A mio avviso conferma il fatto che non ci può essere sicurezza nazionale senza "indipendenza" e controllo della industria dei processori e dei semiconduttori, cosa che l’Europa ha dismesso e obiettivo che non è nemmeno analizzato, e che la Cina ha messo come priorità per il 2025 per sganciarsi dal predominio USA

ricordo che ARM è diventata giapponese, tutte le altre  aziende di microprocessori sono USA o , secondariamente, coreane o cinesi e le foundry significative in USA, Taiwan e parte Cina

g


https://www.zdnet.com/article/ex-intel-security-expert-this-new-spectre-attack-can-even-reveal-firmware-secrets/


Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets

A new variant of Spectre can expose the contents of memory that normally can't be accessed by the OS kernel.

By Liam Tung | May 18, 2018 -- 12:55 GMT (13:55 BST) | Topic: Security

 

Yuriy Bulygin, the former head of Intel's advanced threat team, has published research showing that the Spectre CPU flaws can be used to break into the highly privileged CPU mode on Intel x86 systems known as System Management Mode (SMM).

Spectre and Meltdown vulnerabilities enable software attacks using CPU design flaws common to Intel, AMD, and Arm chips to access secrets stored in memory.

Bulygin, who has launched security firm Eclypsium, has modified Spectre variant 1 with kernel privileges to attack a host system's firmware and expose code in SMM, a secure portion of BIOS or UEFI firmware.

SMM resides in SMRAM, a protected region of physical memory that should only be accessible by BIOS firmware and not the operating system kernel, hypervisors or security software.

SMM handles especially disruptive interrupts and is accessible through the SMM runtime of the firmware, knows as System Management Interrupt (SMI) handlers.

As a former Intel researcher explained in a 2013 paper, when an SMI event occurs, say, due to thermal throttling or system health checks, all the CPU's cores enter SMM or system management mode.

"Because SMM generally has privileged access to physical memory, including memory isolated from operating systems, our research demonstrates that Spectre-based attacks can reveal other secrets in memory (eg, hypervisor, operating system, or application)," Bulygin explains.

To expose code in SMM, Bulygin modified a publicly available proof-of-concept Spectre 1 exploit running with kernel-level privileges to bypass Intel's System Management Range Register (SMRR), a set or range registers that protect SMM memory.

"These enhanced Spectre attacks allow an unprivileged attacker to read the contents of memory, including memory that should be protected by the range registers, such as SMM memory," he notes.

"This can expose SMM code and data that was intended to be confidential, revealing other SMM vulnerabilities as well as secrets stored in SMM. Additionally, since we demonstrate that the speculative memory access occurs from the context of SMM, this could be used to reveal other secrets in memory as well."