Yesterday, news broke that Intel CPUs suffer from a serious security flaw that allows user programs to access contents of the protected kernel memory. Details were sparse when the original news broke, but Intel has now publicly commented on the flaw and it appears that Apple has already issued a patch…
According to developer Alex Ionescu, macOS 10.13.2, originally released on December 6th, includes a fix for the kernel security bug. Furthermore, additional fixes are purportedly included in macOS 10.13.3, which is still in beta testing.
AppleInsider also says that “multiple sources within Apple” have said macOS 10.13.2 fixed “most” of the security holes. Meanwhile, Linux and Microsoft developers are still in the process of deploying their respective fixes.
While Apple itself has yet to publicly acknowledge the bug, Intel today did issue a statement on the matter. The chipmaker explains that reports indicating the flaw is limited to Intel products only are incorrect, with AMD and ARM processors also purportedly affected.
Intel says it is working closely with “many other technology companies” to develop an “industry-wide approach” to solve the problem.
Intel’s statement is interesting in that it seems to focus more on the media coverage of the bug rather than the bug itself. Intel says it had originally planned to acknowledge the issue next week when “more software and firmware updates will be made available,” but was forced to issue today’s statement “because of the current inaccurate media reports.”
The inaccuracy Intel seemingly refers to is that AMD and ARM were not originally reported as suffering from the same security hole.
We’ve reached out to Apple for comment on the macOS fix for this bug and will update if we learn more.
Here is Intel’s full statement:
Recent reports that these exploits are caused by a “bug” or a “flaw” and are unique to Intel products are incorrect. Based on the analysis to date, many types of computing devices — with many different vendors’ processors and operating systems — are susceptible to these exploits.
Intel is committed to product and customer security and is working closely with many other technology companies, including AMD, ARM Holdings and several operating system vendors, to develop an industry-wide approach to resolve this issue promptly and constructively. Intel has begun providing software and firmware updates to mitigate these exploits. Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.
Intel is committed to the industry best practice of responsible disclosure of potential security issues, which is why Intel and other vendors had planned to disclose this issue next week when more software and firmware updates will be available. However, Intel is making this statement today because of the current inaccurate media reports.
Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. Following good security practices that protect against malware in general will also help protect against possible exploitation until updates can be applied. Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers.
