Intel chip flaws could wreak havoc on the cloud

Published 12:00 am Thursday, August 16, 2018

More flaws found in Intel chips could let hackers access sensitive information in computers or in the cloud.

Researchers found a vulnerability in January and reported it to Intel. The Silicon Valley chip giant then found two related flaws, and on Tuesday announced it is releasing patches to the flaws similar to Spectre and Meltdown. Those flaws, disclosed at the beginning of the year, affected most computers around the world.

The newly disclosed flaws, dubbed Foreshadow and Foreshadow-NG, were discovered in Intel’s Core and Zeon processors released after 2015, and could affect computers running virtualization technology on the same third-party cloud. Cloud-service providers Amazon, Microsoft, Google, Oracle and VMWare on Tuesday outlined steps they’re taking to address the issue.

Intel said in a statement through a spokeswoman Wednesday that the flaws were “addressed by microcode updates released earlier this year, coupled with corresponding updates to operating system and hypervisor software” that are rolling out now.

The company also said the risk to computers not running virtualized operating systems is low, and that the flaw is hard to exploit.

“We are not aware of reports that any of these methods have been used in real-world exploits, but this further underscores the need for everyone to adhere to security best practices,” Leslie Culbertson, executive vice president and general manager of Product Assurance and Security at Intel, said in a blog post.

Researchers who discovered the flaw — from KU Leuven University in Belgium, the University of Adelaide and the University of Michigan — presented their findings Wednesday at a security conference.

The researchers and Intel are urging computer users to download security updates.

AMD said Tuesday its chips are not vulnerable to the Foreshadow flaw. Intel’s list of all affected chips can be found on its website.

Marketplace