7 New Meltdown and Spectre-type CPU Flaws Affect Intel, AMD, ARM CPUs

Since then, several more variants of speculative execution
attacks have been discovered, including Spectre-NG^[2], SpectreRSB, Spectre
1.1, Spectre1.2, TLBleed^[3], Lazy FP^[4], NetSpectre^[5]
and Foreshadow^[6], patches for which were
released by affected vendors time-to-time.

Speculative execution is a core component of modern processors
design that speculatively executes instructions based on
assumptions that are considered likely to be true. If the
assumptions come out to be valid, the execution continues,
otherwise discarded.

Now, the same team of cybersecurity researchers who discovered
original Meltdown and Spectre vulnerabilities have uncovered 7 new
transient execution attacks affecting 3 major processor
vendors—Intel, AMD, ARM.

While some of the newly-discovered transient execution attacks
are mitigated by existing mitigation techniques for Spectre and
Meltdown, others are not.

1. Meltdown-PK (Protection Key Bypass)—On Intel CPUs, an
attacker with code execution ability in the containing process can
bypass both read and write isolation guarantees enforced through
memory-protection keys for userspace.

2. Meltdown-BR (Bounds Check Bypass)—Intel and AMD x86
processors that ship with Memory Protection eXtensions (MPX) for
efficient array bounds checking can be bypassed to encode
out-of-bounds secrets that are never architecturally visible.

Spectre-PHT (Pattern History Table)

3. Spectre-PHT-CA-OP (Cross-Address-space Out of
Place)—Performing previously disclosed Spectre-PHT attacks within
an attacker-controlled address space at a congruent address to the
victim branch.

4. Spectre-PHT-SA-IP (Same Address-space In
Place)—Performing Spectre-PHT attacks within the same address space
and the same branch location that is later on exploited.
5. Spectre-PHT-SA-OP (Same Address-space Out of
Place)—Performing Spectre-PHT attacks within the same address space
with a different branch.

Spectre-BTB (Branch Target Buffer)

6. Spectre-BTB-SA-IP (Same Address-space In
Place)—Performing Spectre-BTB attacks within the same address space
and the same branch location that is later on exploited.

7. Spectre-BTB-SA-OP (Same Address-space Out of
Place)—Performing Spectre-BTB attacks within the same address space
with a different branch.

Researchers demonstrate all of the above attacks in practical
proof-of-concept attacks against processors from Intel, ARM, and
AMD. For Spectre-PHT, all vendors have processors that are
vulnerable to all four variants of mistraining, they say.

For in-depth details about the new attacks, you can head on to
the research
paper^[7] titled, “A Systematic
Evaluation of Transient Execution Attacks and Defenses,” published
by the team of researchers today.

^[1]