Chipmaker Intel is facing yet another security issue concerning its central processing units (CPUs) which are used in data centers. TechSpot reported that the Load Value Injection (LVI) is a vulnerability that is present in x86 silicon present in millions of chips across the globe.
Bitdefender and an academic research team led by Jo Van Bulck worked together to understand the LVI attack method. Cited by TechSpot, the analysis deemed that this new vulnerability is potentially more dangerous compared to previous attacks encountered by the chip company.
According to the report, LVI is “part of a new class of attacks on Intel CPU’s speculative execution.” The attack exploits Intel’s CPU features, which allows systems to optimize performance through predicting future instructions, creating a set of results and discarding wrong ones, while using the correct prediction.
With LVI, attackers can access information used by the system to predict users’ instructions. According to the TechSpot report, malicious parties can “get [users’] CPU to spit out the bits of data that should technically be securely stored through Intel’s Software Guard Extensions (SGX).”
SGX is a protocol utilized by any application that uses digital rights management, passwords and encryption keys to executed codes and store data in an isolated environment. This means that systems that have OS or firmware security flaws can rely on SGX to prevent info leaks.
However, LVI was able to override SGX’s function by injecting malicious data into the CPU’s protective measures. This allows attackers to access information used by applications.
Not the first time
The LVI issue is not the first major vulnerability faced by the chipmaker. Back in 2018, Intel addressed the so-called Meltdown and Spectre attacks. For Meltdown, hackers were able to access memory that should have been inaccessible in theory. On the other hand, Spectre allowed attackers to compromise the system by allowing unauthorized execution of codes, including malicious ones.
The analysis stated that LVI works like Meltdown but in reverse.
Intel has been aware of the vulnerability for a year before it was publicized. Van Bulck’s team composed of computer scientists from Austria, the United States, and Australia discovered the problem last year. They informed the chipmaker and gave the company one year to address the issue.
Despite the publicization of the vulnerability, TechSpot noted that “Intel is downplaying the severity of LVI due to the sophistication level required to perform such an attack.” While Bitdefender’s stance is in line with Intel’s, Vin Bulck’s team warns that a successful hack can compromise millions of data, especially if hackers target data centers.
