Just when Intel Corp. was addressing the Spectre security vulnerabilities first revealed in January, researchers have spoiled the party by revealing a new, previously unknown variant.

Dubbed SgxPectre, the vulnerability allows an attacker to undertake a so-called side-channel attack via Intel’s SGX secure environments. SGX, short for Software Guard Extensions, is a set of central processing unit chip instructions that can be used by developers to create applications to set aside private regions of code and data.

Using SGX, application code can be put into an “enclave,” an isolated execution environment to protect sensitive data from unauthorized access or modification by rogue software running at higher privilege levels. But as it turns out, that same access can also be exploited.

Detailed in a paper published last week by researchers at Ohio State University, the attack exploits software supported via software development kits for SGX, including Intel SGX Software Development Kit, Rust-SGX and Graphene-SGX. Using those SDKs, attackers can create their own SGX enclaves that are designed to create repetitive code executions — the same way previous Spectre variants can confuse a CPU to steal data from it.

Although that sounds bad, there is a good news: Intel has already promisedg a fix.

“We are aware of the research paper from Ohio State and have previously provided information and guidance online about how Intel SGX may be impacted by the side channel analysis vulnerabilities,” Intel said in a statement reported by Neowin. “We anticipate that the existing mitigations for Spectre and Meltdown, in conjunction with an updated software development toolkit for SGX application providers — which we plan to begin making available on March 16th — will be effective against the methods described in that research. We recommend customers make sure they are always using the most recent version of the toolkit.”

Intel last released a microcode update to address Spectre Variant 2 on Feb. 21, and Microsoft released a Windows variant of the same code March 1.

Image: Wikimedia Commons