4 ms·

Does anyone have a tech brief on why SMT is more dangerous than any other type of shared resource? i.e. There are several resources that are shared between core

by mbell 8y ago

Does anyone have a tech brief on why SMT is more dangerous than any other type of shared resource? i.e. There are several resources that are shared between cores on a CPU, is there something inherent about SMT that makes the resources it shares more attackable or is this just a bug?

throwaway2048 8y ago
Basically timing attacks are completely unavoidable on SMT because SMT fundamentally depends on what the other thread is doing on the core, if the thread is using few core resources the attack thread gets more, or vice versa. This gives you a very fine grained view into what the other thread is doing timing wise, and is inherent to the concept of SMT (two threads running on a core at once, using resources not utilized by the other). I suspect this issue is completely impossible to resolve in anything except very constrained situations that negate the benefit of SMT entirely. Its different than say, a timing attack on the OS scheduler for two reasons 1. OS scheduling is very coarse (A process gets exclusive use of a core for tens of thousands or hundreds of thousands of cycles), with SMT you get a very fine grained near cycle-by-cycle view of core utilization by the other process. 2. you don't get much of a view into what precisely the other thread is doing such as is it doing lots of integer operations, floating point, memory fetches etc, which can be derived in SMT attacks based on how fast such things occur for the evil monitoring thread.
- mbell 8y ago
  Is this not a problem with, for example, L3 cache that is shared across cores? Is there something inherent about it that makes timing attacks impossible or is it just that we're seeing people go after lower hanging fruit?
  - throwaway2048 8y ago
    Cache timing attacks are definitely a real thing, but cache can at least be isolated/partitioned (even if its not really currently).
kbenson 8y ago
SMT is like a shared kitchen. Even if you're unable to see the other person in it, if you go to use the sink, oven, or microwave and have to wait because it's in use, you know some small bit about the other occupant. Knowing how long you have to wait tells you more. Knowing what is already stocked in the fridge from the other occupant that you can immediately use tells you a lot. Separate cores are more like completely separate kitchens. Sure, the grocery delivery service might take shorter or longer some times, but it's hard to tell much beyond general area business from that. What's in your fridge is what you put there.

by mbell 8y ago

throwaway2048 8y ago

Basically timing attacks are completely unavoidable on SMT because SMT fundamentally depends on what the other thread is doing on the core, if the thread is using few core resources the attack thread gets more, or vice versa. This gives you a very fine grained view into what the other thread is doing timing wise, and is inherent to the concept of SMT (two threads running on a core at once, using resources not utilized by the other). I suspect this issue is completely impossible to resolve in anything except very constrained situations that negate the benefit of SMT entirely. Its different than say, a timing attack on the OS scheduler for two reasons 1. OS scheduling is very coarse (A process gets exclusive use of a core for tens of thousands or hundreds of thousands of cycles), with SMT you get a very fine grained near cycle-by-cycle view of core utilization by the other process. 2. you don't get much of a view into what precisely the other thread is doing such as is it doing lots of integer operations, floating point, memory fetches etc, which can be derived in SMT attacks based on how fast such things occur for the evil monitoring thread.

mbell 8y ago
Is this not a problem with, for example, L3 cache that is shared across cores? Is there something inherent about it that makes timing attacks impossible or is it just that we're seeing people go after lower hanging fruit?
- throwaway2048 8y ago
  Cache timing attacks are definitely a real thing, but cache can at least be isolated/partitioned (even if its not really currently).

kbenson 8y ago

SMT is like a shared kitchen. Even if you're unable to see the other person in it, if you go to use the sink, oven, or microwave and have to wait because it's in use, you know some small bit about the other occupant. Knowing how long you have to wait tells you more. Knowing what is already stocked in the fridge from the other occupant that you can immediately use tells you a lot. Separate cores are more like completely separate kitchens. Sure, the grocery delivery service might take shorter or longer some times, but it's hard to tell much beyond general area business from that. What's in your fridge is what you put there.