Wednesday, May 22, 2024

Downfall Attack Enables Extraction of Passwords and Encryption Key From Intel Microprocessor

Gather Data Sampling (GDS) impacts select Intel CPUs, enabling attackers to deduce outdated data through malicious use of gather instructions. While all these entries link to the prior thread or sibling core registers.

Like MDS, GDS (Gather Data Sampling) enables local code execution to reveal protected secret data. GDS is different from MDS as it exposes only stale vector register data through specific gathering instructions, lacking user choice in suspected data.

Cybersecurity researcher Daniel Moghimi at Google recently crafted a ‘Downfall’ CPU attack that enables threat actors to extract the following data from Intel chips shared by users:- 

  • Passwords
  • Keys
  • Emails
  • Banking

Cybersecurity researchers tracked this vulnerability as CVE-2022-40982, and this flaw affects the Skylake to Ice Lake chips from Intel with transient execution side-channel issues.

Flaw profile

  • CVE ID: CVE-2022-40982
  • Description: Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to enable information disclosure via local access potentially.
  • CVSS Base Score: 6.5
  • Severity: MEDIUM
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Technical analysis

By exploiting this vulnerability, a threat actor can easily retrieve the protected sensitive data through Intel’s SGX, which segregates the code and memory.

Besides this, the SGX exclusively aids the server CPUs which enables it to establish a secure enclave that is inaccessible even by the OS itself.

Moreover, Daniel Moghimi revealed the exploitative nature of Downfall, under which this flaw exploits the gathered instructions for a speculative leak of vector register content.

Moghimi seized AES keys through GDS across VMs, even from cores’ sibling threads. In under 10s, 8 bytes at a time, the researcher fused stolen AES round keys to crack encryption.

However, apart from this, the researcher leveraged the undisclosed techniques in this scenario on powerful CPUs to breach data barriers between:-

  • User-kernel
  • Processes
  • VMs
  • Secure execution domains

Failed tries prompted repeated attacks, as the master key data was infrequent within 10 seconds. Moghimi offers diverse GDS attacks, snatching varied data due to specific SIMD buffer conditions.

Affected CPU families

Downfall needs attacker presence on the victim’s physical core, facilitated by current shared computing.

Local malware might exploit it, and besides this, Intel already acknowledged the flaw with Moghimi in August, issuing a microcode fix.

Vulnerability remained undisclosed for nearly a year, allowing OEMs and CSPs to validate fixes.

But, Intel affirms that Alder Lake, Raptor Lake, and Sapphire Rapids series were not affected, as the Downfall affects the following CPU families:-

  • Skylake
  • Cascade Lake
  • Cooper Lake
  • Amber Lake
  • Kaby Lake
  • Coffee Lake
  • Whiskey Lake
  • Comet Lake
  • Tiger Lake family
  • Ice Lake
  • Rocket Lake

In this case, to leak data, Daniel Moghimi exploited the REDACTED on high-performance REDACTED CPUs by breaching the user-kernel boundaries across systems.


Here below, we have mentioned all the recommendations from Intel:-

  • For enhanced security, Intel advises users of affected processors to install the latest firmware from their system manufacturer.
  • Intel suggests SGX users update platform flash microcode via firmware interface table.
  • Intel’s new microcode update prevents the attackers from observing gather instruction results.
  • To counter this flaw, an SGX TCB recovery is in the works.
  • Non-Intel (SGX) systems can apply microcode fixes via OS loading.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.


Latest articles

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...

DoppelGänger Attack: Malware Routed Via News Websites And Social Media

A Russian influence campaign, DoppelGänger, leverages fake news websites (typosquatted and independent) to spread...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles