New Vulnerability Affects All Intel Processors From The Last 6 Years

A newly discovered class of vulnerabilities in Intel processors, termed Branch Predictor Race Conditions (BPRC), allows attackers to systematically extract sensitive data from the cache and random-access memory (RAM) of other users sharing the same hardware.

Affecting all Intel processors released in the past six years-including those in consumer devices and cloud server infrastructure-the vulnerability exploits speculative execution technologies designed to accelerate computational performance.

Researchers from ETH Zurich’s Computer Security Group (COMSEC) demonstrated that malicious actors could leverage BPRC to bypass privilege barriers at the processor level, achieving unauthorized readouts of memory contents at rates exceeding 5,000 bytes per second.

This flaw poses acute risks for multi-tenant cloud environments, where shared hardware resources amplify the potential for cross-user data breaches.

Speculative Execution and Its Inherent Security Trade-Offs

Modern processors employ speculative execution to predict and precompute likely instructions, reducing latency in program execution.

By anticipating branches in code execution paths, such as conditional statements, CPUs can maintain computational throughput even during delays caused by data fetches from slower memory systems. However, this performance optimization creates side channels that attackers can exploit.

ETH Zurich’s Kaveh Razavi, head of COMSEC, notes that speculative technologies “fundamentally undermine data security” by introducing temporal gaps in privilege checks during user context switches.

The BPRC vulnerability follows a pattern seen in earlier flaws like Spectre (2017), Meltdown (2017), and Retbleed (2022), all of which manipulated speculative execution to access protected memory regions. These recurring issues highlight systemic weaknesses in how CPU architectures balance speed and security.

The BPRC vulnerability emerged from investigations into residual effects of the Retbleed patch. Johannes Wikner, a former PhD student in Razavi’s group, detected anomalous cache signals persisting regardless of Intel’s mitigation measures for Retbleed.

Sandro Rüegge, lead analyst for the BPRC research, traced these signals to a nanosecond-scale race condition occurring during privilege transitions.

When a processor switches between users or processes, it temporarily suspends speculative execution to update privilege permissions. However, BPRC exposes a critical flaw: permission updates lag behind speculative instruction precomputation by a few nanoseconds.

Attackers can inject code that triggers speculative execution during this window, causing the CPU to erroneously apply stale privileges. This allows unauthorized access to memory regions reserved for higher-privileged users or processes.

By repeating such attacks, adversaries can sequentially extract memory contents. Rüegge’s experiments demonstrated that a single exploit cycle retrieves one byte, but rapid iteration achieves 5,000+ bytes per second-enough to exfiltrate sensitive data like encryption keys or authentication tokens within minutes.

Cloud service providers face heightened risks due to their reliance on shared hardware. Virtual machines (VMs) or containers running on the same physical server often share CPU resources, creating opportunities for cross-tenant attacks.

A malicious actor could deploy a compromised VM to harvest data from co-located VMs, bypassing virtualization-layer security measures.

Enterprise data centers and public cloud platforms using Intel’s affected Xeon processors are particularly vulnerable. Attack vectors extend beyond traditional servers to edge computing nodes and IoT devices, leveraging Intel’s Atom or Core series chips.

Intel released microcode updates in late 2024 to address BPRC, requiring deployment via BIOS or operating system patches.

However, Razavi emphasizes that such fixes are stopgaps: “The series of newly discovered vulnerabilities in speculative technologies indicates fundamental architectural flaws”.

Each patch introduces performance overheads, undermining the very speed advantages speculative execution aims to provide.

For users, installing the latest Windows, Linux, or firmware updates remains critical. Cloud providers must ensure hypervisors and host systems apply these patches promptly.

Yet, as with Spectre and Meltdown, complete mitigation may require hardware redesigns a prospect complicated by the industry’s reliance on legacy x86 architectures.

BPRC underscores the need for a paradigm shift in processor architecture. Academics and industry groups are exploring alternatives such as in-order execution, which sacrifices some performance for deterministic security, and hardware-enforced isolation mechanisms like Intel’s Software Guard Extensions (SGX). However, widespread adoption of such designs remains years away.

Until then, organizations must prioritize vulnerability monitoring and layered defenses. Regular audits of firmware and microcode, coupled with intrusion detection systems tuned to cache anomalies, can reduce exposure.

For high-risk environments, migrating critical workloads to non-Intel platforms, though impractical for many, may become necessary.

As Razavi concludes, “The arms race between performance optimization and security is escalating. Without architectural overhauls, we will continue battling speculative execution flaws one patch at a time”.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar

The post New Vulnerability Affects All Intel Processors From The Last 6 Years appeared first on Cyber Security News.