CPU security vulnerabilities pose broad-spectrum issues
Meltdown and Spectre side-channel vulnerabilities threaten most computer microprocessors and operating systems—including portable devices, and potentially industrial control systems exposed to the Internet.
The United States Computer Emergency Readiness Team (US-CERT) reports several CPU hardware implementations are vulnerable to side-channel attacks, being referred to as Meltdown and Spectre (also KAISER and KPTI).
As this is an actual hardware problem related to CPU architecture design, the only real solution is to replace affected CPU chips with corrected architectures. Estimates in the popular news are suggesting that as many as 1.5 billion computers are affected worldwide.
There has been discussion about the problem in the industry for several months, but only recently has the issue come to public attention.
Meanwhile, workarounds to mitigate the hardware issues are being created in operating system software and will be available as updates by the operating system (OS) providers in a short period of time.
The problem, if left uncorrected, can allow an attacker to execute code with user privileges, which can have various impacts, for example, reading otherwise protected kernel memory and bypassing KASLR (Kernel Address Space Layout Randomization).
According to Google’s Project Zero, CPU data cache timing can be abused to leak information out of “mis-speculated execution,” leading to (worst case) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts.
Multiple CPUs and OS architectures are affected and include AMD, Apple, ARM, Google, Intel, Linux Kernel, Microsoft and Mozilla. Virtually no computer is unaffected (including tablets and phones), and this includes servers running any of these microprocessors and operating systems, and most likely industrial control platforms running on the same hardware/OS platforms. Some news sources are suggesting that chips dating back to 1995 are affected by the architectural design issue.
At this time US-CERT is unaware of any active exploitation, and will provide more information as it becomes available.
In terms of industrial control systems, best advice is to monitor the ICS-CERT Industrial Control Systems Cyber Emergency Response Team web page and vendors of programmable controllers, automation systems, distributed control systems and other microprocessor-based equipment that may be vulnerable by being exposed to the Internet.
Recent Articles by Wayne Labs
