Rewterz Threat Advisory – SplitSpectre, a new Spectre-like CPU attack

A new variation of the Spectre CPU vulnerability has been discovered, that can be exploited via browser-based code.

IMPACT:  NORMAL

PUBLISH DATE:  05-December-2018

OVERVIEW

A new variation of the Spectre-CPU vulnerability is discovered which can be exploited via a browser-based code. Named as SplitSpectre, the flaw can be used to exploit CPUs that have not been updated against the original Spectre vulnerability.

CPUs that are updated against Spectre are also immune to this new variant.

ANALYSIS

A design flaw in the microarchitecture of modern processors can be exploited by attacking the process of “speculative execution,” which is an optimization technique used to improve CPU performance.

Dubbed as ‘SplitSpectre’, the new flaw is a variation of the original Spectre v1 vulnerability that splits the Spectre v1 gadget into two parts, making the attack far easier than the original.

This enhanced exploitation technique involving a browser-based code can be executed within the attacker’s own malicious code, instead of the target’s kernel, thereby making the exploit simpler, researchers said.

The variant differs from the original vulnerability in the sense that it splits the original technique and technically extends the length of the speculative execution window, buying more time for the attacker. The difference also lies not in the compromised part of CPUs, but how the attack is carried out.

Speculative execution attacks exploit vulnerabilities at a CPU’s microarchitectural level.

Therefore, to analyze the microarchitectural level of CPUs, researchers are releasing a new tool called SPECULATOR. It’ll investigate speculative execution behavior critical to these new microarchitectural attacks.

AFFECTED PRODUCTS

The researchers that discovered the flaw launched successful attack on Intel Haswell and Skylake CPUs, and AMD Ryzen processors, using SpiderMonkey 52.7.4, Firefox’s JavaScript engine.

The systems that have been immunized against the original Spectre vulnerability are also immune to SplitSpectre. However, systems that have still not been updated against the Spectre can also be exploited by SplitSpectre.

MITIGATIONS

Researchers informed that the existing Spectre mitigations would thwart the SplitSpectre attacks as well.

Therefore, all users must have the following updates in their systems:

• CPU microcode updates.
• Updates to popular code compilers to immunize apps against Spectre-like attacks.
• The browser-level modifications released by browser vendors after January 2018.

Users failing to install these updates may fall victim to a SplitSpectre attack.

If you think you’re the victim of a cyber-attack, immediately send an e-mail to soc@rewterz.com.