Intel won’t be patching a newly revealed side-channel vulnerability in its CPUs, even though it could be used to leak encryption keys for signing a message.
The flaw, which will be presented at the Black Hat USA 2018 conference, is why OpenBSD recently decided to disable hyperthreading on Intel CPUs.
The OpenBSD project’s chief, Theo de Raadt, said he dropped support for the feature after viewing the paper from researchers at the Systems and Network Security Group at Vrije Universiteit Amsterdam.
The Register reported on Friday that the paper details an attack on Intel’s Hyper-Threading technology to reliably extract a 256-bit EdDSA encryption key used for cryptographically signing data.
The researchers argue that their attack, dubbed TLBleed, is able to leak the keys from another program in no less than 98 percent of tests, depending on the Intel CPU architecture. The leak happens when the key is being used to sign data.
As the attack relies on Intel’s Hyper-Threading, this side-channel flaw differs from Spectre and Meltdown, which exploit speculative execution. Intel’s Hyper-Threading technology is available on Intel Core, Core vPro, Core M, and Xeon processors.
In a publicly available summary, the researchers note that the side-channel attack leaks information from the Translation Lookaside Buffers (TLB), a special type of memory cache that stores recent translations that map virtual to physical memory addresses.
If Hyper-Threading is enabled, a single core can execute multiple threads simultaneously for performance gains, but that core also shares the same memory caches and TLB.
The attack makes it possible for one thread to see how another accesses the CPU through TLB and use this information to work out secrets from another program stored in shared RAM.
“Our TLBleed exploit successfully leaks a 256-bit EdDSA key from cryptographic signing code, which would be safe from cache attacks with cache isolation turned on, but would no longer be safe with TLBleed. We achieve a 98 percent success rate after just a single observation of signing operation on a co-resident hyperthread and just 17 seconds of analysis time.”
The researchers say their attack is able to extract this key while a program is signing a message with the libgcrypt cryptographic library.
However, to exploit the flaw, an attacker would already need to have malware running on a target system or be logged in. But the vulnerability could pose a threat to virtual machines on a public cloud, which could be exploited from another instance on the same machine.
Intel appears unlikely to patch the bug and did not award the researchers payment under its side-channel bug bounty. The company has said its cache attack protections are sufficient to block TLBleed attacks.
However, Ban Gras, one of the researchers behind TLBleed, said in a tweet that the attack shows that cache side-channel protections, such as cash isolation, are not enough.