exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

FreeBSD-SA-05-09.htt.txt

FreeBSD-SA-05-09.htt.txt
Posted Jul 8, 2005
Site freebsd.org

FreeBSD Security Advisory FreeBSD-SA-05:09 - When running on processors supporting Hyper-Threading Technology, it is possible for a malicious thread to monitor the execution of another thread.

tags | advisory
systems | freebsd
advisories | CVE-2005-0109
SHA-256 | 5e666245ff6f81ff72f602f77622595ea80e3cf57ceb0ef27419e4e10cfa5986

FreeBSD-SA-05-09.htt.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-05:09.htt Security Advisory
The FreeBSD Project

Topic: information disclosure when using HTT

Category: core
Module: sys
Announced: 2005-05-13
Revised: 2005-05-13
Credits: Colin Percival
Affects: All FreeBSD/i386 and FreeBSD/amd64 releases.
Corrected: 2005-05-13 00:13:00 UTC (RELENG_5, 5.4-STABLE)
2005-05-13 00:13:00 UTC (RELENG_5_4, 5.4-RELEASE-p1)
2005-05-13 00:13:00 UTC (RELENG_5_3, 5.3-RELEASE-p15)
2005-05-13 00:13:00 UTC (RELENG_4, 4.11-STABLE)
2005-05-13 00:13:00 UTC (RELENG_4_11, 4.11-RELEASE-p9)
2005-05-13 00:13:00 UTC (RELENG_4_10, 4.10-RELEASE-p14)
CVE Name: CAN-2005-0109

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

0. Revision History

v1.0 2005-05-13 Initial release.
v1.1 2005-05-13 Additional details.

I. Background

Sharing the execution resources of a superscalar processor between
multiple execution threads is referred to as "simultaneous
multithreading". "Hyper-Threading Technology" or HTT is the name used
for the implementation of simultaneous multithreading on Intel Pentium
4, Mobile Pentium 4, and Xeon processors. HTT involves sharing
certain CPU resources between multiple threads, including memory
caches. FreeBSD supports HTT when using a kernel compiled with
the SMP option.

II. Problem Description

When running on processors supporting Hyper-Threading Technology, it is
possible for a malicious thread to monitor the execution of another
thread.

NOTE: Similar problems may exist in other simultaneous multithreading
implementations, or even some systems in the absence of simultaneous
multithreading. However, current research has only demonstrated this
flaw in Hyper-Threading Technology, where shared memory caches are used.

III. Impact

Information may be disclosed to local users, allowing in many cases for
privilege escalation. For example, on a multi-user system, it may be
possible to steal cryptographic keys used in applications such as OpenSSH
or SSL-enabled web servers.

IV. Workaround

Systems not using processors with Hyper-Threading Technology support are
not affected by this issue. On systems which are affected, the security
flaw can be eliminated by setting the "machdep.hlt_logical_cpus" tunable:

# echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf

The system must be rebooted in order for tunables to take effect.

Use of this workaround is not recommended on "dual-core" systems, as
this workaround will also disable one of the processor cores.

V. Solution

Disable Hyper-Threading Technology on processors that support it.

NOTE: It is expected that future work in cryptographic libraries and
operating system schedulers may remedy this problem for many or most
users, without necessitating the disabling of Hyper-Threading
Technology. Future advisories will address individual cases.

Perform one of the following:

1) Upgrade your vulnerable system to 4-STABLE or 5-STABLE, or to the
RELENG_5_4, RELENG_5_3, RELENG_4_11, or RELENG_4_10 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 4.10,
4.11, 5.3, and 5.4 systems.

a) Download the relevant patch from the location below and verify the
detached PGP signature using your PGP utility.

[FreeBSD 4.10]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt410.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt410.patch.asc

[FreeBSD 4.11]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt411.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt411.patch.asc

[FreeBSD 5.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt5.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt5.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.

NOTE: For users that are certain that their environment is not affected
by this vulnerability, such as single-user systems, Hyper-Threading
Technology may be re-enabled by setting the tunable
"machdep.hyperthreading_allowed".

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_4
src/sys/i386/i386/mp_machdep.c 1.115.2.23
src/sys/i386/include/cpufunc.h 1.96.2.4
RELENG_4_11
src/UPDATING 1.73.2.91.2.10
src/sys/conf/newvers.sh 1.44.2.39.2.13
src/sys/i386/i386/mp_machdep.c 1.115.2.22.2.1
src/sys/i386/include/cpufunc.h 1.96.2.3.12.1
RELENG_4_10
src/UPDATING 1.73.2.90.2.15
src/sys/conf/newvers.sh 1.44.2.34.2.16
src/sys/i386/i386/mp_machdep.c 1.115.2.20.2.1
src/sys/i386/include/cpufunc.h 1.96.2.3.10.1
RELENG_5
src/sys/amd64/amd64/mp_machdep.c 1.242.2.11
src/sys/amd64/include/cpufunc.h 1.145.2.1
src/sys/i386/i386/mp_machdep.c 1.235.2.10
src/sys/i386/include/cpufunc.h 1.142.2.1
RELENG_5_4
src/UPDATING 1.342.2.24.2.10
src/sys/amd64/amd64/mp_machdep.c 1.242.2.7.2.4
src/sys/amd64/include/cpufunc.h 1.145.6.1
src/sys/conf/newvers.sh 1.62.2.18.2.6
src/sys/i386/i386/mp_machdep.c 1.235.2.6.2.3
src/sys/i386/include/cpufunc.h 1.142.6.1
RELENG_5_3
src/UPDATING 1.342.2.13.2.18
src/sys/amd64/amd64/mp_machdep.c 1.242.2.2.2.2
src/sys/amd64/include/cpufunc.h 1.145.4.1
src/sys/conf/newvers.sh 1.62.2.15.2.20
src/sys/i386/i386/mp_machdep.c 1.235.2.3.2.2
src/sys/i386/include/cpufunc.h 1.142.4.1
- -------------------------------------------------------------------------

VII. References

http://www.daemonology.net/hyperthreading-considered-harmful/

The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:09.htt.asc
-----BEGIN PGP SIGNATURE-----

iD8DBQFChJA4FdaIBMps37IRAo8nAJ9w7xtIF0atnxiKDhFOpBXEZQDtZQCghWdM
qc5lGST7l+iJEYN/7zTNUPY=
=WqEa
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close