Microsoft, Intel, and Google have jointly disclosed a new variant of the Meltdown and Spectre vulnerabilities that originally drew attention in January. So far, Intel says it hasn't yet seen any reports of the method being employed as part of "real-world exploits."
Dubbed "Variant 4," the new vulnerability uses speculative execution to expose data in a method similar to the original set of variants. The variant, Intel says, was demonstrated by researchers in a language-based runtime environment, which is commonly used in web browsers.
However, protections already deployed by browser makers for earlier variants also applicable to Variant 4. From Intel:
Starting in January, most leading browser providers deployed mitigations for Variant 1 in their managed runtimes – mitigations that substantially increase the difficulty of exploiting side channels in a web browser. These mitigations are also applicable to Variant 4 and available for consumers to use today.
Still, Intel says it is working on a combination of microcode and software updates that will provide further mitigation for Variant 4. The microcode updates are already available as a beta for OEM manufacturers and software vendors, and Intel expects them to be released "over the coming weeks." In its tests, Intel says it saw a performance impact of between two and eight percent with the mitigation enabled. However, once available, the mitigation will be off by default with the option to enable it.
In its own security advisory, Microsoft said: "At the time of publication, we are not aware of any exploitable code patterns of this vulnerability class in our software or cloud service infrastructure, but we are continuing to investigate."
Though it initially hit some snags with its first round of patches for the original exploits, Intel in March said it had released microcode updates for all of its products released in the past five years. Going forward, Intel is redesigning its processors to guard against attacks like Meltdown and Spectre.
We may earn a commission for purchases using our links. Learn more.
Dell's refreshed XPS 13 (9300) is tough competition for the Galaxy Book S
Samsung has released its ARM-based Galaxy Book S, and many are comparing it to the similarly sized Dell XPS 13 (9300). We break things down to help you make the right decision.
Microsoft's confident Xbox Series X news drip is a refreshing shift
Microsoft used to keep development pretty close to its chest, strewn through a lens of PR and over-thought marketing. Xbox seems to have turned a corner into something different.
Xbox Series X specs include 12 teraflops, confirms Microsoft's Phil Spencer
Phil Spencer, Head of Xbox, confirms that the Xbox Series X features 12 teraflops of computing power, in line with previous leaks from Windows Central.
Grab one of these great CPUs for your custom PC
No matter what level of performance you're looking for, we've rounded up the best processors for your custom rig.