lkml.org 
[lkml]   [2005]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Hyper-Threading Vulnerability
Uttered Linus Torvalds <torvalds@osdl.org>, spake thus:

> It does show that if you want to hide key operations, you want to be
> careful. I don't think HT is at fault per se.

Trivially easy when two processes share the same FS namespace.
Consider two files:

$ ls -l /tmp/a /tmp/b
-rw------ 1 owner owner xxxxx /tmp/a
-rw------ 1 owner owner xxxxx /tmp/b

One file serves as a clock. Note that the permissions deny all
access to everyone except the owner. The owner user then does this,
intentionally or unintentionally:

for x in 0 0 0 1 0 0 0 0 0 1
do
rm -f /tmp/a /tmp/b
case "$x" in
0 ) rm -f /tmp/a;;
1 ) touch /tmp/a;;
esac
touch /tmp/b
sleep 2
done

And the baddie does this:

let n=1
let char=0
while (($n < 8))
do
while [ ! -f /tmp/b ]; do
sleep 0.5
done
let char=((char << 1))
if [ -f /tmp/a ]; do
let char=((char + 1))
done
done
printf "The letter was: %c\n" $char

This is one of the classic TEMPEST problems that secure systems have
long had to deal with. See, at no time did HT ever raise its ugly
head ;-)

Cheers
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-05-16 19:44    [W:0.106 / U:0.316 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site