They discover a new vulnerability in Intel and AMD processors called SWAPGS, which can only be exploited locally.
Vulnerabilities in processors at the microarchitecture level are only just beginning to surface. Spectre and Meltdown have been the most serious, primarily affecting Intel, although AMD and ARM have also been impacted. Now, a new variant of Spectre has been discovered. This new vulnerability exploits speculative execution to send unexpected SWAPGS instructions to obtain system data.
Specter has been a real headache for Intel, who fixed it, theoretically, on the Coffee Lake and Coffee Lake Refresh processors. The new vulnerability has been christened CVE-2019-1125. This vulnerability does not make distinctions, affecting Intel and AMD processors interchangeably.
New SWAPGS vulnerability affecting Intel and AMD processors
By attacking speculative execution, the vulnerability allows an unprivileged local attacker to access sensitive information. The attackers would be able to access the kernel memory and obtain passwords, tokens, encryption keys, etc.
Currently speculative execution is essential in all modern processors and in their design. It basically offers:
- The processor executes instructions based on possibly true assumptions
- If the assumption is valid, execution continues
- If the assumption is invalid, the execution is discarded
We have learned about this vulnerability thanks to the security part 'Patch Tuesday' released by Microsoft in July 2019. Bitdefender has analyzed and broken down the update, revealing the problem. It will undoubtedly be a new headache for Intel and another also for AMD.
Bitdefender also sure that this vulnerability exceeds the patches created for Specter and Meltdown. The positive part of this vulnerability is that it can only be executed locally, and cannot be exploited remotely. Basically it could be used to attack users on a local network, but not access from outside the network.
Intel highlights that SWAPGS attacks break the 'Kernel Page-Table Isolation' of modern processors. SWAPGS statements have privilege statements in the system that change GS records to MSR values. Some instructions only present in x86-64 architecture processors.
Linux does not get rid of this vulnerability, which also affects it. In spite of everything, SWAPGS researchers emphasize that Linux is a somewhat more secure platform.
AMD has said that its processors are safe as they do not rely on speculative execution. That doesn't make them immune to vulnerability. Researchers have said that they continue to analyze it, to verify if they are vulnerable or not.
