Four recent cases of CPU bugs point to billions of potential hacker attacks in future, that will trivialize the CrowdStrike outage
Intel is currently facing some market heat as its 13th/14th processors have been reported to be unstable due to the excessive voltage applied by the stock boosting algorithm. Even gaming servers using enterprise-grade motherboards and high-performance 13th/14th gen CPUS have been crashing alarmingly, according to news reports.
Similarly, a vulnerability in AMD processors has remained undetected for almost 20 years, until now. Dubbed Sinkclose (aka CVE-2023-31315, CVSS score: 7.5), the bug allows hackers and rogue users with access to the operating system kernel to run code in a privileged execution environment called System Management Mode present in x86-based processors.
Now, researchers from Germany’s CISPA Helmholtz Center for Information Security has disclosed a bug that affects Chinese chip maker T-Head’s XuanTie C910 and C920 processors that could allow attackers to gain unrestricted access to susceptible devices.
The faulty instructions, embedded in the processor hardware, can operate directly on physical memory rather than virtual memory, and thus bypass the process isolation normally enforced by the operating system and hardware. This vulnerability could be weaponized to circumvent security and isolation features, conferring hackers unrestricted access to the device.
Users have a choice to disable the vulnerable instructions, but that will cripple the CPU performance, especially in parallel processing tasks and workloads involving large data sets. This means the fix cannot be accepted as a long-term solution to the problem.
In the case of the Intel 13th/14th gen overheating/overvoltage issue, a microcode patch issued early this month by the firm could be an interim solution to underclock the processors to regain some stability. However, whatever damage that has already been inflicted in some severe overheating cases still need to be addressed under warranty coverage.
For AMD, the bug can be patched via a BIOS firmware update or a hot-loadable microcode update. However, the firm will only patch processors made in 2020 and after.
Finally, Qualcomm’s Adreno GPU had recently been found to contain more than nine flaws that could permit local access to a device to achieve privilege escalation and code execution at the kernel level. The vulnerabilities (CVE-2024-23350, CVE-2024-21481, CVE-2024-23352 and CVE-2024-23353) are being addressed by patches distributed at the device manufacturer level.
