Researchers Earn $150,000 for L1TF Exploit Leaking Data From Public Cloud

Academic researchers from Vrije Universiteit Amsterdam have demonstrated that transient execution CPU vulnerabilities are practical to exploit in real-world scenarios to leak memory from VMs running on public cloud services. The research shows that L1TF (L1 Terminal Fault), also known as Foreshadow, a bug in Intel processors reported in January 2018, and half-Spectre, gadgets believed unexploitable on new-generation CPUs, as they cannot directly leak secret data, can be used together to leak data from the public cloud.

The researchers conducted their tests on a sole-tenant node on Google Cloud and demonstrated they could “leak the TLS key of a Nginx server in a victim VM under noisy conditions, without detailed knowledge of either host or guest” in an average time of 14.2 hours.

To read the complete article, see: Security Week.