CVE-2022-40982

lastmod 2023-08-11created 2023-08-112 edits

Downfall attack - a new Meltdown vulnerability in Intel CPUs

Features

• Daniel Moghimi, a senior researcher at Google, disclosed the Downfall vulnerability (CVE-2022-40982), which affects 6th to 11th generation Intel CPUs.
• A data leak in a memory optimization technique of Intel CPUs allows untrusted processes to access other memory.
  • The Gather instruction, used to quickly access data scattered across memory, leaks the contents of the internal vector register file during speculative execution.
  • To exploit this, introduced the GDS (Gather Data Sampling) and GVI (Gather Value Injection) techniques.
• Released demos that steal other users' encryption keys or extract kernel data in a Linux environment.
  • The GDS technique in particular is very effective; a PoC attack stealing keys from OpenSSL succeeded within two weeks.
• This vulnerability can bypass not only typical virtual machine and user-kernel isolation but also the hardware security technology Intel SGX.
  • In theory, the Downfall attack can also be run from a web browser, but further research is needed.
  • Also, the Downfall attack looks similar to ordinary programs, making it very hard to detect, and commercial antivirus software cannot detect it.
• The vulnerability was shared with Intel on August 24, 2022, and Intel is preparing updates to mitigate it.
  • However, up to 50% overhead may occur.
• PoC code is also public.

See also

• Information Security
• Security vulnerability (Vulnerability)
• Common Vulnerabilities and Exposures (CVE)
• Intel
• Meltdown

Favorite site

• Downfall
• downfall/POC at main · flowyroll/downfall