Germany calls on chip and hardware makers to tackle processor flaws

BERLIN (Reuters) - Germany's federal cyber agency called on chip and hardware-makers to address new vulnerabilities discovered in computer central processing units, but said no complete fix was possible at the moment. The BSI agency said its analysis showed the new flaws, dubbed Spectre-Next Generation, resembled the Meltdown and Spectre bugs discovered in January and could allow attackers to access personal data such as passwords and encryption keys. While no new attacks were known outside laboratories, there was a risk that attackers could develop new methods based on detailed information that had been disclosed, it added. "No complete eradication of the flaws is possible at the moment; the risk can only be minimized," it said in a statement. Temporary measures were needed since vulnerable processors and affected computer systems could only be swapped out in the longer-term, the agency said on Friday. BSI also called on cloud and virtual solution providers to immediately investigate the impact of the flaws on their products, and respond along with the manufacturers of system components. "Customers should be informed about the measures taken and the remaining risks," the agency said. A German computing magazine called c't reported earlier this month that researchers had found eight new flaws that resembled the Meltdown and Spectre bugs. It said Intel Corp planned to patch the flaws and some chips designed by ARM Holdings, a unit of Japan's Softbank <9984.T>, might be affected. Work was continuing to establish whether Advanced Micro Devices chips were vulnerable. BSI did not name any manufacturers involved. Intel has not addressed the c't article directly but said in a statement earlier this month that it uses a process called "coordinated disclosure" in which security researchers and companies agree to not release information about bugs until patches are ready. "We believe strongly in the value of coordinated disclosure and will share additional details on any potential issues as we finalize mitigations," the company said in the statement. "As a best practice, we continue to encourage everyone to keep their systems up-to-date.” AMD has said it was aware of the media reports and was examining the issue. No comment was immediately available from ARM. (Reporting by Andrea Shalal in Berlin and Stephen Nellis in San Francisco; Editing by Alexander Smith and Diane Craft)