This is not good. A new vulnerability in numerous generations of Intel CPUs has been named “Downfall” by Daniel Moghimi, a security specialist at Google. Attackers can take advantage of the vulnerability to access data, such as login information, from other applications and memory areas. The bug was already identified as CVE-2022-40982, and Intel provided confirmation of it here.
So, what exactly is the Intel ‘Downfall’ vulnerability, and how many CPUs could be affected?
The Intel ‘Downfall’ Vulnerability Is Critical
On a dedicated Intel ‘Downfall’ website, Moghimi provides a thorough explanation of the vulnerability, along with various examples. He claims that the impacted Intel CPUs, which are found in both personal PCs and cloud servers, number in the billions, and offers the following probable effects of the gap:
“This vulnerability, identified as CVE-2022-40982, enables a user to access and steal data from other users who share the same computer. For instance, a malicious app obtained from an app store could use the Downfall attack to steal sensitive information like passwords, encryption keys, and private data such as banking details, personal emails, and messages. Similarly, in cloud computing environments, a malicious customer could exploit the Downfall vulnerability to steal data and credentials from other customers who share the same cloud computer.”
While you should visit the Intel ‘Downfall’ website for further details, Moghimi continues with a high-level summary of the problem:
“The vulnerability is caused by memory optimization features in Intel processors that unintentionally reveal internal hardware registers to software. This allows untrusted software to access data stored by other programs, which should not be normally be accessible.”
How To Protect Yourself From The Intel ‘Downfall’ Vulnerability
To address the security vulnerability, Intel has already started to provide microcode patches. The business advises owners of vulnerable Intel Processors to update to the most recent firmware offered by the system manufacturer, which fixes these problems.
However, as Moghimi cautions, in some cases this might result in a performance reduction of up to 50%. Here is Intel’s response to the negative impact of the microcode upgrades.
Performance reductions of up to 39% were seen in some server and ray tracing workloads during the first independent testing of the mitigation microcode by the specialized Linux website, Phoronix. Although there is a way to choose not to install the patch, Intel states that most consumer software shouldn’t be significantly impacted, with the exception of workloads for image and video editing.
Which Intel CPUs Are Affected?
Customers can find the vulnerability in any PC or laptop with an Intel Core processor from the sixth “Skylake” generation, to the eleventh-generation “Tiger Lake” chips. This indicates that the flaw has been there since at least 2015, when Skylake was introduced.
Corresponding Xeon CPUs from Intel are likewise susceptible to failure. Because of Intel’s dominance in server CPUs, almost every internet user might be affected, at least indirectly.
Here is a list of all the impacted CPUs provided by Intel. This PDF contains a thorough technical examination by Daniel Moghimi himself.
The more recent 12th and 13th generation Core CPUs from Intel are unaffected.
If you’d like to learn more about how to mitigate the risks associated with the Intel ‘Downfall’ vulnerability, contact us by calling (502) 240-044 or emailing info@mirazon.com.