Researchers discover fresh set of Meltdown and Spectre exploits

Researchers from Princeton University and NVIDIA have discovered (PDF) new methods to exploit the Meltdown and Spectre CPU vulnerabilities. No exploit code has been released but the paper describes MeltdownPrime and SpectrePrime techniques that can be used to conduct side-channel timing attacks.

The Register reports software mitigation for Meltdown and Spectre will likely stop these new exploits, albeit at the cost of lower performance. Unfortunately, it doesn't look like the upcoming hardware-level changes will be enough to get rid of these exploits:

The researchers suggest that while software fixes for the original flaws will also neuter variant attacks, hardware changes may not be adequate.

"Given our observations with mfence and lfence successfully mitigating Spectre and SpectrePrime in our experiments, we believe that any software techniques that mitigate Meltdown and Spectre will also be sufficient to mitigate MeltdownPrime and SpectrePrime," the paper concluded. "On the other hand, we believe that microarchitectural mitigation of our Prime variants will require new considerations."

In related news, Intel announced an extension of its bug hunting program. The chip giant is now awarding bounties of up to $250,000 for side channel vulnerabilities. Awards for other areas range up to $100,000.