Report: Intel CPUs suffer from major security flaw, fix could bring notable performance hit to macOS

Intel processors from the last decade reportedly suffer from a severe chip-level security bug that isn’t necessarily easy to fix. The Register reports that the fix must come at the OS level, and even when the fix is available, there will be a notable performance hit…

The report explains that not much is known about the bug at this point, but it calls it a “fundamental design flaw” that is “present in modern Intel processors produced in the past decade.”

The bug allows for user programs to discern the contents of protected kernel memory, which could be taken advantage of by hackers to more easily exploit other security bugs. Though, as The Register notes, it could actually be worse than that. The bug, which offers access to kernel memory, “could be abused by programs and logged-in users to read the contents of the kernel’s memory.”

The kernel’s memory space is hidden from user processes and programs because it may contain all sorts of secrets, such as passwords, login keys, files cached from disk, and so on. Imagine a piece of JavaScript running in a browser, or malicious software running on a shared public cloud server, able to sniff sensitive kernel-protected data.

A patch for this chip-level security bug isn’t pretty, either. The report explains that the fix could bring between a 5 percent and 30 percent slowdown, though more specific information is unclear at this point. The slowdown is due to how the processor must dump cached data and reload information from memory.

Currently, Microsoft and Linux developers are working on the fix. The bug also affects Intel-powered Macs as the flaw is in Intel’s x86 hardware, but Apple’s work on a fix is unclear. Becuase of the flaw being in the hardware itself, it can’t be fixed with a normal microcode update, but rather requires an OS-level fix.

These Kernel Page Table Isolation patches move the kernel into a completely separate address space, so it’s not just invisible to a running process, it’s not even there at all. Really, this shouldn’t be needed, but clearly there is a flaw in Intel’s silicon that allows kernel access protections to be bypassed in some way.

The downside to this separation is that it is relatively expensive, time wise, to keep switching between two separate address spaces for every system call and for every interrupt from the hardware. These context switches do not happen instantly, and they force the processor to dump cached data and reload information from memory. This increases the kernel’s overhead, and slows down the computer.

The Register speculates that more specific information about the bug is currently under embargo as developers work on patches. More details could come as soon as next week, directly from Intel.

Read more at The Register, which offers details on how the flaw could severely impact cloud processing and much more.

Subscribe to 9to5Mac on YouTube for more Apple news: