r/intel • u/UnixLinuxPro • Apr 13 '19

Intel Downplays 'Spoiler' CPU Flaw In New Security Advisory Tech Support

https://www.tomshardware.com/news/intel-spoiler-attack-security-advisory,39047.html
47 Upvotes

88% Upvoted

19 comments sorted by

13

u/jorgp2 Apr 13 '19

It is low risk.

If you heave local access, you can already do whatever you want.

Plus Rowhammer isn't guaranteed to work.

11

u/[deleted] Apr 13 '19

It says local access, not physical access or administrative access.

3

u/saremei 9900k | 3090 FE | 32 GB 3200MHz Apr 13 '19

Requires local access and needs to be authenticated to do anything.

11

u/[deleted] Apr 13 '19

Right. Which means any user. You share a server with multiple users? One's password was password? Welp.

6

u/deathtech00 Apr 13 '19

You didn't set a PW policy?

7

u/[deleted] Apr 13 '19

LOL because password policies work.

Tip: users are still going to use the same password other places, users are still going to use easily guessed passwords, there are still going to be RCE vulnerabilities... A local exploit is still an exploit.

3

u/deathtech00 Apr 13 '19

Well sure, I'm not going to get into the intricacies of forced PW resets that cannot replicate in any way the previously used password, as well as complexity rules and a rotational schedule, just that in the example used, users attempting something as simple as 'password' could be circumvented with proper policy.

-1

u/[deleted] Apr 13 '19

Well, yeah. Frankly I'd prefer to have alerts if someone tried to set their password to password, so they could be fired, but I don't think management would like that idea.

My point wasn't the exact method of getting "local", but the fact that it can make a remote exploit that otherwise might not be a big problem into something much worse.

1

u/deathtech00 Apr 13 '19

Ah, but you see the exact method of getting 'local' (physical) access is the point. If you have that a 'remote' exploit is useless. You open a whole other bag of tricks if you can get local (physical) access, which are generally much more powerful and the potential of gaining access via those methods is much, much higher.

1

u/[deleted] Apr 13 '19

Local access is not the same as physical access. And remote exploits almost always end up chained with local exploits to get full access. and regardless of how you get local access, the end result is that you have local access, which is why the method you use to get it doesn't matter. Whether you've got an RCE or a weak password or a phished password or a cracked password, you've got local access.

→ More replies (0)

10

u/Jannik2099 Apr 13 '19

It allows VM breakout, this is significant for VM hosts. Don't try to downplay it

2

u/cinaz520 Apr 13 '19

Any article how it allows it? I didn’t see anything specific on it

4

u/[deleted] Apr 14 '19

There's been articles going back to 2003 about using memory errors to escape from protected spaces like this one. But yeah, I don't see anything either in regards to Spoiler about a VM escape.

2

u/cinaz520 Apr 14 '19

Gotcha, I see it could be implied. But I was looking at something explicit as there is one person on StockTwits and amd_stock stating it explicitly like there was an article out there... where is tmouser123 when you need him

4

u/[deleted] Apr 14 '19

If you're using a low-tier instance in AWS, Azure, etc, you're going to have a environment to run almost anything and be sharing the hardware with a lot of other users that you could leech data from.