Weird Security Flaw Affected Intel Chips for 16 Years

Aug 11, 2015

Better read this if you bought your computer before 2011

At the BlackHat conference in Las Vegas, Battelle security researcher Christopher Domas revealed a hidden security flaw that affected Intel processors for 16 years. The first flawed chips appeared in 1995, and the problem wasn't fixed until the 2011 crop of new processors that included the Sandy Bridge series.

The strange problem occurs at such a deep level of the hardware architecture that it is unstoppable and undetectable by the operating system. Intel processors have a privilege ring architecture that defines the level of privilege available to a process. As most developers and power users know, the kernel occupies Ring 0, usermode applications live at Ring 3, and device drivers fall somewhere in between. Far lesser known are the mysterious rings inside of Ring 0. Ring -1 is the hypervisor ring, which manages the operating systems running at Ring 0, and below that, the murky Ring -2 is home to Intel's System Management Mode software. This innermost ring is loaded by the system firmware, and it is effectively untouched by the rest of the system. The bug that affected Intel processors for 16 years allows privilege escalation code to run at Ring -2, where it was invisible to the rest of the system.

Users with older PCs should watch for more news on this problem, but it doesn't look like a quick fix will appear anytime soon, and now that the flaw has been published in the press, it is only a matter of time before intruders exploit it. Linux users better not bet on that natural security of Linux systems to get you through this one: The operating system is just another app when you're down in Ring -2.

Related content

  • Ring Secure Communication

    In the last few years, secure text, voice, and video transmission have become major areas of free software development. One of the leaders in this field is Ring.

    more »
  • News

    Dell kickstarts 2018 with a brand new Linux laptop, Linus Torvalds rips Intel for meltdown and Spectre flaws, LibreOffice-based CODE 3.0 released, Google announces Kubeflow to bring Kubernetes to machine learning, and a critical flaw in phpMyAdmin. 

    more »
  • Virtualizing Rootkits

    A new generation of rootkits avoids detection by virtualizing the compromised system – and the user doesn't notice a thing.

    more »
  • Meltdown and Spectre

    The blatant security holes known as Meltdown and Spectre, which are built into the computer hardware, are likely to keep us busy for the next few years. How is the Linux community addressing this unexpected challenge?

    more »
  • Xeon Phi

    The Xeon Phi accelerator card from Intel takes an unusual approach: Instead of GPUs, the Xeon Phi features a cluster of CPUs for easier programming.

    more »
comments powered by Disqus

Issue 38: 101 Cool Linux Hacks/Special Editions

Buy this issue as a PDF

Digital Issue: Price $15.99
(incl. VAT)

News

Tag Cloud

Administration Community Desktop Events Hardware Linux Linux Pro Magazine Mobile Programming Software Ubuntu Web Development Windows free software open source