefixes to the FSRM-optimized rep mov operation. Ormandy wrote:

We noticed some very unusual conduct whereas testing. For instance, branches to surprising areas, unconditional branches being ignored and the processor now not precisely recording the instruction pointer in xsave or name directions.

Oddly, when making an attempt to know what was occurring we’d see a debugger reporting inconceivable states!

This already appeared prefer it might be indicative of a major problem, however inside just a few days of experimenting we discovered that when a number of cores have been triggering the identical bug, the processor would start to report machine examine exceptions and halt.

We verified this labored even inside an unprivileged visitor VM, so this already has severe safety implications for cloud suppliers. Naturally, we reported this to Intel as quickly as we confirmed this was a safety problem.

Jerry Bryant, Intel’s senior director of Incident Response & Safety Communications, mentioned on Tuesday that firm engineers have been already conscious of a “useful bug” in older CPU platforms that would lead to a short lived denial of service and had scheduled a repair for subsequent March. The severity ranking had tentatively been set at 5 out of a potential 10. These plans have been disrupted following discoveries inside Intel and later inside Google. Bryant wrote:

Due to the diligence and experience of Intel safety researchers, a vector was later found that would enable a potential escalation of privilege (EoP). With an up to date CVSS 3.0 rating of 8.8 (excessive), this discovery modified our method to mitigating this problem for our prospects and we pulled the replace ahead to align with disclosures already deliberate for November 2023.

Whereas getting ready the February 2024 Intel Platform Replace bundle for buyer validation, we obtained a report from a Google researcher for a similar TDoS problem found internally. The researcher cited a Google 90 day disclosure coverage and that they might go public on November 14, 2023.

Disaster (hopefully) averted

Google labored with business companions to establish and check a profitable mitigation so all customers are shielded from this danger in a well timed method. Particularly, Google’s response crew ensured a profitable rollout of the mitigation to our programs earlier than it posed a danger to our prospects, primarily Google Cloud and ChromeOS prospects.

Intel’s official bulletin lists two courses of affected merchandise: those who have been already fastened and people which can be fastened utilizing microcode updates launched Tuesday. Particularly, these merchandise have the brand new microcode replace:

An exhaustive listing of affected CPUs is out there right here. As regular, the microcode updates will likely be out there from system or motherboard producers. Whereas people aren’t more likely to face any rapid risk from this vulnerability, they need to examine with the producer for a repair.

Folks with experience in x86 instruction and decoding ought to learn Ormandy’s submit in its entirety. For everybody else, crucial takeaway is that this: “Nevertheless, we merely don’t know if we are able to management the corruption exactly sufficient to attain privilege escalation.” Meaning it’s not potential for individuals outdoors of Intel to know the true extent of the vulnerability severity. That mentioned, anytime code working inside a digital machine can crash the hypervisor the VM runs on, cloud suppliers like Google, Microsoft, Amazon, and others are going to instantly take discover.

In a separate submit, Google officers wrote:

The influence of this vulnerability is demonstrated when exploited by an attacker in a multi-tenant virtualized surroundings, because the exploit on a visitor machine causes the host machine to crash leading to a Denial of Service to different visitor machines working on the identical host. Moreover, the vulnerability may doubtlessly result in info disclosure or privilege escalation.

The submit mentioned that Google labored with business companions to establish and check profitable mitigations which were rolled out. It’s possible any potential disaster has now been averted, at the very least within the greatest cloud environments. Smaller cloud providers should have work to do.