Intel fixes high-severity CPU bug that causes “very strange behavior”

Intel on Tuesday pushed microcode updates to repair a high-severity CPU bug that has the potential to be maliciously exploited towards cloud-based hosts.

The flaw, affecting nearly all trendy Intel CPUs, causes them to “enter a glitch state where the normal rules don’t apply,” Tavis Ormandy, one in every of a number of safety researchers inside Google who found the bug, reported. Once triggered, the glitch state leads to sudden and probably severe conduct, most notably system crashes that happen even when untrusted code is executed inside a visitor account of a digital machine, which, below most cloud safety fashions, is assumed to be protected from such faults. Escalation of privileges can also be a chance.

Very unusual conduct

The bug, tracked below the widespread title Reptar and the designation CVE-2023-23583, is said to how affected CPUs handle prefixes, which change the conduct of directions despatched by operating software program. Intel x64 decoding typically permits redundant prefixes—which means those who don’t make sense in a given context—to be ignored with out consequence. During testing in August, Ormandy seen that the REX prefix was producing “unexpected results” when operating on Intel CPUs that help a more recent function often called quick brief repeat transfer, which was launched within the Ice Lake structure to repair microcoding bottlenecks.

The sudden conduct occurred when including the redundant rex.r prefixes to the FSRM-optimized rep mov operation. Ormandy wrote:

We noticed some very unusual conduct whereas testing. For instance, branches to sudden areas, unconditional branches being ignored and the processor now not precisely recording the instruction pointer in xsave or name directions.

Oddly, when attempting to know what was taking place we might see a debugger reporting unattainable states!

This already appeared prefer it could possibly be indicative of a significant issue, however inside a number of days of experimenting we discovered that when a number of cores had been triggering the identical bug, the processor would start to report machine verify exceptions and halt.

We verified this labored even inside an unprivileged visitor VM, so this already has severe safety implications for cloud suppliers. Naturally, we reported this to Intel as quickly as we confirmed this was a safety problem.

Jerry Bryant, Intel’s senior director of Incident Response & Security Communications, stated on Tuesday that firm engineers had been already conscious of a “functional bug” in older CPU platforms that would end in a short lived denial of service and had scheduled a repair for subsequent March. The severity score had tentatively been set at 5 out of a doable 10. Those plans had been disrupted following discoveries inside Intel and later inside Google. Bryant wrote:

Thanks to the diligence and experience of Intel safety researchers, a vector was later found that would permit a doable escalation of privilege (EoP). With an up to date CVSS 3.0 rating of 8.8 (excessive), this discovery modified our method to mitigating this problem for our prospects and we pulled the replace ahead to align with disclosures already deliberate for November 2023.

While making ready the February 2024 Intel Platform Update bundle for buyer validation, we acquired a report from a Google researcher for a similar TDoS problem found internally. The researcher cited a Google 90 day disclosure coverage and that they might go public on November 14, 2023.

Crisis (hopefully) averted

Intel’s official bulletin lists two courses of affected merchandise: those who had been already fastened and people which are fastened utilizing microcode updates launched Tuesday. Specifically, these merchandise have the brand new microcode replace:

An exhaustive checklist of affected CPUs is accessible right here. As common, the microcode updates can be out there from gadget or motherboard producers. While people aren’t prone to face any instant menace from this vulnerability, they need to verify with the producer for a repair.

People with experience in x86 instruction and decoding ought to learn Ormandy’s publish in its entirety. For everybody else, a very powerful takeaway is that this: “However, we simply don’t know if we can control the corruption precisely enough to achieve privilege escalation.” That means it’s not doable for individuals exterior of Intel to know the true extent of the vulnerability severity. That stated, anytime code operating inside a digital machine can crash the hypervisor the VM runs on, cloud suppliers like Google, Microsoft, Amazon, and others are going to instantly take discover.

In a separate publish, Google officers wrote:

The impression of this vulnerability is demonstrated when exploited by an attacker in a multi-tenant virtualized setting, because the exploit on a visitor machine causes the host machine to crash leading to a Denial of Service to different visitor machines operating on the identical host. Additionally, the vulnerability might probably result in data disclosure or privilege escalation.

The publish stated that Google labored with trade companions to determine and check profitable mitigations which were rolled out. It’s seemingly any potential disaster has now been averted, a minimum of within the greatest cloud environments. Smaller cloud companies should still have work to do.