Yeah, not exactly the most fun pun, but this is a spoiler alert. The vulnerability was given the name Spoiler and was discovered by the Worcester Polytechnic Institute and the University of Lübeck. it involves a leak in page mapping of working memory, making other attacks much easier to perform.
To perform tasks faster, speculative execution is applied to processes in working memory. In this case, data from the working memory is already cached in advance with so-called load and store instructions. However, if a physical memory address does not exist, data leaks away over the timing - the time it took to reach a physical memory address. The researchers mention , Rowhammer, cache and javascript attacks can be executed in merely seconds.
-- The Register --
This security shortcoming can be potentially exploited by malicious JavaScript within a web browser tab, or malware running on a system, or rogue logged-in users, to extract passwords, keys, and other data from memory. An attacker therefore requires some kind of foothold in your machine in order to pull this off. The vulnerability, it appears, cannot be easily fixed or mitigated without significant redesign work at the silicon level.
Speculative execution, the practice of allowing processors to perform future work that may or may not be needed while they await the completion of other computations, is what enabled the Spectre vulnerabilities revealed early last year.
In a research paper distributed this month through pre-print service ArXiv, "SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks," computer scientists at Worcester Polytechnic Institute in the US, and the University of Lübeck in Germany, describe a new way to abuse the performance boost.
Intel has was notified of the problem on December 1st. According to the researchers, a solution via a software update is virtually impossible and can only be remedied with an adjustment in architecture. If this is done, it will undoubtedly lead to lower performance. Whether there is a solution is very doubtful.
Arm and AMD processors are not vulnerable to this attack.
