The researchers include Thomas Prescher (Cyberus Technology GmbH), Julian Stecklina (Amazon Germany), Zdenek Sojka (SYSGO AG) who reported this problem in detail. According to what they found, this vulnerability exists in the Floating Point Unit (FPU) of the processors that works to restore systems current state and switch between processes.
Most modern CPUs use Lazy FP State Restore technique to hold the current state of applications for restoring some time later as needed (hence named as ‘lazy’ state restore). The bug here deals with the way floating points are calculated and leaks information during switching of processes. Hence, a hacker could access information about the activity of other applications along with encryption operations.
As stated in Intel’s official statement,
“Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value.”
For now, Intel recommends using Eager FPU over Lazy Restore.
“For relevant states (e.g. x87, SSE, AVX, etc.), Intel recommends system software developers utilize Eager FP state restore in lieu of Lazy FP state restore.”The Lazy FP State Restore vulnerability affects all Intel Core-based microprocessors. Microsoft confirms that Lazy Restore is active in all Windows versions by default. There is no way to disable this feature. However, it does not affect systems with ARM and AMD processors. So, Azure users will remain secure from this bug. Likewise, for Linux, those versions using Eager FPU also remain unaffected.
