Messages in this thread | | | Date | Mon, 16 May 2005 07:37:16 -0500 | From | Tommy Reynolds <> | Subject | Re: Hyper-Threading Vulnerability |
| |
Uttered Linus Torvalds <torvalds@osdl.org>, spake thus:
> It does show that if you want to hide key operations, you want to be > careful. I don't think HT is at fault per se.
Trivially easy when two processes share the same FS namespace. Consider two files:
$ ls -l /tmp/a /tmp/b -rw------ 1 owner owner xxxxx /tmp/a -rw------ 1 owner owner xxxxx /tmp/b
One file serves as a clock. Note that the permissions deny all access to everyone except the owner. The owner user then does this, intentionally or unintentionally:
for x in 0 0 0 1 0 0 0 0 0 1 do rm -f /tmp/a /tmp/b case "$x" in 0 ) rm -f /tmp/a;; 1 ) touch /tmp/a;; esac touch /tmp/b sleep 2 done
And the baddie does this:
let n=1 let char=0 while (($n < 8)) do while [ ! -f /tmp/b ]; do sleep 0.5 done let char=((char << 1)) if [ -f /tmp/a ]; do let char=((char + 1)) done done printf "The letter was: %c\n" $char
This is one of the classic TEMPEST problems that secure systems have long had to deal with. See, at no time did HT ever raise its ugly head ;-)
Cheers [unhandled content-type:application/pgp-signature] | |