New CPU vulnerability extends to virtual machine environment