Intel CPU-ovi budući da je Haswell ranjiv na napade 'Zombieload v2', uključeno i 'Cascade Lake'


All Intel CPU microarchitectures since 2013 are vulnerable to a new class of 'Zombieload,' attacks, chronicled under 'Zombieload v2' (CVE-2019-11135). This is the fifth kind of microarchitectural data sampling (MDS) vulnerability, besides the four already disclosed and patched against in Q2-2019. The vulnerability was kept secret by the people who discovered it, as Intel was yet to develop a mitigation against it. There is no silicon-level hardening against it, and Intel has released a firmware-level mitigation that will be distributed by motherboard manufacturers as BIOS updates, or perhaps even OS vendors. While Intel's latest enterprise and HEDT microarchitecture, 'Cascade Lake' was thought to be immune to 'Zombieload,' it's being reported that 'Zombieload v2' attacks can still compromise a 'Cascade Lake' based server or HEDT that isn't patched.

'Zombieload v2' je iskorištavanje operacije asinhronog prekida transakcijskih proširenja transakcijske sinkronizacije (TSX), koje se događa kada zlonamjerni softver stvara operativne sukobe čitanja unutar CPU-a. To navodno pušta podatke o tome što se još obrađuje. 'Glavna prednost ovog pristupa je da djeluje i na strojevima s hardverskim ispravkama za Meltdown, koje smo provjerili na i9-9900K i Xeon Gold 5218', piše u najnovijoj verziji Zombieload whitepaper-a koji je ažuriran sa 'Zombieload v2' informacija. TSX je preduvjet za 'Zombieload v2' i sve Intelove mikroarhitekture otkad je 'Haswell' opremljen. AMD-ovi procesori su inherentno imuni na 'Zombieload v2' jer im nedostaje TSX. Intel je ipak umanjio ozbiljnost ili učestalost 'Zombieload v2', ali je ipak poslao ažuriranja mikro kodova označenih 'kritičnim'.
Source: ZDNet