Intel has patched a vulnerability in processors released since 2015, known as Downfall. It could allow attackers to bypass system barriers designed to protect data, potentially giving them access to sensitive information, even passwords and encryption keys, writes Wired.
The vulnerability was discovered by Google researcher Daniel Mogimi, who found a flaw in the chip’s code that uses an instruction called Gather, which is designed to quickly access distributed data in memory. Intel named the flaw Gather Data Sampling, after one of the methods Mogimi used to access information through the processor. The researcher presented his findings at the Black Hat 2023 security conference taking place these days in Las Vegas.
Chips affected by this vulnerability include the Skylake family (manufactured from 2015 to 2019), the Tiger Lake family (introduced in 2020 and scheduled to be discontinued early next year), and the Ice Lake family (introduced in 2019 and largely discontinued in 2021). Intel’s latest generation processors, such as the Alder Lake, Raptor Lake, and Sapphire Rapids families, are not vulnerable due to recent security measures implemented by Intel.
Intel has announced a fix for the Downfall vulnerability, but with the option to disable the patch. This is due to concerns that the patch could significantly impact performance, especially for certain corporate users.
Implementing patches for such vulnerabilities is a complex process. Typically, they must be integrated by each manufacturer of devices that use the respective processors before the changes are made available to end users. While Intel has simplified this process in recent years, it is still labor intensive. It’s worth noting that Mogimi reported the Downfall vulnerability to Intel a year ago.