Intel pays $100k 'bounty' on new Spectre variant

Intel has paid out a US$100,000 ($134,500) bug bounty for a new processor vulnerability that is “closely related” to Spectre variant one.

The figure was disclosed via the Hacker One bug bounty platform, and was almost immediately picked up by security watchers as unusual.

It was attributed via Twitter to a new processor vulnerability disclosed by Intel, which has been given the identifier CVE-2018-3693.

In a separate disclosure, Intel thanked “Vladimir Kiriansky (MIT) and Carl Waldspurger (Carl Waldspurger Consulting) for reporting and for working with the industry on coordinated disclosure” of the new vulnerability.

Kiriansky and Waldspurger's related research paper was released a short time ago. 

The researchers said they had actually found two "minor variants" to the original Spectre variant one vulnerability.

They are calling their finds Spectre1.1 and Spectre1.2, however it appears Spectre 1.1 is the main discovery for which the CVE has been created.

The paper gives a clue around the Intel payment, observing the chipmaker had denoted the research as "partially sponsored." The research was conducted in February 2018.

Intel updated Spectre documentation to include software mitigations for the new variants.

Oracle’s director of security assurance Eric Maurice confirmed his firm was looking at its own mitigations.

“A new processor vulnerability was announced today. Vulnerability CVE-2018-3693 (“Bounds Check Bypass Store” or BCBS) is closely related to Spectre v1,” Maurice said.

“As with previous iterations of Spectre and Meltdown, Oracle is actively engaged with Intel and other industry partners to develop technical mitigations against this processor vulnerability.”

Maurice noted that “new variants of exploits” using the Spectre or Meltdown flaws were likely - and expected - to be found “for the foreseeable future”.

“Fortunately, the conditions of exploitation for these issues remain similar: malicious exploitation requires the attackers to first obtain the privileges required to install and execute malicious code against the targeted systems,” he said.

The researchers said they believed "Spectre1.1 speculative buffer overflows are completely addressable by hardware."

"Rather than adding to the classic buffer overflow patch burden, future systems should be able to close this attack vector completely, with good performance," they said.

The Spectre and Meltdown chip vulnerabilities were laid bare at the start of this year.