Security researchers from Finland and Cuba have discovered a side-channel attack, known as PortSmash, that affects Intel chips and could allow attackers access to encrypted data processed from a computer’s CPU. The vulnerability exists on chipsets that use simultaneous multithreading (SMT) architecture, so it could also affect AMD chips in addition to Intel chips with Hyper-Threading technology.
Researchers claimed that they notified Intel of the vulnerability at the beginning of October, but the chip-maker did not have a patch ready until the end of the month, the same day that a proof-of-concept code was published on Github to show how the attack would work on Intel’s Skylake and Kaby Lake architectures.
For PortSmash to work, malicious code must run on the same PC using the same processor core as the legitimate code. SMT and Intel’s Hyper-Threading technology allow for codes to run on separate threads simultaneously using the same processor core. This delivers greater efficiency, as more code can be executed at the same time. However, code executed on one thread can also observe what is happening on the other thread, and an attacker could use this behavior to inject malicious code to run in tandem with a legitimate code in order to eavesdrop on the processor. The malicious code will leak out bits of encrypted data that it observed from the legitimate process, allowing an attacker to reconstruct the encrypted data from the leak.
“We detect port contention to construct a timing side channel to exfiltrate information from processes running in parallel on the same physical core,” Billy Brumley, security researcher, and one of the research paper’s authors, told The Register.
Intel has since responded to the findings of Brumley and his team, noting that the issue is not related to already widely-known vulnerabilities like Spectre or Meltdown.
“We expect that it is not unique to Intel platforms,” Intel said. “Research on side-channel analysis methods often focuses on manipulating and measuring the characteristics, such as timing, of shared hardware resources. Software or software libraries can be protected against such issues by employing side channel safe development practices. Protecting our customers’ data and ensuring the security of our products is a top priority for Intel and we will continue to work with customers, partners, and researchers to understand and mitigate any vulnerabilities that are identified.”
Brumley noted that in order for PortSmash to work, the malicious code must run on the same processor as the target machine. Brumley’s team has not tested PortSmash on AMD processors, but the plan is to see if the same kind of attack can happen on Ryzen processors in the future.
