What are the Foreshadow/ L1TF exploits? Which chips are affected? How to secure your systems.
New exploits have been discovered for modern Intel chips that allow an attacker to bypass protections and harvest sensitive information.
Like the Spectre and Meltdown exploits earlier this year, the new L1TF / Foreshadow vulnerabilities allow for a form of speculative execution attack. Unlike those earlier exploits, these affect modern chips with SGX architecture extensions, designed to protect data and applications from interference.
The vulnerabilties allow data to be read from an area of fast memory known as the L1 cache, which is available to each processor core. An attacker could use the exploits to read any data held in the cache, including protected information belonging to the System Management Mode (SMM), the operating system's kernel, or to other virtual machines (VMs) running on third-party clouds.
In theory, the exploits could be used to steal information from virtual machines running on public or private clouds, as they allow a malicious VM running on the cloud to read memory belonging to the VM's hypervisor or memory belonging to another guest VM. However, for an attack to be successful, the VMs would need to be running on the same processor core.
As pointed out by TechRepublic's sister site ZDNet, despite the attacker needing to have the ability to run code on the targeted systems to make use of the exploits, the vulnerabilities are serious enough to merit patching immediately, all rating higher than 7 on the Common Vulnerability Scoring System (CVSS).
The exploits have also been used to compromise the protections offered by Software Guard Extensions (SGX). SGX is designed to store data and applications within a secure section of memory, an "enclave" protected from modification or inspection. However, Foreshadow can be used to extract the attestation keys used to verify the identity of a secure SGX enclave, allowing an attacker to trick the system into designating an insecure portion of memory as being secured by SGX.
Which processors are vulnerable?
All SGX-enabled Core processors, Skylake and Kaby Lake, while Atom family processors with SGX support remain unaffected.
Affected processors include:
Intel Core i3/i5/i7/M processor (45nm and 32nm)
2nd/3rd/4th/5th/6th/7th/8th generation Intel Core processors
Intel Core X-series Processor Family for Intel X99 and X299 platforms
Intel Xeon processor 3400/3600/5500/5600/6500/7500 series
Intel Xeon Processor E3 v1/v2/v3/v4/v5/v6 Family
Intel Xeon Processor E5 v1/v2/v3/v4 Family
Intel Xeon Processor E7 v1/v2/v3/v4 Family
Intel Xeon Processor Scalable Family
Intel Xeon Processor D (1500, 2100)
More details on affected Intel processors are available here. Security researchers say they are unaware of the exploits affecting Arm and AMD chips.
How can you protect yourself?
While the microcode updates released by Intel earlier this year to patch the Spectre and Meltdown exploits go some way towards neutralizing attacks, PC owners and sysadmins will need to install additional patches from OS and virtualization vendors. In some situations, further steps will need to be taken, such as disabling Hyper-Threading, which will significantly reduce the chip's performance. This is most likely to be necessary in a traditional enterprise environment running untrusted guest virtual machines, according to Red Hat.
Microsoft has updated Windows clients with its ADV180018 fix, delivered as part of the first patch Tuesday of August 2018.
However, due to the complexities of mitigating the exploits in virtual environments, those using the Hyper-V hypervisor or admins of Windows Server may need to take additional steps to safeguard affected machines, outlined in a technical briefing here.
Microsoft says it has mitigated L1TF for Hyper-V on its Azure cloud platform using HyperClear, which it claims has "relatively negligible performance impact" and that is also available for Windows Server 2016 and later.
Oracle has released security patches for Oracle Linux 7, Oracle Linux 6 and Oracle VM Server for X86 products. In addition to OS patches, Oracle is advising customers to run the current version of the Intel microcode. Oracle Linux customers can use Oracle Ksplice to apply these updates without needing to reboot their systems.
Oracle says it's working to implement the "necessary mitigations" to protect customers across "all Oracle Cloud offerings", with its priority being to protect against "tenant-to-tenant attacks".
Red Hat outlines which versions of its OS are affected here, alongside links to the latest updates. As well as applying these fixes, Red Hat says "customers desiring to completely mitigate this issue will need to consider more securely managing and possibly disabling Hyper-Threading to close off all attack vectors".
Google Cloud Platform
Google says it has updated its Cloud Platform to reduce the risk from L1TF exploits for "the majority" of users but recommends updating guest operating systems to reduce risks. Outside of the core Google Cloud Infrastructure however, Google is recommending customers of various Google Cloud Platform services -- from Google App Engine Flexible Environments to Google Cloud Composer -- take additional steps to protect themselves, which are outlined here.
Amazon Web Services (AWS)
AWS says it has "designed and implemented its infrastructure with protections against these types of attacks, and has also deployed additional protections for L1TF", adding "all EC2 host infrastructure has been updated with these new protections, and no customer action is required at the infrastructure level".
However, it says an updated kernel is available for Amazon Linux, ALAS-2018-1058, and recommends that customers use the stronger security and isolation properties of EC2 instances to separate any untrusted workloads.
The big takeaways for tech leaders:
- Intel has revealed a range of its modern processors are affected by new Foreshadow vulnerabilities that could allow sensitive data to be stolen.
- The vulnerabilities pose a particular risk to data handled by cloud platforms due to the possibility of virtual machines being able to read data from other VMs on the host machine.