Unpatched Intel systems vulnerable to Foreshadow attack

Intel has disclosed a flaw in its Core chips that leaves them vulnerable to new Foreshadow attacks (also called L1 Terminal Fault or L1TF). Foreshadow, like the previously disclosed Meltdown and Spectre vulnerabilities, is a speculative execution flaw that could allow an attacker to steal sensitive information stored inside personal computers or third-party clouds. While this flaw may not be a big deal in most environments, there may be additional concerns in virtualization environments that rely on the security boundary provided by separate virtual machines.

Patches released by Intel in May and revised in June to further address Meltdown and Spectre (INTEL-SA-00115) also mitigate for Foreshadow. If you routinely update your systems when new patches and updates are available, your systems should already be protected.

According to Intel, "End users and systems administrators should check with their system manufacturers and system software vendors and apply any available updates as soon as practical."

Foreshadow was independently and concurrently discovered by two teams, one of which included Thomas F. Wenisch, a U-M assistant professor in Electrical Engineering and Computer Science.