Researchers Earn $150,000 for L1TF Exploit Leaking Data From Public Cloud

Academic researchers from Vrije Universiteit Amsterdam demonstrated that transient execution CPU vulnerabilities are practical to exploit in real-world scenarios to leak memory from VMs running on public cloud services, in what SecurityWeek describes as L1TF Reloaded, a vulnerability combining L1TF and half-Spectre.

The tests were conducted on a sole-tenant node on Google Cloud, where they leaked the TLS key of a Nginx server under noisy conditions in about 14.2 hours, and they also showed the attack could reveal host data and information about other VMs. The researchers note that while the cloud attack surface had previously seemed limited, the combined use of these gadgets can bypass mitigations and yield powerful primitives, with Google Cloud VRP awarding them a reward of $151,515, the highest tier for the programme.

According to SecurityWeek, the AWS defence mitigations prevented leaking sensitive host data in their demonstrations. The article also highlights that Google provided the tests with the sole-tenant node and that the researchers view the findings as evidence that mitigations such as XPFO and secret-free hypervisors would have prevented the attack.