2 ms·
Are those earlier-mentioned attacks against HyperThreading and caches still viable? If not, were they resolved in OpenSSL, in the OS, or in hardware?
by mappu 9y ago
Are those earlier-mentioned attacks against HyperThreading and caches still viable? If not, were they resolved in OpenSSL, in the OS, or in hardware?
- cperciva 9y agoThe particular code path which I found was leaking information was fixed in OpenSSL. Some operating systems (including FreeBSD) turned off HyperThreading by default for a while to allow software authors to fix their code, and then re-enabled it again a few years later. Intel stopped using HyperThreading for a while (it was in the Pentium 4, but that architecture was abandoned), and also made some changes to the caches which they claimed would help, but they never provided any details and I've never seen any verification of their claims in that regard. (Obviously whatever changes they made weren't enough to prevent the Spectre and Meltdown attacks conveying information through the cache!) So the best summary is that people threw up their hands and said "yeah, it's a problem, let's hope that nobody writes code which leaks any sensitive information into the microarchitectural state". Not exactly a good position to be in...