More Spectre-style chip flaws discovered in Intel processors

More waves of patches to plug security holes in processors are on the way, after the discovery that Intel is working to patch more Spectre-style issues in its chips, with eight new vulnerabilities said to be found by security researchers following the Spectre and Meltdown fiasco from earlier this year.

Multiple research teams found the eight new security flaws in Intel's CPUs, reports german publication c't. It is claimed the discoveries are all caused by the same design-related issue, with each equipped with their own listing in the Common Vulnerability Enumerator (CVE) directory, and requiring their own patches.

As is typical for vulnerabilities, the researchers disclosed the issues to Intel, giving the chip producer time to create a patch before a public disclosure can occur. Google Project Zero, the search company's own research team, is said to be quite strict about its 90-day disclosure deadline, meaning the first official disclosure of one of the flaws could happen as soon as May 7.

According to the report, Intel is planning two waves of patches to fix the problems, with the first set to start in May while a second is scheduled for sometime in August. It is also believed Microsoft is preparing its own patches, offered as optional Windows updates, while Linux kernel developers working on their own mitigation measures.

Considering all current Mac ranges use Intel processors, it is highly likely Apple isn't affected by the problems, has patches ready, or is in the process of creating the software countermeasures.

From what is known about the vulnerabilities, Intel has classified four as "high risk," while the others are labeled as a "medium" risk. For seven of the vulnerabilities, the report claims the risks and potential attacks are similar in construction to those of Spectre.

The eighth vulnerability is apparently an exception, potentially posing a greater threat than Spectre itself, as it could allow an attacker to launch an exploit in a virtual machine (VM) as a way to attack the host system. Largely affecting enterprise, as well as some individual users who operate VMs privately, the vulnerability could also be used to attack other VM instances on the same server, and due to Intel's Software Guard Extensions (SGX) not being "Spectre-safe," it could also intercept passwords and keys transmitted between VM instances.

Intel has issued a statement ahead of the potential disclosures, effectively confirming the vulnerabilities exist. The company says it routinely works with other parties to "understand and mitigate any issues that are identified," that it strongly believes in the "value of co-ordinated disclosure," and reminds users to keep their systems up to date.

Revealed in January, the Meltdown and Spectre chip flaws in Intel and ARM-based processors allowed the creation of a number of exploits in systems using the components. All Mac and iOS devices were found to be affected by the issue, but Apple advised at the time it had already released mitigations for current operating system versions, and was working to develop other fixes.

In the following months, Intel became the subject of a number of lawsuits over the design flaws, including their effect on Intel's share price, and accusations that CEO Brian Krzanich allegedly sold shares worth millions of dollars after Intel was informed of the vulnerabilities, but before they were publicly disclosed.

Intel was also criticised for failing to notify U.S. cybersecurity officials of the flaws until after the public became aware of their existence.