Tech Companies Inform Customers About New CPU Vulnerability Akin to Spectre, Meltdown

Major tech companies Microsoft and Intel, with help from Google Project Zero, have simultaneously released information about a newly discovered CPU security flaw that is similar to the notorious Spectre and Meltdown vulnerabilities.

The companies confirmed Monday that they have discovered a new CPU issue now referred to as Speculative Store Bypass Variant 4.

Earlier this year, computer users were informed about Spectre and Meltdown and how they work. As a recap, these vulnerabilities practically allows CPU issues or attackers to bypass security walls in the CPU hardware. This means that once a computer is compromised, an issue may easily affect the entire system especially if necessary updates are not installed.

According to Intel general manager of Product Assurance and Security, Leslie Culbertson, the recently discovered Variant 4 “uses speculative execution” that can expose sensitive data “through a side channel.”

Same with Microsoft’s announcement, the company explained that Variant 4 works in the same nature as Meltdown and Spectre. “An attacker who has successfully exploited this vulnerability may be able to read privileged data across trust boundaries,” Microsoft said in a security advisory.

Variant 4 affects computers powered with AMD, ARM, and Intel processors.

On the other hand, Culbertson clarified that they have not yet received any report where this exploit has been utilized and the same goes for Microsoft. But both companies have also informed customers that the security issue may be applied on browsers, specifically on runtimes such as JavaScript.

Meanwhile, Microsoft assured its customers that necessary mitigations have already been deployed for Microsoft Edge, Internet Explorer and “other major browsers” to make it difficult for an attacker to exploit a system through a side channel.

At the moment, Intel promised that they have already taken necessary steps to help computer manufacturers in coming up with necessary patches for their customers. “We’ve already delivered the microcode update for Variant 4 in beta form to OEM system manufacturers and system software vendors,” Culbertson said.

These updates are expected to be released in the next few weeks.