www.daemonology.net/hyperthreading-considered-harmful -> www.daemonology.net/hyperthreading-considered-harmful/
Hyper-Threading Considered Harmful Hyper-Threading, as currently implemented on Intel Pentium Extreme Editio n, Pentium 4, Mobile Pentium 4, and Xeon processors, suffers from a seri ous security flaw. This flaw permits local information disclosure, inclu ding allowing an unprivileged user to steal an RSA private key being use d on the same machine. Administrators of multi-user systems are strongly advised to take action to disable Hyper-Threading immediately; single-u ser systems (ie, desktop computers) are not affected.
Cache Missing for Fun and Profit, discussing this flaw and related problems, both realized and theoretica l Vendor statements The following statements have been provided to me by vendors: CVE: The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2005-0109 to the problem of information disclosure resultin g from cache evictions in simultaneous multithreading processors.
CVE list, which standardizes names for security problems. NetBSD: The NetBSD Security-Officer Team believes that workarounds will b e suitable for the majority of our users. Since this issue is a complex one, the 'right' solution will require a larger discussion which is only possible once this issue is public. This issue will be addressed in adv isory NetBSD-SA2005-001, which will provide a list of workarounds for us e until the 'final' conclusion is reached. OpenBSD: OpenBSD does not directly support hyperthreading at this time, t herefore no patch is available. Affected users may disable hyperthreadin g in their system BIOS. We will revisit this issue when hyperthreading s upport is improved.
UPDATE: Linus Torvalds has commented on this on the linux-kernel mailing list. He clearly doesn't understand the problem -- but in his defence, h e's not a security guy. Hopefully the Linux developers who do understand security will talk some sense into him. As far as I know, this flaw only exists on Intel processors. This may be because they're too busy fixing the problem, or it may be due to corporate policies which forbid such disclosures. Either way, if there isn't a statement above, it's because I haven't received one. AMD64 is the name given to the 64-bit version of the x86 architecture developed by AMD Recent Intel processors with "EM64T" use this architecture. For the past three months, I've spent almost all of my time working on this security flaw -- investigating how serious it was, contacting all of the affected vendors, explaining how this should be fixed, et cetera. I simply haven't had time to go out and get a job -- and I decided that making sure that this issue was properly reported and fixed was far more important than earning some money. In all seriousness, I'd like to spend a few months writing a completely new cryptgraphic library which is designed from the ground up to be immune to this attack, as well as all other timing attacks.
I can't guarantee that I'll be able to reply to everyone -- I have no idea how many emails I'll get -- but I will make an effort to address every serious question I receive either via personal email or on this web page. Disclosure timeline Late October, 2004: Initial discovery. December 2004: Proof-of-concept exploit written and tested. December 31, 2004: FreeBSD Security Officer Team notified of upcoming sec urity issue. February 27, 2005 - March 18, 2005: Other security teams and vendors (inc luding Intel) contacted. May 13, 2005 @ 00:00 UTC: Official public disclosure that a security flaw exists in Hyper-Threading.
|