The vulnerability dubbed 'Reptar' (CVE-2023-23583), is the third major CPU vulnerability revealed by Google researchers so far this year followed by Downfall (CVE-2022-40982) and Zenbleed (CVE-2023-20593), affecting Intel and AMD CPUs, respectively.
According to a blog post published by Google, Reptar stems from how redundant prefixes are interpreted by the Intel CPU.
Prefixes modify CPU instruction behavior by enabling or disabling certain features. Typically, redundant prefixes are ignored. However, Reptar allows attackers to bypass the CPU's security boundaries by exploiting how it handles redundant prefixes.
The security implications of this vulnerability are massive. The researcher demonstrated Reptar can be exploited in multi-tenant virtualized environments, common in cloud and data centers, to crash the host machine and cause denial-of-service to other guest machines sharing the host. There is also potential for information disclosure or escalation of privilege.
Reptar marks the third high-profile CPU vulnerability revealed by Google this year. In August, researchers disclosed Downfall which impacted Intel CPUs by abusing the CPU's privilege rings to bypass sandboxing technologies used for security. A few weeks later, Google dropped details on Zenbleed affecting AMD CPUs by exploiting deferred messages between processor cores.
With Reptar, it's evident that CPUs remain vulnerable to security flaws, especially as they grow more complex. Google is seeing more of these types of vulnerabilities lately that can affect billions of devices if left unaddressed.
That's why the company continues to dedicate resources to identifying hardware and CPU vulnerabilities proactively. As soon as Reptar was found internally, Google says they quickly looped in Intel and industry partners to develop and test mitigations before it became an issue.
Through close collaboration, mitigations have already been rolled out to protect users. Google ensured its services like Google Cloud and ChromeOS were immunized before publicly disclosing Reptar. The company credits this coordinated vulnerability disclosure process for keeping users safe.
Intel has published an updated microcode for all affected processors. Your operating system or BIOS vendor may already have an update available!
You can read more technical details about the vulnerability on the researcher’s blog.