Yesterday, Intel disclosed a new attack on its processor dubbed "ZombieLoad," following in the footsteps of last year's "Spectre" and "Meltdown" security snafu. The CPU producer has informed other companies of the problems before the public, and thus many devices and OS manufacturers have already patched their software. Among the now-secured products is Google’s ChromeOS, but not Android running on Intel silicon.
The attack itself is officially called Microarchitectural Data Sampling (MDS) and consists of four distinctive security exploits that play together to provide targets for attackers.
"Under certain conditions, MDS provides a program the potential means to read data that program otherwise would not be able to see," Intel writes. "MDS techniques are based on a sampling of data leaked from small structures within the CPU using a locally executed speculative execution side channel." However, while the issue is severe, it doesn't allow attackers to target specific programs or files: "MDS does not, by itself, provide an attacker with a way to choose the data that is leaked." So far, the company is not aware of any real-world exploits through MDS.
Luckily, most Google users are not affected by the problems. Chrome OS was already patched May 1 with version 74 (by turning off Hyper-Threading, which you can turn back on), with additional mitigations scheduled for 75. The Chrome browser, however, has to rely on fixes provided by the operating system on which it runs. Most Android users are not affected at all, either, since the issue doesn't arise on ARM processors. Unfortunately, Google doesn't have a fix for the few devices that do use Intel chips and writes: "For Intel-based systems that are not Chrome OS devices, users should contact their device manufacturer for available updates."
Intel tried downplaying the problems, especially since it's plagued by many of these so-called side-channel attacks as of late. It even wouldn't pay out the highest tier award for the researcher who first found the exploit. Still, the company reacted quickly and managed to fix the issues with fewer performance hits than hotfixes for previous security snafus, which is a good thing.