Intel this week disclosed several new variants of the Spectre vulnerability, which originally came to light in January of this year. Security researchers Vladimir Kiriansky and Carl Waldspurger detailed two of the variants in a publicly released paper. “We introduce Spectre1.1, a new Spectre-v1 variant that leverages speculative stores to create speculative buffer over-flows,” the researchers wrote. “We also present Spectre 1.2 on CPUs that do not enforce read/write protections, speculative stores can overwrite read-only data and code pointers to breach sandboxes.”
Intel says that it paid Kiriansky a reward of $100,000 through its bug bounty program hosted on HackerOne. The company has released software fixes for most of the known Spectre bugs. A recent security report found that for the last six months no attacks have been directly using the Meltdown and Spectre vulnerabilities.
