Jump to content
Nytro

L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack

By Nytro, in Exploituri

Recommended Posts

Nytro Mentor

Nytro

Posted
Posted

L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack

Overview

L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack, resulting in information leakage. allowing a local attacker to derive the contents of memory not belonging to the attacker.

Description

[TABLE=class: wrapper-table]

[TR]

[TD]Common L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack, as described in "Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack" by Yarom and Falkner.

By manipulating memory stored in the L3 cache by a target process and observing timing differences between requests for cached and non-cached memory, an attacker can derive specific information about the target process. The paper demonstrates an attack against GnuPG on an Intel Ivy Bridge platform that recovers over 98% of the bits of an RSA private key.

This vulnerability is an example of CWE-200: Information Exposure.[/TD]

[/TR]

[/TABLE]

Impact

[TABLE=class: wrapper-table]

[TR]

[TD]A local attacker can derive the contents of memory shared with another process on the same L3 cache (same physical CPU). Virtualization and cryptographic software are examples that are likely to be vulnerable.

An attacker on the same host operating system only needs read access to the executable file or a shared library component of the target process.

An attacker on a different virtual machine similarly needs access to an exact copy of the executable or shared library used by the target process, and the hypervisor needs to have memory page de-duplication enabled.[/TD]

[/TR]

[/TABLE]

Solution

[TABLE=class: wrapper-table]

[TR]

[TD]Apply an Update

See the Vendor Information section below for additional information.

GnuPG has released GnuPG version 1.4.14 and Libgcrypt 1.5.3 to to address this vulnerability. CVE-2013-4242 has been assigned to the specific GnuPG vulnerability described in the Yarom/Falkner paper. The CVSS score below applies specifically to CVE-2013-4242.[/TD]

[/TR]

[/TABLE]

[TABLE=class: wrapper-table]

[TR]

[TD]Disable Memory Page De-duplication

To prevent this attack on virtualization platforms, disable hypervisor memory page de-duplication.[/TD]

[/TR]

[/TABLE]

Vendor Information (Learn More)

[TABLE]

[TR=class: row-alt]

[TH=bgcolor: #EBEBEB, align: left]Vendor[/TH]

[TH=bgcolor: #EBEBEB, align: center]Status[/TH]

[TH=bgcolor: #EBEBEB, align: center]Date Notified[/TH]

[TH=bgcolor: #EBEBEB, align: center]Date Updated[/TH]

[/TR]

[TR]

[TD=class: vendor, align: left]libgcrypt[/TD]

[TD=class: status, align: center]Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]16 Aug 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]Linux KVM[/TD]

[TD=class: status, align: center]Affected[/TD]

[TD=class: notified, align: center]15 Aug 2013[/TD]

[TD=class: updated, align: center]16 Aug 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]Red Hat, Inc.[/TD]

[TD=class: status, align: center]Affected[/TD]

[TD=class: notified, align: center]13 Sep 2013[/TD]

[TD=class: updated, align: center]13 Sep 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]VMware[/TD]

[TD=class: status, align: center]Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]Xen[/TD]

[TD=class: status, align: center]Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]Cryptlib[/TD]

[TD=class: status, align: center]Not Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]GnuTLS[/TD]

[TD=class: status, align: center]Not Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]Intel Corporation[/TD]

[TD=class: status, align: center]Not Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]OpenSSL[/TD]

[TD=class: status, align: center]Not Affected[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]Amazon[/TD]

[TD=class: status, align: center]Unknown[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]AMD[/TD]

[TD=class: status, align: center]Unknown[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]16 Aug 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]Attachmate[/TD]

[TD=class: status, align: center]Unknown[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]03 Sep 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]Certicom[/TD]

[TD=class: status, align: center]Unknown[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]16 Aug 2013[/TD]

[/TR]

[TR=class: row-alt]

[TD=class: vendor, align: left]Crypto++ Library[/TD]

[TD=class: status, align: center]Unknown[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]16 Aug 2013[/TD]

[/TR]

[TR]

[TD=class: vendor, align: left]EMC Corporation[/TD]

[TD=class: status, align: center]Unknown[/TD]

[TD=class: notified, align: center]16 Aug 2013[/TD]

[TD=class: updated, align: center]16 Aug 2013[/TD]

[/TR]

[/TABLE]

If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

[TABLE]

[TR]

[TH=bgcolor: #EBEBEB, align: left]Group[/TH]

[TH=bgcolor: #EBEBEB, align: center]Score[/TH]

[TH=bgcolor: #EBEBEB, align: left]Vector[/TH]

[/TR]

[TR]

[TD=class: cvss-metric-group, align: left]Base[/TD]

[TD=class: cvss-score, align: center]2.4[/TD]

[TD=class: cvss-vector, align: left]AV:L/AC:H/Au:S/C:P/I:P/A:N[/TD]

[/TR]

[TR]

[TD=class: cvss-metric-group, align: left]Temporal[/TD]

[TD=class: cvss-score, align: center]1.9[/TD]

[TD=class: cvss-vector, align: left]E:POC/RL:OF/RC:C[/TD]

[/TR]

[TR]

[TD=class: cvss-metric-group, align: left]Environmental[/TD]

[TD=class: cvss-score, align: center]2.3[/TD]

[TD=class: cvss-vector, align: left]CDP:ND/TD:M/CR:H/IR:H/AR:ND[/TD]

[/TR]

[/TABLE]

References

Credit

Thanks to Yuval Yarom and Katrina Falkner for reporting this vulnerability and for help writing this document.

This document was written by Adam Rauf.

Other Information

  • CVE IDs: CVE-2013-4242
  • Date Public: 05 Sep 2013
  • Date First Published: 01 Oct 2013
  • Date Last Updated: 01 Oct 2013
  • Document Revision: 33

Sursa: Vulnerability Note VU#976534 - L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack

Paper: http://eprint.iacr.org/2013/448.pdf

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...