[HiTech RedNeck]

This is being ballyhooed by some as a Linux problem, but it sounds like it would affect security on any general purpose multiuser OS running on a hyperthreaded processor. Basically the problem lets an unprivileged process sniff out a crypto key on an unrelated, uncooperating process. Colin Percival is claiming he has implemented a successful exploit against OpenSSL, using this vulnerability. Commercial co-users of a server (does FR fall into this category, or does it have its own dedicated machines?) would seem to have cause to be nervous.

[HiTech RedNeck]

spook-in-the-night bump

[jokar]

bump

[ConservativeMind]

I've read the paper about the BSD exploit and it is a real problem. It described multiple ways to infer what was being done on the rest of the processor with moderately high to perfect precision. The next unpatched exploit could allow this to happen, communicating the data flow over a reasonably fast connection (the process requires a lot of overhead to do the inferring, so the traffic can't be the full bandwidth).

Intel is already looking at the fixes necessary for a processor microcode patch, if possible (via BIOS upgrade).

The original paper was barely a dozen pages or so in PDF format.

[SoDak]

I use OpenSSL in financial services. I've heard about this exploit, but I haven't switched to the 64 bit kernel yet on my AIX boxes due to a legacy issue with the database. The way I understood it was that the vulnerability was only present while using 64 bit kernel, although I could be wrong. We have physical safeguards in place to minimize our risk anyway.

[familyop]

The rest of the story is also important, IMO. After following the "recent Hyper-Threading vulnerability" link,...

~~~~~~~~~~~~~~~~~~~~~~~~~

http://it.slashdot.org/article.pl?sid=05/05/13/0520214&tid=172

Posted by CowboyNeal on Friday May 13, @08:07AM
from the not-just-for-performance dept.
cperciva writes "Hyper-Threading, as currently implemented on Intel Pentium Extreme Edition, Pentium 4, Mobile Pentium 4, and Xeon processors, suffers from a serious security flaw. This flaw permits local information disclosure, including allowing an unprivileged user to steal an RSA private key being used on the same machine. Administrators of multi-user systems are strongly advised to take action to disable Hyper-Threading immediately. I will be presenting this attack at BSDCan 2005 at 10:00 AM EDT on May 13th, and at the conclusion of my talk I will also releasing a paper describing the attack and possible mitigation strategies."

~~~~~~~~~~~~~~~~~~~~~

And there's the "serious security flaw" link,...

~~~~~~~~~~~~~~~~~~~~~

Hyper-Threading Considered Harmful [much more info]
http://www.daemonology.net/hyperthreading-considered-harmful/