BERLIN (Reuters) – Germany’s federal cyber agency called on chip and hardware-makers to address new vulnerabilities discovered in computer central processing units, but said no complete fix was possible at the moment.
The BSI agency said its analysis showed the new flaws, dubbed Spectre-Next Generation, resembled the Meltdown and Spectre bugs discovered in January and could allow attackers to access personal data such as passwords and encryption keys.
While no new attacks were known outside laboratories, there was a risk that attackers could develop new methods based on detailed information that had been disclosed, it added.
“No complete eradication of the flaws is possible at the moment; the risk can only be minimized,” it said in a statement.
Temporary measures were needed since vulnerable processors and affected computer systems could only be swapped out in the longer-term, the agency said on Friday.
BSI also called on cloud and virtual solution providers to immediately investigate the impact of the flaws on their products, and respond along with the manufacturers of system components.
“Customers should be informed about the measures taken and the remaining risks,” the agency said.
A German computing magazine called c’t reported earlier this month that researchers had found eight new flaws that resembled the Meltdown and Spectre bugs.
It said Intel Corp planned to patch the flaws and some chips designed by ARM Holdings, a unit of Japan’s Softbank, might be affected. Work was continuing to establish whether Advanced Micro Devices chips were vulnerable.
BSI did not name any manufacturers involved.
Intel has declined to comment on the vulnerabilities described in c’t magazine, while AMD has said it was aware of the media reports and was examining the issue.
No comment was immediately available from ARM.
Reporting by Andrea Shalal; Editing by Alexander Smith
Get more stuff like this
Subscribe to our mailing list and get interesting stuff and updates to your email inbox.
Thank you for subscribing.
Something went wrong.