The new flaws affect processors made by Intel, ARM, AMD and IBM. They are caused by the same process of speculative execution — where actions are taken ahead of the actual instructions being read in order to gain a speed boost — that were the cause of the Meltdown and Spectre bugs which came to light earlier this year.
The four companies, along with Microsoft, Red Hat and Ubuntu, have published advice on how to mitigate the effects of these flaws.
According to a Microsoft advisory, one of the new flaws, dubbed speculative store bypass or Variant 4 — given that it is a variant of the earlier Spectre vulnerability — affects AMD, ARM and Intel processors to varying degrees. This flaw can be exploited remotely.
"Vulnerable code patterns in the operating system or in applications could allow an attacker to exploit this vulnerability."
Intel executive vice-president and general manager of Product Assurance and Security, Leslie Culbertson, said: "Variant 4 uses speculative execution, a feature common to most modern processor architectures, to potentially expose certain kinds of data through a side channel.
She added that new microcode patches would be released to fix the flaw.
The other vulnerability, dubbed Variant 3a or rogue system register read, is also due to speculative execution. Processors that perform speculative reads of system registers may allow unauthorised disclosure of system parameters to an attacker with local user access.
According to Microsoft, an attacker who exploits this vulnerability could then bypass Kernel Address Space Layout Randomisation protections.
In order to carry out an exploit, local access is required, with an attacker having to log on and then run a specially crafted application.
"The mitigation for this vulnerability is exclusively through a microcode/firmware update, and there is no additional Microsoft Windows operating system update," the company said.