Recently, Intel issued a notice regarding the assignment of an official identifier for the Spoiler vulnerability. The Spoiler vulnerability became known a month ago following a report from specialists at Worcester Polytechnic Institute in Massachusetts and the University of Lübeck (Germany). For those seeking solace, in vulnerability databases, Spoiler will be referred to as CVE-2019-0162. For pessimists, it's worth noting that Intel does not plan to release patches to mitigate the risk of attacks using CVE-2019-0162. According to the company, standard measures against side-channel attacks can protect against Spoiler.
It is important to note that the Spoiler vulnerability (CVE-2019-0162) by itself does not allow for unauthorized access to sensitive user data. It is merely a tool that amplifies and makes more likely the exploitation of the long-known Rowhammer vulnerability. This attack is a type of side-channel attack targeting DDR3 memory with ECC (Error Correction Code). It is also possible that DDR4 memory with ECC is susceptible to the Rowhammer vulnerability, but this has not yet been confirmed experimentally. In any case, if we've missed anything, there have been no reports regarding this.
Using Spoiler, one can correlate virtual addresses with physical memory addresses. In other words, it helps identify which specific memory cells to target with Rowhammer in order to overwrite data in physical memory. Altering just three bits of data in memory simultaneously bypasses ECC and gives an attacker a degree of freedom. Access to the address mapping requires access to the computer at a non-privileged user level. This circumstance lowers the risk posed by Spoiler, but does not eliminate it. Experts estimate the risk of Spoiler to be 3.8 out of 10.
All Intel Core processors, from the first generation onward, are vulnerable to Spoiler vulnerabilities. Changing the microcode to address it would lead to a significant drop in processor performance. "After thorough study, Intel determined that the existing protection mechanism, KPTI [kernel memory isolation], reduces the risk of data leaks through privileged levels. Intel recommends that users adhere to standard practices to mitigate the exploitation of such vulnerabilities [in side-channel attacks]."
Source: 3dnews.ru
