WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] HT Vulnerability CAN-2005-0109

To: xen-devel@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-devel] HT Vulnerability CAN-2005-0109
From: Mark Williamson <mark.williamson@xxxxxxxxxxxx>
Date: Wed, 18 May 2005 15:48:48 +0100
Cc: Nils Toedtmann <xen-devel@xxxxxxxxxxxxxxxxxx>
Delivery-date: Wed, 18 May 2005 14:54:08 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <1116427424.4496.17.camel@xxxxxxxxxxxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Organization: University of Cambridge
References: <1116427424.4496.17.camel@xxxxxxxxxxxxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: KMail/1.8
> Sorry if this is a dupe. I quickly checked the lists and the bitkeeper
> changesets but found no reference. If i missed it, ignore this mail.

No, this hasn't been mentioned on the lists yet.

> Just stumbled on /. upon CAN-2005-0109 and wonder if xen is affected:
>
>   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0109>
>   <http://www.daemonology.net/hyperthreading-considered-harmful/>

This vulnerability could (in principle) affect isolation between Xen VMs.  
It's not clear how exploitable it is, though.

> I have _no_clue_ about OS internals, processors or programming, but as i
> understood the abstract this is a bug on some intel pentium/xeon cpus in
> their hyperthreading implementation (i read it "ht threads share cpu
> cache in a way that information leaks from one thread to another"). The
> author states that the OS kernel (here: the xen kernel) could workaround
> that bug.

Yes, it's possible to imagine various strategies to work around this problem.

> Is it possible that two domain kernels running on the same physical core
> but on different ht threads leak information to each other exploiting
> this covert/side channels?

Theoretically possible but not necessarily a problem in practice.

Covert channels will *always* be there.  The problem with this channel is that 
it is potentially rather high bandwidth and that it can be used as a side 
channel to try to capture crypto keys from OpenSSL.

Someone has yet to release code that'll actually exploit these theoretical 
holes, so it's not clear how big a problem is in practice.

Cheers,
Mark

> I apologize in advance if all this does not make sense ...
>
> /nils.
>
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel