OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns

'The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion. But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup." ' -- source: https://bsd.slashdot.org/story/18/06/19/2327212 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

On Thu, Jun 21, 2018 at 11:37:24AM +1200, Peter Reutemann wrote:
Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU.
I thought hyper-threading is about having two threads running on one CPU pipeline, thus within one core. Only just enough CPU resources (such as the register file) are duplicated so that the state of each thread can be separately maintained. By putting two threads on the one pipeline better utilisation is made of the pipeline. I suspect this will be why they are so vulnerable to the new attacks. The two threads share certain CPU resources such as the L1 cache so one can potentially perform a timing attack on the other to get an idea of what it is up to. Cheers Michael.
participants (2)
-
Michael Cree
-
Peter Reutemann