A software engineer from AWS found a new vulnerability in existing Intel CPUs that allows attackers to extract data from the cache. The attack, described as Snoop-assisted L1 Data Sampling (Snoop for short) would work on a significant set of processors of the American company.
Pawel Wieczorkiewicz, who works for AWS, found the vulnerability and suggested to Intel that it was possible to gain access to the cache of CPUs, after which the tech manufacturer started looking into the problem. Amazon Web Services’ software engineer did, however, indicate that it was only possible to carry out the attack under very specific circumstances and that the amount of data captured was very small; not a large prize like with the Spectre and Meltdown vulnerabilities.
Intel then indicated that it does not see the snoop attack as a practical method of data capture, due to the rare circumstances mentioned by Wieczorkiewicz. In addition, the chip manufacturer believed that installing previously released patches, the Foreshadow L1TF patches, should fix the vulnerability. These patches were released by Intel at the end of 2018.
A list published by Intel shows which processors need the patches, as that is where the vulnerability would be located. According to Intel, the newer generations of chips (from the sixth generation of Intel Cores) are not vulnerable to the new snoop method.
20 minutes ago
