Meltdown and Spectre two vulnerabilities were discovered in Intel’s CPUs, both vulnerabilities were intended to steal data from other processes running on the same CPU. Now and after a year (approx.) a new vulnerability rose up in Intel’s CPU’s.
The vulnerability “PortSmash” (CVE-2018-5407) is also a Side Channel Vulnerability which could allow data leakage from other processes running on the same CPU core with simultaneous multithreading(SMT) feature enabled.
SMT allows to execute two threads each one from different process alongside each other on the same core of CPU, it might be possible for a process to extract some data from the other one, that’s what the team said, a team of security researchers from the Tampere University of Technology in Finland and Technical University of Havana, Cuba.
The team also published a Prof Of Concept(POC) code on Github, tested against openssl 1.1.0h cryptography library and unsurprisingly they managed to steal the private decryption keys.
Affected Hardware :
- Kaby-Lake(7th generation)
- Sky-Lake(6th generation)
- Older versions
- Possibly AMD CPU’s with SMT feature
The researchers contacted Intel's security team and reported the vulnerability about a month ago , the researchers published the POC exploit after Intel failed to provide the needed patches, they also promised to publish a paper titled "Port Contention for Fun and Profit" which explains the attack in detailed manner.
Since Intel failed to provide patches the only way to protect your self is to disable SMT in your bios, upgrading the affected applications and wait till there is a patch.
Since Intel failed to provide patches the only way to protect your self is to disable SMT in your bios, upgrading the affected applications and wait till there is a patch.
0 Comments