Vulnerability Note VU#911878

Simultaneous multithreading processors may leak information through cache eviction analysis techniques

Original Release date: 23 May 2005 | Last revised: 05 Aug 2005

Overview

Operating systems on hardware platforms supporting simultaneous multi-threading (Hyper-Threading technology in particular) are potentially vulnerable to information leakage to local users. Proof of concept papers and code demonstrating successful attacks against cryptographic keys are in public circulation.

Description

Hyper-Threading (HT) Technology allows two series of instructions to run simultaneously and independently on a single processor. With Hyper-Threading Technology enabled, the system treats a physical processor as two "logical" processors. Each logical processor is allocated a thread on which to work, as well as a share of execution resources such as cache memories, execution units, and buses.

Information could potentially be deduced by local users using programs capable of shared memory cache eviction analysis. Proof of concept code using timing and cache eviction analysis techniques have demonstrated that cyptographic keys can be deduced on Intel processors with Hyper-Threading technology (HTT) . It is likely that similar techniques could be employed on other processor architectures that support simultaneous multithreading.

This vulnerability is applicable to many operating system platforms running on a hardware platform that supports simultaneous multithreading (Intel HTT in particular).

Colin Percival has released a paper "Cache Missing for Fun and Profit" that demonstrates shared access to memory caches provide a potential covert channel between threads, and also permit a malicious thread to monitor the execution of another thread, potentially allowing for theft of cryptographic keys.

Vendors have started providing patches and configuration information to disable simultaneous multithreading/HTT support.

Warning: On dual-core (multiple CPU) systems this could have the undesirable effect of disabling all but one of the CPUs. For single core (CPU) systems this workaround may still impact the performance of the server (depending on load).

Organizations need to assess whether the performance impact of disabling simultaneous multithreading/HTT support is worthwhile relative to the risk of successful compromise of sensitive information.

Impact

Sensitive information, including cryptographic key material, may be leaked to other local users on the affected system.

The paper describing this issue and its corresponding proof-of-concept exploit make assumptions about the relative quiescence of the target system. At this stage it is unclear how viable the analysis techniques outlined in the above paper would be on busy systems.

Single user workstations and systems where users do not have the ability to run their own programs are unlikely to be affected by this specific issue.

Solution

We are not aware of an all encompassing short term solution to this issue.


Workarounds

Disabling of simultaneous multithreading/HTT support at the operating system or BIOS level may reduce the likelihood of successful attack using the methods outlined in Colin's paper, however it may not mitigate against other similar types of attackes.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
FreeBSDAffected23 May 200524 May 2005
Red Hat Inc.Affected23 May 200505 Aug 2005
SCOAffected23 May 200524 May 2005
Sun Microsystems Inc.Affected23 May 200503 Jun 2005
F5 NetworksNot Affected23 May 200526 May 2005
Juniper NetworksNot Affected23 May 200502 Jun 2005
Apple Computer Inc.Unknown23 May 200524 May 2005
ConnectivaUnknown23 May 200524 May 2005
Cray Inc.Unknown23 May 200524 May 2005
DebianUnknown23 May 200524 May 2005
EMC CorporationUnknown23 May 200524 May 2005
EngradeUnknown23 May 200524 May 2005
FujitsuUnknown23 May 200524 May 2005
Hewlett-Packard CompanyUnknown23 May 200524 May 2005
HitachiUnknown23 May 200524 May 2005
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Colin Percival is credited with bringing the issue to the attention of vendors and the wider community.

This document was written by Robert Mead and Chad Dougherty.

Other Information

  • CVE IDs: CAN-2005-0109
  • Date Public: 13 May 2005
  • Date First Published: 23 May 2005
  • Date Last Updated: 05 Aug 2005
  • Severity Metric: 8.30
  • Document Revision: 22

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.