Since June 2017, a potentially disastrous security exposure has been known, and for the most part it has been kept quiet. The flaw apparently affects Microsoft and Linux operating systems (OS) and all recent Intel, ARM, and AMD computer chips in laptops, desktops, and cellphones. So far, there are no reported security breaches that depend on this “chip flaw,” and the first wave of patches is being distributed just a week after the problem was publicly announced.
Because the flaw is almost ubiquitous, it was a tempting target for sophisticated hackers and certainly for nation states. On the other hand, the flaw does not always expose valuable information to those who might attempt to exploit it.
Here is a high-level explanation of the flaw. Within a computer, the operating system (OS) executes its instructions (code) to achieve results that it or a user application needs.
For example, suppose a consumer wants to use Microsoft Word to type paragraphs into a disk-stored file. Word would need to be “launched” — i.e., OS would find the code for the Word application, assign specific memory for Word to use as its working memory, and place the beginning of Word’s code in that memory. The OS would then transfer control of the computer to the beginning of Word’s code. In the working memory assigned to it, Word code would set up parameters for a new Word document, such as file names, text characteristics, and security information. Word would also copy information between locations in its assigned memory and write information into that memory.
Word will continue executing code until it encounters a privileged instruction, i.e. an action that only the OS is permitted to do. Privileged operations include moving information to or from a channel (screen, keyboard, speakers, Wi Fi radio, or disk storage), adjusting assigned memory locations, and reading or writing memory outside the application’s assigned memory. The OS can suspend Word, copy its working memory into newly assigned area of memory, and then copy another application’s code into the memory that Word had just vacated.
Here is the glitch. The memory that OS uses is called the “kernel,” and its location is within the application’s assigned virtual memory area. Sometimes the OS places parameters from applications in its kernel, but fails to erase that area of the kernel when it transfers control to another application. A rogue application can make a lucky guess at a kernel memory address and copy information from the kernel memory into its assigned working memory. If parameters from an earlier application were in that address in the kernel, the application can copy the parameters into its own assigned working memory. It can then include the stolen information in a file, or send it out to the internet.
The security flaw exposes parameters that should have been placed beyond reach of other applications running on the computer. The fix under development for the so-called “chip flaw” could be to force the erasure of application information stored in kernel memory, or better yet to avoid storing application parameters in the kernel. There might always be a need for some application information (such as memory assignment addresses) to be stored in the kernel. Complications such as that encourage the chip makers to stay silent on the specifics of their fixes.
It seems that a fix can be a patch to a chip’s OS, although in the long run it might be tempting to build the remedy into the physical computer chip. Fortunately, there appears to be no need to alter applications.