Intel has paid out a $100,000 bug bounty for new processor vulnerabilities that are related to Spectre variant one.
The new Spectre-class variants are tracked as Spectre 1.1 (CVE-2018-3693) and Spectre 1.2, of which Spectre 1.1 described as a bounds-check bypass store attack has been considered as more dangerous.
How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%
Spectre flaws take advantage of speculative execution, an optimization technique used by modern CPUs, to potentially expose sensitive data through a side channel by observing the system.
Speculative execution is a core component of modern processors design that speculatively executes instructions based on assumptions that are considered likely to be true. If the assumptions come out to be valid, the execution continues, otherwise discarded.
A team of researchers—Vladimir Kiriansky of MIT and Carl Waldspurger of Carl Waldspurger Consulting—has now discovered two sub-variants of Spectre Variant one.
The new Spectre variants come almost a month after researchers from Microsoft and Google disclosed a Spectre Variant 4 impacting modern CPUs in millions of computers, including those marketed by Apple.
Read more: The Hacker News
