Researchers find a vulnerability in Intel and AMD CPUs that could let hackers steal encryption keys via a side channel attack on power management feature DVFS
Dan Goodin / Ars Technica :
Context & Ripple Effects
The disclosure follows Intel-specific research into a remote data-extraction path through a power-monitor interface and the earlier Meltdown and Spectre flaws, which established that hardware behavior can expose data held by otherwise separate workloads.
By naming both Intel and AMD, the DVFS finding broadens the security focus from individual processor families to a power-management mechanism used across leading CPU vendors.
First-order effects
- Intel and AMD face a newly disclosed route for attackers to target encryption keys through DVFS, putting their processor security mitigations under immediate scrutiny.
- Organizations using Intel- and AMD-based systems must account for a hardware side channel that can expose cryptographic material rather than merely compromise an application’s own code.
Second-order effects
- The finding extends the attack-surface review prompted by Intel’s earlier power-monitor-interface vulnerability: power-management controls now warrant the same attention as processor execution paths.
- Security teams evaluating CPU-based cryptography must treat isolation between workloads as contingent on the underlying hardware behavior, a concern first made prominent by Meltdown and Spectre.
Third-order effects
- Repeated disclosures involving execution, power monitoring, and DVFS point toward hardware side channels becoming a persistent design-security category rather than isolated vendor-specific defects.
- If cross-vendor findings continue, processor competition will increasingly include how vendors limit leakage from shared physical resources while retaining performance features.
The trend: CPU security is moving toward sustained scrutiny of physical and power-management behavior that can leak secrets across software isolation boundaries.