If your computer is one of those which has an Intel CPUs released in recent years (it probably does) then there’s some big news on the security front.
As The Register reports, a newly-discovered design flaw has been found on Intel CPU hardware that could allow malicious code to access information supposedly held in “protected” areas of your computer’s memory.
Precise details of the security vulnerability - which is known variously as KPTI (Kernel Page Table Isolation), KAISER (Kernel Address Isolation to have Side-channels Efficiently Removed) and even F*CKWIT (Forcefully Unmap Complete Kernel With Interrupt Trampolines) - have not been made public, and with good reason.
The very real fear is that attackers could exploit the flaw on vulnerable systems to gain access to parts of the computer’s memory which may be storing sensitive information. Think passwords, private keys, credit card data…
Intel isn’t able to push out a firmware update to its chip. That means operating systems like Microsoft Windows, Linux, and Apple macOS, which relied upon Intel’s hardware to provide some of these essential security services, will have to push out their own low-level updates to do the job that they were previously relying upon Intel to do.
Meanwhile cloud services like Amazon EC2, Microsoft Azure, and Google Compute Engine are are also likely to be at risk and will need to be updated.
The good news is that it sounds as if this flaw has been known about (but kept quiet) for a couple of months, and major vendors have been working feverishly on fixes. You can expect the likes of Microsoft and Apple to start rolling out security updates as matter of priority before the flaw is maliciously exploited.
The bad news is that no-one likes to make such low level security updates, particularly under such time-sensitive conditions. Inevitably some businesses will find themselves disrupted by the process.
And going forward, the fact that the operating system has to do more because Intel chips have dropped the ball, may mean that some computer operations take a performance hit.
And few of us are rarely happy with our computers slowing down…
For more discussion on this topic, be sure to listen to this episode of the Smashing Security podcast: