Overview
L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack, resulting in information leakage. allowing a local attacker to derive the contents of memory not belonging to the attacker.
Description
Common L3 CPU shared cache architecture is susceptible to a Flush+Reload side-channel attack, as described in "Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack" by Yarom and Falkner. By manipulating memory stored in the L3 cache by a target process and observing timing differences between requests for cached and non-cached memory, an attacker can derive specific information about the target process. The paper demonstrates an attack against GnuPG on an Intel Ivy Bridge platform that recovers over 98% of the bits of an RSA private key. |
Impact
A local attacker can derive the contents of memory shared with another process on the same L3 cache (same physical CPU). Virtualization and cryptographic software are examples that are likely to be vulnerable. |
Solution
Apply an Update |
Disable Memory Page De-duplication |
Vendor Information
Any shared cache architecture may be susceptible to side-channel or timing attacks. CPU vendors are listed as "Not Affected" since the cache architecture is functioning as designed. It is generally up to an operating system or application to take appropriate measures to protect sensitive information. |
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 2.4 | AV:L/AC:H/Au:S/C:P/I:P/A:N |
| Temporal | 1.9 | E:POC/RL:OF/RC:C |
| Environmental | 2.3 | CDP:ND/TD:M/CR:H/IR:H/AR:ND |
References
Acknowledgements
Thanks to Yuval Yarom and Katrina Falkner for reporting this vulnerability and for help writing this document.
This document was written by Adam Rauf.
Other Information
| CVE IDs: | CVE-2013-4242 |
| Date Public: | 2013-09-05 |
| Date First Published: | 2013-10-01 |
| Date Last Updated: | 2013-11-01 21:12 UTC |
| Document Revision: | 40 |