{"id":10061,"date":"2018-01-04T05:35:01","date_gmt":"2018-01-04T10:35:01","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/copy-of-two-severe-vulnerabilities-found-in-intels-hardware\/10061\/"},"modified":"2018-03-22T17:37:59","modified_gmt":"2018-03-22T13:37:59","slug":"two-severe-vulnerabilities-found-in-intels-hardware","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/two-severe-vulnerabilities-found-in-intels-hardware\/10061\/","title":{"rendered":"Two severe vulnerabilities found in Intel’s hardware"},"content":{"rendered":"

Two severe vulnerabilities<\/a> have been discovered<\/a> in Intel chips, either of which could enable attackers to seize sensitive information from apps by accessing the core memory. The first vulnerability, Meltdown, can effectively remove the barrier between user applications and sensitive parts of the operating system. The second vulnerability, Spectre, also found in AMD and ARM chips, can trick vulnerable applications into leaking their memory contents.<\/p>\n

\"Meltdown<\/a><\/p>\n

Applications installed on a device generally run in \u201cuser mode,\u201d away from the more sensitive parts of the operating system. If an app needs access to a sensitive area, for example the underlying disk, network, or processing unit, it needs to ask permission to use \u201cprotected mode.\u201d In Meltdown\u2019s case, an attacker could access protected mode and the core memory without requiring permission, effectively removing that barrier \u2014 and enabling them to potentially steal data from the memory of running apps, such as data from password managers, browsers, e-mails, and photos and documents.<\/p>\n

In practical terms, that means arbitrary memory can be read using Meltdown. This can include passwords, encryption keys, logins, credit card information, and much more. With Spectre, on the other hand, the memory of a (vulnerable) application can be read. So for example, if you visit a website, JavaScript code on the website can read the logins and passwords that are stored in your browser\u2019s memory.<\/p>\n

\n

Using #Meltdown<\/a> to steal passwords in real time #intelbug<\/a> #kaiser<\/a> #kpti<\/a> \/cc @mlqxyz<\/a> @lavados<\/a> @StefanMangard<\/a> @yuvalyarom<\/a> https:\/\/t.co\/gX4CxfL1Ax<\/a> pic.twitter.com\/JbEvQSQraP<\/a><\/p>\n

\u2014 Michael Schwarz (@misc0110) January 4, 2018<\/a><\/p><\/blockquote>\n