Friday, November 1, 2024
HomeVulnerabilityIntel Paid $100,000 Reward to Researchers who Discovered Spectre 1.1, 1.2 CPU...

Intel Paid $100,000 Reward to Researchers who Discovered Spectre 1.1, 1.2 CPU Level Vulnerability

Published on

Malware protection

Intel rewarded $100,000 for two security researchers to find the CPU Spectre level critical vulnerability which leads to leak confidential information through microarchitectural side channels.

Newly discovered spectre level vulnerabilities are catogorised as Spectre 1.1, a new Spectre-v1 and Spectre 1.2.

Previously discovered highly critical vulnerabilities Spectre and Meltdown have been made a huge impact in IT sectors and the attack works on mobile devices, personal computers and cloud infrastructure depends on the cloud providers.

- Advertisement - SIEM as a Service

Spectre and Meltdown flaw allow an attacker to steal the data that currently processed on the computer it includes the process of personal photos, Emails, Password manager, instant messages and sensitive documents.

Same as old spectre vulnerabilities, These 2 Spectre 1.1, Spectre 1.2 also affect the CPU which leads to excute the malicious process and take over the previously secured CPU memory.

Both of the attacks leverage the “speculative execution” technique which is used by most modern CPUs to optimize performance.

Spectre 1.1

Newly discovered Spectre 1.1(Bounds check bypass CVE-2017-5753) create speculative buffer overflows by leverages speculative stores. same as traditional buffer overflow, it  can modify data and code pointers.

In this case reserarchers said Data-value attacks can bypass some Spectre-v1 mitigations, either directly or by redirecting control flow.

Attacker can ale to  perform arbitrary speculative code execution using Control-flow attacks and also it bypass the mitigation that was applied on precious speculative-execution attacks in Spectre 1.0.

Intel and ARM has been acknowledged for their vulnerable CPU’S and the AMD didn’t release any statment in this regards.

Spectre 1.2

Researchers said, Spectre1.2(Bounds check bypass on stores – CVE-2018-3693) vulnerability allow to by the read-only Protection and , speculative stores are allowed to overwrite read-only data, code pointers, and code metadata, including vtables.

Also the issue could be exploited by an attacker to bypass the Read/Write PTE flags and write code directly in read-only data memory.

According to the Researchers, We advise users to refer to more user-friendly vendor recommendations for mitigations against speculative buffer overflows or available patches.

MicrosoftRed Hat, Oracle have released security advisories, confirming that they are investigating the issues and potential effects.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to...

New Windows Downgrade Attack Let Hackers Downgrade Patched Systems To Exploits

The researcher discovered a vulnerability in the Windows Update process that allowed them to...

Hackers Use Fog Ransomware To Attack SonicWall VPNs And Breach Corporate Networks

Recent cyberattacks involving Akira and Fog threat actors have targeted various industries, exploiting a...