Simultaneous multithreading processors may leak information through cache eviction analysis techniques

Overview

Operating systems on hardware platforms supporting simultaneous multi-threading (Hyper-Threading technology in particular) are potentially vulnerable to information leakage to local users. Proof of concept papers and code demonstrating successful attacks against cryptographic keys are in public circulation.

Description

Hyper-Threading (HT) Technology allows two series of instructions to run simultaneously and independently on a single processor. With Hyper-Threading Technology enabled, the system treats a physical processor as two “logical” processors. Each logical processor is allocated a thread on which to work, as well as a share of execution resources such as cache memories, execution units, and buses.

Information could potentially be deduced by local users using programs capable of shared memory cache eviction analysis. Proof of concept code using timing and cache eviction analysis techniques have demonstrated that cyptographic keys can be deduced on Intel processors with Hyper-Threading technology (HTT) . It is likely that similar techniques could be employed on other processor architectures that support simultaneous multithreading.

This vulnerability is applicable to many operating system platforms running on a hardware platform that supports simultaneous multithreading (Intel HTT in particular).

Colin Percival has released a paper “Cache Missing for Fun and Profit” that demonstrates shared access to memory caches provide a potential covert channel between threads, and also permit a malicious thread to monitor the execution of another thread, potentially allowing for theft of cryptographic keys.

Vendors have started providing patches and configuration information to disable simultaneous multithreading/HTT support.

**Warning:**On dual-core (multiple CPU) systems this could have the undesirable effect of disabling all but one of the CPUs. For single core (CPU) systems this workaround may still impact the performance of the server (depending on load).

Organizations need to assess whether the performance impact of disabling simultaneous multithreading/HTT support is worthwhile relative to the risk of successful compromise of sensitive information.

---

Impact

Sensitive information, including cryptographic key material, may be leaked to other local users on the affected system.

The paper describing this issue and its corresponding proof-of-concept exploit make assumptions about the relative quiescence of the target system. At this stage it is unclear how viable the analysis techniques outlined in the above paper would be on busy systems.

Single user workstations and systems where users do not have the ability to run their own programs are unlikely to be affected by this specific issue.

---

Solution

We are not aware of an all encompassing short term solution to this issue.

---

Workarounds

Disabling of simultaneous multithreading/HTT support at the operating system or BIOS level may reduce the likelihood of successful attack using the methods outlined in Colin’s paper, however it may not mitigate against other similar types of attackes.

---

Vendor Information

911878

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

FreeBSD __ Affected

Notified: May 23, 2005 Updated: May 24, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

FreeBSD has released a security advisory FreeBSD-SA-05:09.htt available from:

<ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:09.htt.asc&gt;

FreeBSD has also released patches to disable HTT support.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Red Hat Inc. __ Affected

Notified: May 23, 2005 Updated: August 05, 2005

Status

Affected

Vendor Statement

Vendor Statement: Red Hat, Inc

Updated packages for Red Hat Enterprise 2.1, 3, and 4 are available to mitigate this and related attacks against OpenSSL:

<http://rhn.redhat.com/errata/CAN-2005-0109.html&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

SCO __ Affected

Notified: May 23, 2005 Updated: May 24, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

SCO has released two security advisories about “Hyper-Threading information leakage”, they are available from:

<ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.24/SCOSA-2005.24.txt&gt;
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.24/SCOSA-2005.24.txt

The security advisories state:
“This issue affects OpenServer 5.0.7 if SMP is installed and any Update Pack is applied. It also affects UnixWare 7.1.4 and 7.1.3 if Hyper-Threading is enabled. (Hyper-Threading is disabled in UnixWare by default.)”

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Sun Microsystems Inc. __ Affected

Notified: May 23, 2005 Updated: June 03, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Sun have released a Sun(sm) Alert Notification available at:

<http://sunsolve.sun.com/search/document.do?assetkey=1-26-101739-1&gt;

Sun state that Solaris on the SPARC platform is not affected by this issue.
The alert contains information on four mitigation options, see the alert for details.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

F5 Networks __ Not Affected

Notified: May 23, 2005 Updated: May 26, 2005

Status

Not Affected

Vendor Statement

F5 Products are not vulnerable to VU911878, the hyperthreading information leakage issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Juniper Networks __ Not Affected

Notified: May 23, 2005 Updated: June 02, 2005

Status

Not Affected

Vendor Statement

The hyper-threading (HTT) support in FreeBSD kernels is only
available when the kernel is configured to support symmetric
multi-processing (SMP). JUNOS is not currently configured and built
to utilize SMP for any of our platforms. Of our platforms, the
J-Series is the only one for which the hardware could physically
support HTT. There is no plan to enable HTT on the J-Series platform
for any current releases.

Juniper E-series and ScreenOS are not based on FreeBSD, and therefore
not affected.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Apple Computer Inc. __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Connectiva __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Cray Inc. __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Debian __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

EMC Corporation __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Engrade __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Fujitsu __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Hewlett-Packard Company __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Hitachi __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

IBM __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Immunix __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Ingrian Networks __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Intel __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Mandriva Inc. __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Microsoft Corporation __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

MontaVista Software __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

NEC Corporation __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

NetBSD __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Nokia __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Novell __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

OpenBSD __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Openwall GNU/*/Linux __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

QNX __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

SGI __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Sequent __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Sony Corporation __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

SuSE Inc. __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

TurboLinux __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

Unisys __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

WRS __ Unknown

Notified: May 23, 2005 Updated: May 24, 2005

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

US-CERT has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23911878 Feedback>).

View all 36 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:09.htt.asc&gt;
• <http://www.daemonology.net/hyperthreading-considered-harmful/&gt;
• <http://www.daemonology.net/papers/htt.pdf&gt;
• <http://cr.yp.to/antiforgery/cachetiming-20041111.pdf&gt;
• <http://jvn.jp/cert/JVNVU%23911878/index.html&gt;

Acknowledgements

Colin Percival is credited with bringing the issue to the attention of vendors and the wider community.

This document was written by Robert Mead and Chad Dougherty.

Other Information

CVE IDs:	CVE-2005-0109
Severity Metric:	8.30 Date Public: