MESSAGE
| DATE | 2005-05-16 |
| FROM | From: "Inker, Evan"
|
| SUBJECT | Subject: [NYLXS - HANGOUT] Hyper-Threading Vulnerability
|
FreeBSD: Hyper-Threading Vulnerability
Posted by Jeremy on Thursday, May 12, 2005 - 17:02
http://kerneltrap.org/node/5103
Colin Percival, a FreeBSD committer and security team member, has found a
local exploit against the current implementation of Intel's Hyper-Threading
Technology. "Hyper-Threading, as currently implemented on Intel Pentium
Extreme Edition, Pentium 4, Mobile Pentium 4, and Xeon processors, suffers
from a serious security flaw," Colin explains. "This flaw permits local
information disclosure, including allowing an unprivileged user to steal an
RSA private key being used on the same machine. Administrators of multi-user
systems are strongly advised to take action to disable Hyper-Threading
immediately."
Colin will present the details behind the attack at BSDCan 2005 at 10:00 AM
EDT on May 13'th. "At the conclusion of my talk I will also be releasing a
paper describing the attack and possible mitigation strategies," Colin
explains. The flaw affects all operating systems, and for a secure
multi-user environment essentially requires that Hyper-Threading be
disabled. More information can be found on Colin's web page on the topic.
The formentioned paper can be downloaded here in pdf format.
Hyper-Threading allows multi-threaded applications to execute threads in
parallel on a single CPU. Intel's website explains, "Hyper-Threading
Technology enables this thread-level parallelism (TLP) by duplicating the
architectural state on each processor, while sharing one set of processor
execution resources. When scheduling threads, the operating system treats
the two distinct architectural states as separate 'logical' processors. This
allows multiprocessor capable software to run unmodified on twice as many
logical processors."
>From the BSDCan website, "Colin Percival is 23 years old and lives in
Vancouver, Canada. He received his B.Sc. in Mathematics from Simon Fraser
University at age 19, and is currently awaiting his D.Phil. in Computer
Science from Oxford University." More recently Colin was elected to the
Senate of Simon Fraser University.
****************************************************************************
This message contains confidential information and is intended only
for the individual or entity named. If you are not the named addressee
you should not disseminate, distribute or copy this e-mail.
Please notify the sender immediately by e-mail if you have received
this e-mail by mistake and delete this e-mail from your system.
E-mail transmission cannot be guaranteed to be secure or error-free
as information could be intercepted, corrupted, lost, destroyed, arrive
late or incomplete, or contain viruses. The sender therefore does not
accept liability for any errors or omissions in the contents of this
message which arise as a result of e-mail transmission.
If verification is required please request a hard-copy version.
This message is provided for informational purposes and should not
be construed as an invitation or offer to buy or sell any securities or
related financial instruments.
GAM operates in many jurisdictions and is
regulated or licensed in those jurisdictions as required.
****************************************************************************
|
|
